使用可编程商品交换机的网络内体积DDoS受害者识别
In-Network Volumetric DDoS Victim Identification Using Programmable Commodity Switches
摘要：
分布式拒绝服务（DDoS）攻击已经成为现代电信网络最重要的威胁之一。然而，大多数现有的防御系统需要检测软件从集中式监控收集器运行，导致流量负载增加和响应延迟。最近出现的数据平面可编程性（DPP）实现了一种替代解决方案：基于阈值的容量DDoS检测可以直接在可编程交换机中执行，以仅浏览潜在的危险流量，并在控制器中进行深入分析。本文首先介绍了基于草图的BACON数据结构，用于估计每个目的地的流量基数，并对其进行了理论分析，然后将其应用于一个简单的网络内DDoS受害者识别策略INDDoS中，检测到目标IP的传入连接数超过预定义的阈值。我们描述了它的硬件实现Tofino为基础的可编程交换机使用特定领域的P4语言，证明了一些限制所施加的真正的硬件，以保障处理速度可以克服实现相对复杂的数据包操作。最后，我们提出了一些实验性能测量，表明我们的可编程交换机能够保持处理数据包的线速率，同时进行体积DDoS检测，并实现了高F1分数的DDoS受害者识别。
英文摘要：
Volumetric distributed Denial-of-Service (DDoS) attacks have become one of the most significant threats to modern telecommunication networks. However, most existing defense systems require that detection software operates from a centralized monitoring collector, leading to increased traffic load and delayed response. The recent advent of Data Plane Programmability (DPP) enables an alternative solution: threshold-based volumetric DDoS detection can be performed directly in programmable switches to skim only potentially hazardous traffic, to be analyzed in depth at the controller. In this paper, we first introduce the BACON data structure based on sketches, to estimate per-destination flow cardinality, and theoretically analyze it. Then we employ it in a simple in-network DDoS victim identification strategy, INDDoS, to detect the destination IPs for which the number of incoming connections exceeds a pre-defined threshold. We describe its hardware implementation on a Tofino-based programmable switch using the domain-specific P4 language, proving that some limitations imposed by real hardware to safeguard processing speed can be overcome to implement relatively complex packet manipulations. Finally, we present some experimental performance measurements, showing that our programmable switch is able to keep processing packets at line-rate while performing volumetric DDoS detection, and also achieves a high F1 score on DDoS victim identification.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
