arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2601.06367cs.NI
收藏

ReAct:针对非对称路由的反射攻击缓解

ReAct: Reflection Attack Mitigation For Asymmetric Routing

The Hebrew University of Jerusalem(耶路撒冷希伯来大学);Princeton University(普林斯顿大学);Oberlin College(欧柏林学院);University of Haifa(海法大学)

David Hay, Mary Hogan, Shir Landau Feibish

AI总结:

ReAct是一种针对非对称路由的AR-DDoS防御机制,通过可编程数据平面和滑动窗口Bloom过滤器实现跨交换机的请求-响应相关性,有效过滤攻击流量并减少误报。

摘要:

放大反射分布式拒绝服务(AR-DDoS)攻击仍然是一个严峻的威胁,利用无状态协议向受害者发送非法流量。最近的进展使数据平面能够防御此类攻击,但现有解决方案通常假设对称路由且仅限于单个交换机。这些假设在现代网络中失效,因为非对称性很常见,导致合法响应被丢弃和持续的连接问题。本文提出了ReAct,一种针对AR-DDoS的网络内防御机制,具有对非对称性的鲁棒性。ReAct通过可编程数据平面和滑动窗口的Bloom过滤器,在交换机之间执行请求-响应相关性。为处理非对称流量,ReAct引入了一种基于数据平面的请求转发机制,使交换机能够在路径不同的情况下验证响应。ReAct能够自动适应路由变化,只需最小干预,确保在动态网络环境中持续保护。我们在P4解释器和NVIDIA Bluefield-3上实现了ReAct,展示了其在多个平台上的适用性。评估结果表明,ReAct过滤了几乎所有攻击流量,而不会丢弃合法响应,即使在高流量攻击和非对称情况下也是如此。与现有最先进方法相比,ReAct实现了显著更低的误报率。据我们所知,ReAct是首个支持动态、跨交换机协作的数据平面AR-DDoS防御机制,使其在具有非对称性的网络中具有独特适用性。

英文摘要:

Amplification Reflection Distributed Denial-of-Service (AR-DDoS) attacks remain a formidable threat, exploiting stateless protocols to flood victims with illegitimate traffic. Recent advances have enabled data-plane defenses against such attacks, but existing solutions typically assume symmetric routing and are limited to a single switch. These assumptions fail in modern networks where asymmetry is common, resulting in dropped legitimate responses and persistent connectivity issues. This paper presents ReAct, an in-network defense for AR-DDoS that is robust to asymmetry. ReAct performs request-response correlation across switches using programmable data planes and a sliding-window of Bloom filters. To handle asymmetric traffic, ReAct introduces a data-plane-based request forwarding mechanism, enabling switches to validate responses even when paths differ. ReAct can automatically adapt to routing changes with minimal intervention, ensuring continued protection even in dynamic network environments. We implemented ReAct on both a P4 interpreter and NVIDIAs Bluefield-3, demonstrating its applicability across multiple platforms. Evaluation results show that ReAct filters nearly all attack traffic without dropping legitimate responses-even under high-volume attacks and asymmetry. Compared to state-of-the-art approaches, ReAct achieves significantly lower false positives. To our knowledge, ReAct is the first data-plane AR-DDoS defense that supports dynamic, cross-switch collaboration, making it uniquely suitable for deployment in networks with asymmetry.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑