Source-linked AI summary
A New Approach to DDoS Defense using SDN and NFV
Seyed K. Fayaz, Yoshiaki Tobioka, Vyas Sekar, Michael Bailey
TL;DR
Fixed-location proprietary appliances limit DDoS defense flexibility and elasticity, motivating SDN/NFV-based alternatives. Bohatei implements elastic defense placement, responsive resource management, proactive orchestration, and adaptation, with evaluations showing scalable, rapidly responding, and resilient operation.
Problem
Fixed-location proprietary appliances limit DDoS defense flexibility and elasticity as attack types and volumes change.
Method
Bohatei uses SDN/NFV to vary defense VM scale and type, steer suspicious traffic, and address resource, orchestration, and adversary challenges.
Results
Bohatei’s prototype evaluations show scalable, rapidly responding, and resilient DDoS defense, including operation against 500 Gbps attacks.
Takeaways & Limitations
The system demonstrates that SDN/NFV can support flexible and elastic DDoS defense across several known attack types and dynamic adversaries.
Takeaways & Limitations
The ILP formulation is optimal but takes several hours, while the threat model fixes the adversary’s maximum attack-traffic budget.
Abstract
from arXiv · showhide
Networks today rely on expensive and proprietary hard- ware appliances, which are deployed at fixed locations, for DDoS defense. This introduces key limitations with respect to flexibility (e.g., complex routing to get traffic to these "chokepoints") and elasticity in handling changing attack patterns. We observe an opportunity to ad- dress these limitations using new networking paradigms such as software-defined networking (SDN) and network functions virtualization (NFV). Based on this observation, we design and implement of Bohatei, an elastic and flexible DDoS defense system. In designing Bohatei, we address key challenges of scalability, responsive- ness, and adversary-resilience. We have implemented defenses for several well-known DDoS attacks in Bohatei. Our evaluations show that Bohatei is scalable (handling 500 Gbps attacks), responsive (mitigating attacks within one minute), and resilient to dynamic adversaries.
1 Introduction
Bohatei applies SDN/NFV to make DDoS defense flexible and elastic while addressing responsiveness, scalability, and dynamic adversaries. Its prototype and evaluation demonstrate practical defenses and scalable, resilient operation.
- Motivation: 20,000-plus daily attacks and peak volumes of 0.5 Tbps underscore the scale and diversity of the DDoS threat.Reported impacts include monetary losses and loss of customer trust.
- Motivation: Fixed-location, proprietary appliances constrain defense placement, attack functionality, and traffic-processing capacity.Operators must either overprovision appliances or reroute traffic to centralized scrubbing sites.
- Approach: SDN/NFV provide the basis for flexible placement and elastic scaling of defenses according to attack type and volume.SDN steers suspicious traffic, while NFV varies defense VM scale and type.
- Design challenges: Bohatei addresses resource-management, SDN orchestration, and dynamic-adversary challenges through responsive algorithms, proactive forwarding, and adaptation.Its contributions include a resource-management algorithm, tag-based forwarding, and an adaptation strategy.
- Implementation: The system includes defenses for several known DDoS attacks and is implemented on industry-grade SDN/NFV platforms.The implementation uses OpenDaylight and open-source defense tools such as Open vSwitch, Snort, Bro, and iptables.
- Evaluation: Bohatei is reported to scale to 500 Gbps attacks, support ISPs with about 200 backbone routers, and cope effectively with dynamic adversaries.The evaluation used both a real testbed and simulations.
2 Background and Motivation
SDN and NFV offer DDoS defense benefits by reducing dependence on fixed hardware, simplifying routing, and enabling elastic, attack-specific deployment. Bohatei motivates these benefits with cost, latency, time-to-market, resource-footprint, and vendor-flexibility examples.
- SDN and NFV foundations: SDN decouples network control from packet forwarding, enabling centralized programming of network behavior.This addresses the complexity and brittleness of tightly coupled traditional network management.
- Cost and deployment: A 10 Gbps defense appliance costs approximately $128,000 versus about $3,000 for a commodity server with a 10 Gbps NIC.The paper estimates a potential 1-2 orders of magnitude reduction in capital expenses, excluding software and development costs.
- SDN and NFV foundations: NFV virtualizes network functions to reduce cost, enable elastic scaling, and shorten deployment time.These properties support launching customized or additional defense VMs as attacks evolve.
- Elasticity: Elastic provisioning reduces the illustrative defense resource footprint from 240 Gbps to 130 Gbps, a 45% reduction.The example compares provisioning for the maximum volume at every interval with scaling to each interval’s demand.
- Flexibility: Launching attack-specific defense VMs reduces the illustrative hardware footprint from 480 to 270, a 40% reduction.The comparison uses SYN flood and DNS amplification defenses across three time intervals.
- Routing: Launching VMs near demand can reduce an illustrative traffic path from 3 hops to 2 hops, a 33% decrease.SDN/NFV avoid complex routing hacks needed to steer traffic through fixed-location appliances.
3 System Overview
Bohatei is an ISP-centric, SDN/NFV-based DDoS defense architecture that estimates suspicious traffic, allocates defense VMs, and steers traffic through them. It addresses responsive resource management, scalable orchestration, and adaptation to dynamic adversaries.
- Deployment scenario: Bohatei targets ISP-centric DDoS-defense-as-a-service using datacenters with commodity servers capable of running virtualized network functions.The design focuses on one customer but can extend to other deployment models.
- Threat model: The threat model allows fixed-budget adversaries to vary attack types, mixtures, and ISP ingress locations against a single customer.Concrete attack types include TCP SYN flood, UDP flood, DNS amplification, and elephant flow.
- Workflow: The workflow detects attacks, estimates suspicious traffic by type and ingress, provisions defense VMs, and configures forwarding rules.These four stages connect attack identification to traffic steering through the selected defenses.
- Challenges and ideas: Bohatei addresses responsive resource management, scalable network orchestration, and dynamic-adversary challenges through hierarchical optimization, proactive tag-based forwarding, and online adaptation.The resource-management problem can take hours with large NP-hard formulations, while reactive per-flow SDN can exhaust control-plane and switch resources.
4 Resource Manager
Bohatei’s resource manager translates annotated defense graphs and traffic estimates into physical VM deployments while accounting for processing and network costs. Its objective is efficient allocation that supports traffic analysis and mitigation.
- Inputs: Annotated graphs add edge weights representing the expected fraction of input traffic traversing each graph edge.Weights are derived from prior monitoring data and the adaptation module.
- Inputs: Traffic estimates specify suspicious volume by attack type and ingress, while VM capacities describe how much traffic each logical module can process.The resource manager uses these inputs together with datacenter and server constraints.
- Network footprint: Resource allocation accounts for ingress-to-datacenter transfer cost and intra-rack versus inter-rack traffic cost.These costs can represent latency, with intra-rack traffic cheaper than inter-rack traffic.
- Physical realization: The manager realizes each annotated-graph node with one or more VMs, producing a physical graph for deployment.This translation connects logical defense strategies to concrete VM instances.
Fine-grained scaling:
Bohatei uses fine-grained scaling and hierarchical optimization to deploy defense resources efficiently. Logical modules scale independently, while global and local controllers divide datacenter and server placement decisions.
- Fine-grained scaling: Fine-grained scaling independently expands each logical module instead of scaling an entire defense graph monolithically.This targets cases where one module becomes the processing bottleneck.
- Optimization goals: The resource manager minimizes legitimate-traffic latency and suspicious-traffic footprint while satisfying bandwidth and compute constraints.Its decisions include traffic fractions sent to datacenters and VM counts assigned to servers.
- Optimization limits: The ILP formulation gives an optimal solution but can take several hours, allowing an adversary to change the attack mix before deployment decisions are computed.This motivates a faster scalable heuristic.
- Hierarchical optimization: Bohatei decomposes resource management into global datacenter selection and local server selection problems.The global controller chooses processing datacenters; local controllers assign servers within selected datacenters.
- Datacenter selection: The datacenter-selection heuristic sorts suspicious volumes and assigns them progressively to the least-cost datacenters based on ingress-to-datacenter costs.It outputs traffic-splitting fractions and a physical graph.
- Server selection: Server selection preserves locality by placing high-capacity nodes with predecessors on the same server or rack when possible.The heuristic uses module processing capacities to guide placement.
5 Network Orchestration
Bohatei separates wide-area and intra-datacenter routing and replaces reactive per-flow control with proactive tag-based forwarding. Its design supports context-dependent paths and elastic VM replication without a centralized load-balancer bottleneck.
- Routing decomposition: Network orchestration decomposes routing into wide-area traffic delivery to datacenters and intra-datacenter delivery to the correct VMs.It uses MPLS-style routing for the wide area and SDN-oriented techniques inside datacenters.
- Wide-area orchestration: Bohatei proactively installs per-VM tag rules before traffic arrives instead of reacting to each suspicious flow.Backbone routers steer traffic according to resource-manager traffic fractions, using static tunnels from edge PoPs to datacenters.
- Context-dependent forwarding: Tags encode processing context so switches can select the next VM based on the current module’s result.In the example, tag values distinguish benign and attack traffic after processing by A1,1.
- Scalability: Tag-based forwarding reduces rule requirements from one rule per 1000 flows to two forwarding rules in the illustrated case.The approach also proactively configures VM and switch behavior to reduce control-channel interactions.
- Scale-out load balancing: Scale-out load balancing is implemented inside each VM so balancing capacity grows with the number of VM instances.This avoids placing a dedicated load balancer on every packet’s path through a replicated module.
- Tag-space requirements: The maximum evaluation requirement was 800 tags, encodable in 10 bits.The paper states that datacenter networking platforms can satisfy this tag-space requirement through extensible header fields.
6 Strategy Layer
The strategy layer estimates attack traffic and allocates defenses against an adversary that can change attack mixes across epochs. Online adaptation uses randomized regret minimization because previous measurements and fixed strategies can be exploited or perform poorly.
- Interaction model: A one-epoch reaction delay results from attack detection, resource management, and network orchestration operations.The interaction is modeled as repeated play across epochs, with the ISP responding one epoch after the adversary.
- Threat model: The ISP pre-allocates VMs and hardware resources for an attack mix while the adversary can change that mix to increase resource consumption or delivered attack traffic.The adversary may induce overprovisioning or exploit missing defenses.
- Limitations of strawman solutions: PrevEpoch produces wastage of 0,0,20 units and evasion of 10,10,30 units in a three-epoch example because it overfits the previous measurement.Uniform allocation and fixed-factor overprovisioning suffer from the same problems and are not competitive.
- Online adaptation: The adaptation objective is low regret relative to the best static solution computed in hindsight, rather than the best dynamic solution requiring oracle knowledge of the adversary.The dynamic benchmark is impractical because it presumes advance knowledge of adversarial behavior.
- Online adaptation: Follow the perturbed leader combines the average of past attack observations with a randomized component so attackers cannot predict the ISP’s estimates.The random perturbation is drawn uniformly from [0, 2×B nextEpoch×|E|×|A|] under a total defense budget of 2 × B.
7 Implementation
Bohatei implements modular analysis and response defenses, control-plane orchestration, attack detection, and resource-management algorithms using open-source networking components. Implemented strategies cover several DDoS attack types and use tagged packets to steer traffic through defense modules.
- Strategy layer: Bohatei’s modular strategy layer supports best-of-breed defense components and fine-grained scaling across attack-specific modules.The defense library separates analysis modules from response modules.
- Analysis modules: Analysis modules process suspicious packets, determine actions, and emit tags that steer traffic to subsequent analysis and response instances.Tags provide the context used for downstream module selection.
- Response modules: Response modules consume tagged packets and can forward, log, drop, or rate-limit traffic, with functions depending on the attack type.For TCP SYN attacks, a response may send RST packets.
- DDoS defense modules: SYN flood defense classifies sources using SYN/ACK completion patterns and applies SYN-Proxy defense to ambiguous sources.Sources that never complete connections can have future packets marked as known attack packets.
- DDoS defense modules: DNS amplification defense checks whether a DNS server was queried by a customer IP and separates fast header analysis from slower payload inspection.Its responses include logging, dropping, or basic forwarding.
- DDoS defense modules: UDP flood and elephant-flow defenses identify anomalous traffic using source behavior or flow size, then classify, forward, log, or randomly drop packets.UDP traffic is routed to benign or attack responses, while elephant flows receive randomized packet drops.
- Implementation: The implementation uses OpenDaylight plugins, OpenFlow switch configuration, Open vSwitch, Snort, Bro, iptables, nfdump, FlowTags, and custom Go code.The source code was made available by the authors.
8 Evaluation
Bohatei is evaluated through real-testbed and trace-driven experiments for scalability, responsiveness, routing efficiency, hardware cost, and resilience to dynamic attacks. Across these evaluations, it handles large attacks, responds within one minute, reduces latency and provisioning cost, and maintains low regret against changing adversaries.
- 8.1 Bohatei scalability: Bohatei handles attacks of hundreds of Gbps in large ISP scenarios.
- 8.1 Bohatei scalability: Bohatei’s resource-management heuristics take a few milliseconds versus tens of minutes to hours for ILP, with an optimality gap of ≤0.04%.
- 8.1 Bohatei scalability: Bohatei incurs zero rule setup latency, while reactive per-flow setup latency deteriorates rapidly as attack volume increases.
- 8.1 Bohatei scalability: Tag-based forwarding reduces switch rule space by four orders of magnitude compared with today’s flow-based forwarding.
- 8.2 Bohatei end-to-end effectiveness: Bohatei responds within one minute to diverse attacks and restores legitimate-flow performance; UDP recovery is shorter than TCP recovery.
- 8.1 Bohatei scalability: Fine-grained modular scaling reduces hardware cost by 2.1–5.4× compared with monolithic defense VMs for 100 Gbps attacks.
- 8.2 Bohatei end-to-end effectiveness: Bohatei reduces traffic latency by 20% to 65% across different routing scenarios.
- 8.3 Dynamic DDoS attacks: Online adaptation achieves low normalized regret across adversarial strategies compared with uniform and previous-measurement estimates.
9 Related Work
Related work spans DDoS detection, resilient Internet architectures, overlays, and SDN/NFV security. Bohatei focuses on a practical single-ISP deployment and uses proactive tag-based forwarding rather than reactive per-flow orchestration.
- Attack detection: DDoS detection techniques include time-series detection, backscatter analysis, attack-specific features, and network-wide analysis.
- DDoS-resilient Internet architectures: DDoS-resilient architectures include capabilities, inter-domain routing, inter-AS collaboration, packet marking, unforgeable identifiers, and traceback.
- DDoS-resilient Internet architectures: Bohatei targets a practical single-ISP context, whereas other resilient architectures lack an immediate deployment path for current networks.
- Overlay-based solutions: Overlay-based solutions provide a buffer zone between attack sources and targets, and Bohatei’s design contributions can be applied to them.
- SDN/NFV-based security: Existing SDN security solutions can introduce DDoS avenues through reactive per-flow models, while Bohatei uses proactive tag-based forwarding rules.
10 Conclusions
The conclusions present Bohatei as an SDN/NFV-based DDoS defense that addresses resource-management and control/data-plane bottlenecks. Its prototype evaluations show scalability, rapid response, improved performance over naive SDN implementations, and resilience to dynamic adversaries.
- 10 Conclusions: Bohatei brings SDN/NFV flexibility and elasticity to DDoS defense.
- 10 Conclusions: The prototype addresses practical resource-management and control/data-plane challenges so they do not become DDoS-defense bottlenecks.
- 10 Conclusions: Real-testbed evaluations show Bohatei is scalable, responds rapidly to attacks, and enables resilient defenses against dynamic adversaries.
- 10 Conclusions: Bohatei outperforms naive SDN implementations that do not address control/data-plane bottlenecks.
- A ILP Formulation: The ILP uses q variables to connect VM-to-VM traffic with VM and server assignments.
- A ILP Formulation: The ILP formulation models traffic assignment, VM placement, processing capacity, costs, flow conservation, and backbone-link congestion constraints.
B DSP and SSP Algorithms
Because the ILP resource-management formulation is impractically slow, Bohatei uses DSP and SSP heuristics to assign suspicious traffic to datacenters and servers.
- DSP algorithm: The ISP global controller solves DSP to assign suspicious incoming traffic to datacenters.
- SSP algorithm: Each local controller solves SSP to assign servers to VMs.
- DSP and SSP implementation: Figures 16 and 17 provide detailed pseudocode for the DSP and SSP heuristics.
- DSP algorithm: The DSP heuristic extracts the largest attack volume and selects a datacenter with minimum latency and available capacity.