PaperlayerView exact revision on arXiv

Source-linked AI summary

DDoS Attacks in Cloud Computing: Issues, Taxonomy, and Future Directions

Gaurav Somani, Manoj Singh Gaur, Dheeraj Sanghi, Mauro Conti, Rajkumar Buyya

arXiv:1512.08187v2cs.CR

TL;DR

Cloud DDoS attacks threaten service quality, resource management, and budgets, especially under utility-computing models. The paper surveys and classifies cloud DDoS defenses, evaluates their requirements, and concludes that effective protection needs accurate scaling decisions, multi-layer mitigation, and resource-aware designs.

  • Problem

    Cloud DDoS research lacks a survey addressing utility-computing resource management and the economic consequences of EDoS attacks.

  • Method

    The paper conducts a systematic literature survey, builds a taxonomy spanning prevention, detection, and mitigation, and discusses evaluation metrics and defense abstractions.

  • Results

    The survey identifies cloud-specific DDoS characteristics and concludes that defenses should use multi-level information, resource allocation, and cloud resources.

  • Takeaways & Limitations

    Effective cloud DDoS mitigation should support accurate auto-scaling decisions, multi-layer defense, and coordinated information across defense levels.

  • Takeaways & Limitations

    Resource-based detection can confuse DDoS-driven surges with legitimate flash traffic or heavy computation, while fixed caps sacrifice on-demand allocation benefits.

Abstract

from arXiv · show

Security issues related to the cloud computing are relevant to various stakeholders for an informed cloud adoption decision. Apart from data breaches, the cyber security research community is revisiting the attack space for cloud-specific solutions as these issues affect budget, resource management, and service quality. Distributed Denial of Service (DDoS) attack is one such serious attack in the cloud space. In this paper, we present developments related to DDoS attack mitigation solutions in the cloud. In particular, we present a comprehensive survey with a detailed insight into the characterization, prevention, detection, and mitigation mechanisms of these attacks. Additionally, we present a comprehensive solution taxonomy to classify DDoS attack solutions. We also provide a comprehensive discussion on important metrics to evaluate various solutions. This survey concludes that there is a strong requirement of solutions, which are designed keeping utility computing models in mind. Accurate auto-scaling decisions, multi-layer mitigation, and defense using profound resources in the cloud, are some of the key requirements of the desired solutions. In the end, we provide a definite guideline on effective solution building and detailed solution requirements to help the cyber security research community in designing defense mechanisms. To the best of our knowledge, this work is a novel attempt to identify the need of DDoS mitigation solutions involving multi-level information flow and effective resource management during the attack.

1. Introduction

Cloud adoption offers elastic, pay-as-you-go infrastructure but creates cloud-specific DDoS and economic risks. This survey organizes existing work, evaluates solutions, and identifies requirements for resource-aware defense.

  • Cloud computing provides on-demand resources and pay-as-you-go access, but its security issues affect budgets, resource management, and service quality.
  • DDoS attacks increasingly target cloud and SaaS services, with reported incidents affecting enterprises and major providers.
  • Cloud elasticity and auto-scaling can amplify attack consequences by allocating additional resources during malicious overload.
  • The paper surveys cloud DDoS research, develops a solution taxonomy, proposes evaluation metrics, and identifies design aspects for effective mitigation.
  • Existing surveys do not adequately address cloud-specific characterization, utility-computing resource management, and the economic effects of EDoS attacks.

2. DDoS Attacks and Cloud Computing

Cloud computing’s virtualization, elasticity, scalability, and pay-as-you-go model support efficient service delivery. The same properties can help DDoS attackers impose denial of service and economic costs through resource consumption.

  • Virtualization enables VMs to expand or shrink allocated CPUs, memory, storage, and bandwidth while running.
  • Horizontal and vertical scaling provide on-demand capacity by adding resources to VMs or deploying instances across physical servers.
  • Pay-as-you-go billing lets consumers add resources dynamically, making resource allocation and usage directly relevant to cloud costs.
  • Multi-tenancy places VMs from different owners on shared physical servers to improve hardware utilization and return on investment.
  • DDoS traffic can overload a victim server, trigger auto-scaling, consume additional resources, and ultimately produce denial of service and lost cloud benefits.

3. Attack Statistics and Impact Characterization

Cloud DDoS attacks have produced substantial operational and economic impacts, while attack methods and secondary effects continue to expand. Studies characterize both direct service disruption and resource-related consequences.

  • DDoS attacks are predominantly botnet-driven, with controllers directing automated malware-infected machines against targeted services.
  • Average financial damage from a DDoS attack was reported as up to 444,000 USD, while one cloud-targeted organization incurred a $30,000 daily bill.
  • DDoS attack bandwidth grew from 8 Gbps in 2004 to more than 500 Gbps in 2016.
  • Around 50% of organizations reportedly suffered smoke-screening attacks while mitigating DDoS, and 90% of targeted companies faced repetitive attacks.
  • Characterization studies examined cloud attack costs using high request rates, large data transfers, and EDoS effects on consumer bills and hosted clusters.

4. Taxonomy of DDoS Solutions

The paper organizes cloud DDoS defenses into a taxonomy covering prevention, detection, and mitigation/recovery. It also proposes evaluation metrics and notes that the simplified protection overview omits many solutions.

  • Taxonomy structure: The taxonomy incorporates traditional-infrastructure defense research to provide a detailed classification of available solution ideas and approaches.The classification uses named taxonomy fields to organize contributions.
  • Taxonomy structure: The taxonomy classifies cloud DDoS defenses into attack prevention, attack detection, and attack mitigation and recovery.Some works contribute to multiple divisions and are discussed in each relevant section.
  • Protection levels: Protection is presented as a staged process involving request prevention, anomaly detection, traffic monitoring and analysis, and mitigation or recovery.Cloud features and profound resources support the mitigation and recovery stage.
  • Evaluation: The taxonomy evaluates prevention, detection, and mitigation subclasses using performance and evaluation metrics intended to support uniform comparison and verification.The paper notes that many surveyed solutions do not use evaluation or performance metrics.
  • Scope and limitations: Figure 4 provides only a simplified gist of the protection solution space and therefore omits many solutions available at each stage.The paper identifies a need for more solutions at the mitigation stage.

5. Attack Prevention (P)

Cloud DDoS prevention proactively filters or restricts requests before they affect services, but these defenses can impose usability, latency, scalability, and resource-management costs.

  • Prevention methods act before attack effects appear and apply to legitimate and illegitimate users alike.The taxonomy divides prevention into challenge-response, hidden servers or ports, restrictive access, and resource limits.
  • 5.1. Challenge Response (P1): Challenge-response schemes use CAPTCHA-like Turing tests or cryptographic puzzles to distinguish users from automated attackers.Examples include EDoS Shield and DDoS-MS, which combine graphical Turing tests and crypto puzzles for bot-driven attacks.
  • 5.1. Challenge Response (P1): Challenge-response defenses must balance bot resistance against accessibility, conversion rates, server overhead, and puzzle-generation or storage costs.Text puzzles can be cracked by dictionary or parsing attacks, while graphical tests require additional generation and storage overhead.
  • 5.2. Hidden Servers /Ports (P2): Hidden servers, ports, proxies, or replicas shield the real service and can add authentication, traffic monitoring, load balancing, and recovery functions.Moving-target approaches dynamically change hidden proxies or server assignments, but require replica maintenance and shuffling management.
  • 5.3. Restrictive Access (P3): Restrictive access uses reputation, delayed responses, selective access, or temporary blocking to control suspected clients without necessarily dropping every request.Delayed access can avoid triggering auto-scaling, but its effectiveness is questioned where users require timely responses.
  • 5.4. Resource Limits (P4): Resource limits can reduce DDoS-driven economic losses through correct auto-scaling decisions, but fixed caps sacrifice on-demand resource allocation.Distinguishing malicious resource surges from genuine traffic is difficult, creating a central prevention challenge in utility computing.

6. Attack Detection (D)

Cloud DDoS detection identifies attack signs through monitored services, traffic behavior, identities, request counts, and resource usage. The surveyed approaches benefit from historical traffic learning but remain vulnerable to feature, false-alert, spoofing, and overhead challenges.

  • The detection taxonomy includes anomaly detection, source and spoof tracing, count-based filtering, BotCloud detection, and resource-usage methods.These categories use attack signs appearing in services and monitored performance metrics.
  • 6.1. Anomaly Detection (D1): Anomaly detectors model packet traces, connections, web logs, headers, or historical behavior to identify deviations from benign traffic patterns.Examples use Zipf-distributed web access, IP and TCP flags, Jensen-Shannon Divergence, entropy, and HTTP/XML profiles.
  • 6.1. Anomaly Detection (D1): Machine learning over historical benign or attack traffic is a major strength of cloud DDoS detection and supports rapid monitoring with big-data analytics and software-defined networks.These methods are becoming popular for cloud-targeted attacks.
  • Detection quality depends on feature selection and training, with false positives, false negatives, and IP spoofing identified as major evaluation and robustness concerns.Spoofed identities can defeat methods that model user behavior or profiles using IP addresses.
  • 6.2. Source and Spoof Trace (D2): Source traceback identifies spoofed attack origins, but cooperative schemes require support from network devices and struggle against massive botnet spoofing.SBTA adds a server that tags packets and reconstructs paths using a database for comparison.
  • 6.3. Count Based Filtering (D3): Count-based filters apply thresholds to hop counts, connections, or requests per time unit, while multi-level filtering can combine puzzles, hop counts, and packet frequency.Server-side filters can impose significant overhead and latency on ordinary users.

7. Attack Mitigation (M)

Cloud DDoS mitigation methods keep services available during attacks through resource scaling, migration, operating-system controls, SDN, and mitigation services, but each introduces operational or cost trade-offs.

  • Overview: Mitigation and recovery methods aim to keep victim servers serving requests because downtime can cause significant business losses.The taxonomy includes resource scaling, victim migration, OS resource management, SDN, and DDoS Mitigation as a Service.
  • Resource Scaling: Resource scaling adds VM resources or instances to absorb attacks and maintain service availability through vertical or horizontal scaling.Scaling can expand resources within a VM or start new instances on the same or different physical servers.
  • Resource Scaling: Scaling can reduce attack effects, but stealthy undetected attacks may increase resource consumption and mitigation costs multi-fold.The cost-saving benefit of cloud hosting can be undermined when auto-scaling responds to attack traffic.
  • Victim Migration: Victim migration moves a running server to isolated or larger backup resources, potentially reducing attack effects and providing capacity for mitigation.Migration can later return the server to its original location after the attack is detected and mitigated.
  • Victim Migration: Migration schemes face sustainability problems from reserved-resource wastage, false detection during legitimate demand, duplication overhead, and prolonged attacks.Long attacks also create a trade-off between serving legitimate users and transferring state, data, and sessions.
  • OS Resource Management and SDN: OS-level resource management reduces contention inside victim VMs, while SDN offers reconfigurability and network-wide monitoring for massive and low-rate attacks.Reported OS-level metrics include detection, mitigation, reporting, and cooling-down times; SDN infrastructure itself can also be attacked.
  • DDoS Mitigation as a Service: DMaaS approaches can use cloud resources for mitigation, but remote intervention may not accelerate mitigation and raises control, privacy, cost, and sustainability concerns.Shutdown and replacement-instance strategies also fail to resolve service downtime and may remain vulnerable to repeated attacks.

8. Discussion and Future Directions

The survey finds that cloud DDoS research commonly relies on characterization, prevention, filtering, anti-spoofing, and resource scaling, while fewer solutions address cloud utility-model features.

  • Dominant solution themes: Most surveyed solutions focus on characterization or impact studies, Turing-test prevention, threshold or pattern filtering, anti-spoofing, and resource scaling.Solutions typically use one or a combination of these five approaches.
  • Future directions: Only a few solutions account for auto-scaling, multi-tenancy, and the utility model, leaving cloud-specific resource management insufficiently represented.The survey identifies these omissions as weaknesses in the state of the art and calls for effective availability-preserving mitigation and recovery.

8.1. Solution Considerations

Effective cloud DDoS defenses must control auto-scaling, account for multi-tenancy and billing, and coordinate scaling with migration while limiting cost and side effects.

  • Auto-scaling: Auto-scaling decisions should verify genuine resource demand because monitored CPU, memory, bandwidth, response time, and query-processing metrics can trigger allocation changes.Specific checks are needed to control false auto-scaling triggers.
  • Auto-scaling: Vertical scaling adjusts resources within co-hosted VMs, whereas horizontal scaling starts additional VM instances on other physical servers to share load.The proposed composite strategy first uses vertical scaling and then horizontal scaling, subject to need and cost limits.
  • Multi-tenancy: Multi-tenancy improves hardware utilization but requires attention to performance isolation, interference, provider return on investment, and resource-allocation policies.Vertical scaling is more flexible when fewer VMs share a physical machine, while providers may seek to host more VMs.
  • Utility model: Pay-as-you-go billing can increase provider benefits when hosted VMs require additional resources, so defenses should incorporate accounting and billing perspectives.Additional resource consumption creates charges for consumers and revenue for providers.
  • Migration: VM migration incurs downtime, configuration-change, and bandwidth costs, and prolonged attacks may cause repeated migrations and side effects across cloud resources.Defense mechanisms should coordinate migration with horizontal scaling to reduce migration frequency during attacks.
  • Solution costs: DDoS losses may become multi-fold in cloud infrastructure, making sustainability and budget considerations especially important for small and medium enterprises.The survey points to cost considerations as a central requirement for DDoS solution design.

8.2. Building an effective solution

The proposed design organizes cloud DDoS defense across application, VM/OS, hypervisor, cloud, ISP, and third-party levels, emphasizing information flow and coordinated decisions.

  • Defense architecture: The solution model uses five defense levels and associates each level with services, information, or monitored metrics.These levels are grouped into application, system, and external defense abstractions.
  • Application Defense: Application defenses identify unexpected request increases and source IPs using mechanisms such as Turing tests, request-frequency checks, and hop-count filtering.Most existing solutions operate at the application level, but application-only defense does not address all cloud aspects.
  • Application Defense: Complex filtering can create indirect EDoS through computation, storage, and accumulated puzzles, while special tests may reduce service usability.The design must preserve accessibility because even one-second page-load delays may affect conversion rates.
  • Application Defense: Low-rate continuous attacks require attention because one request per minute for a month can still incur cost.Request-rate analysis should therefore cover more than obvious high-rate flooding.
  • System Defense: VM/OS monitoring can inspect process resource usage, while hypervisors manage vertical scaling, VM scheduling, memory, and storage.Cloud-level controls can send or receive alerts and coordinate decisions across lower layers.
  • System Defense: Cloud-level defense monitors aggregate incoming and outgoing traffic and makes horizontal-scaling decisions involving migration and cost.Communication between hypervisor and cloud manager is presented as a useful design approach.
  • External Defense: ISP-level defense can replace choked lines, identify target and originating networks, and support perimeter mitigation that tolerates 40% attacker customer networks.Distributed change-point detection and collaborative trust policies are also described for network-level defense.
  • Composite designs: Application-plus-system defense is presented as more effective than application-only defense because lower layers can use information supplied by application-level detection.System-only designs remain concerned with distinguishing true positives from false negatives without application-level verification.

9. Summary and Conclusions

The survey organizes cloud DDoS defenses, evaluation metrics, and solution-design guidance around cloud-specific characteristics. It concludes that effective defenses should account for multi-level information, resource management, and cloud-scale operation.

  • The survey identifies EDoS as a primary form of DDoS attack in cloud computing and emphasizes utility-computing characteristics in defense design.Cloud features are presented as critical to understanding DDoS attacks and their impact.
  • It classifies cloud DDoS defenses into prevention, detection, and mitigation, including approaches for resource allocation, on-demand resources, botcloud detection, and SDN-based network reconfiguration.The taxonomy is paired with performance metrics for evaluating and comparing solution classes.
  • The paper provides a comprehensive set of evaluation metrics intended to support benchmarking of future cloud DDoS solutions.
  • Its solution-design guideline covers the design space and parameters needed for developing future defense mechanisms.The guideline is intended to support innovative and effective cloud DDoS defenses.
  • The conclusions call for cloud- and feature-specific, multi-level defenses with cost- and attack-aware resource allocation and multi-layer evaluation in cloud infrastructures.The proposed direction contrasts these designs with traditional DDoS solutions and emphasizes larger-scale cloud characterization.
Loading 1512.08187v2…