Aggregate-based Congestion Control for Pulse-wave DDoS Defense

Abstract

Pulse-wave DDoS attacks are a new type of volumetric attack formed by short, high-rate traffic pulses. Such attacks target the Achilles' heel of state-of-the-art DDoS defenses: their reaction time. By continuously adapting their attack vectors, pulse-wave attacks manage to render existing defenses ineffective. In this paper, we leverage programmable switches to build an in-network DDoS defense effective against pulse-wave attacks. To do so, we revisit Aggregate-based Congestion Control (ACC): a mechanism proposed two decades ago to manage congestion events caused by high-bandwidth traffic aggregates. While ACC proved efficient in inferring and controlling DDoS attacks, it cannot keep up with the speed requirements of pulse-wave attacks. We propose <i>ACC-Turbo</i>, a renewed version of ACC that infers attack patterns by applying online-clustering techniques in the network and mitigates them by leveraging programmable packet scheduling. By doing so, <i>ACC-Turbo</i> identifies attacks at line rate and in real-time, and rate-limits attack traffic on a per-packet basis. We fully implement <i>ACC-Turbo</i> in P4 and evaluate it on a wide range of attack scenarios. Our evaluation shows that <i>ACC-Turbo</i> autonomously identifies DDoS attack vectors in an unsupervised manner and rapidly mitigates pulse-wave DDoS attacks. We also show that <i>ACC-Turbo</i> runs on existing hardware (Intel Tofino).