Skip to main content
SpringerLink
Log in

Fine-Grained Intra-domain Bandwidth Allocation Against DDoS Attack

  • Conference paper
  • First Online:
Security and Privacy in Communication Networks (SecureComm 2021)

Abstract

Multiple bandwidth reservation mechanisms based on network capability have been proposed to resolve Distributed Denial of Service (DDoS) attacks towards the transit-link. However, previous capability-based techniques are insufficient to provide accurate protection towards legitimate users of contaminated domains. In this paper, we present FIBA, an intra-domain bandwidth allocation mechanism with fine-grained accessing control granularity. FIBA enables source domains to locally differentiate the capability requests by state measuring according to two attributing factors. Moreover, FIBA can establish hierarchical channels for capability requesting packets to realize the isolation of traffic from the same source domain. Our scheme is integrated with existing methods and can be optionally deployed by source domains. Finally, through network experiments, we evaluate FIBA can realize user-level DDoS protection even in 90%-contaminated domain.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 89.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 119.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    For example, 2-state tag problem is to find an interger number a to minimize \(H(\{A_{i,j}|A_{i,j}\le a\})+H(\{A_{i,j}|A_{i,j}>a\})\). Also, the source AS can determine by itself.

References

  1. Autonomous system numbers (2016). http://www.iana.org/ assignments/as-numbers/as-numbers.xhtml

  2. Bene: A python network simulator (2017). https://github.com/zappala/bene

  3. AS relationships (2020). https://www.caida.org/data/as-relationships/

  4. AWS said it mitigated a 2.3 Tbps DDoS attack, the largest ever, June 2020. https://www.zdnet.com/article/aws-said-it-mitigated-a-2-3-tbps-ddos-attack-the-largest-ever/

  5. DDoS attacks rise in intensity, sophistication and volume, September 2020. https://www.helpnetsecurity.com/2020/09/17/ddos-attacks-rise-in-intensity-sophistication-and-volume/

  6. Andersen, D.G., Balakrishnan, H., Feamster, N., Koponen, T., Shenker, S.: Accountable internet protocol (aip). In: Proceedings of the ACM SIGCOMM 2008 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications, Seattle, 17–22, August 2008

    Google Scholar 

  7. Basescu, C., et al.: SIBRA: scalable internet bandwidth reservation architecture. In: Proceedings NDSS, San Diego, February 2016

    Google Scholar 

  8. Bennett, J.C.R., Zhang, H.: Hierarchical packet fair queueing algorithms. IEEE/ACM Trans. Netw. 5(5), 675–689 (2002)

    Article  Google Scholar 

  9. Bonacich, P.: Factoring and weighting approaches to status scores and clique identification. J. Math. Soc. 2(1), 113–120 (1972)

    Article  Google Scholar 

  10. Estrada, E., Rodriguez-Velazquez, J.A.: Subgraph centrality in complex networks. Phys. Rev. E Stat. Nonlin. Soft Matter Phys. 71(5), 056103 (2005)

    Google Scholar 

  11. Godfrey, P., Ganichev, I., Shenker, S., Stoica, I.: Pathlet routing. ACM SIGCOMM Comput. Commun. Rev. 39(4), 111–122 (2009)

    Article  Google Scholar 

  12. Heer, H.: Host identity protocol certificates draft-ietf-hip-cert-12. Technology (2011)

    Google Scholar 

  13. Kalkan, K., Alagöz, F.: A distributed filtering mechanism against DDoS attacks. Comput. Netw. 108, 199–209 (2016). https://doi.org/10.1016/j.comnet.2016.08.023

    Article  Google Scholar 

  14. Kang, M.S., Lee, S.B., Gligor, V.D.: The crossfire attack. In: Proceedings IEEE S&P, pp. 127–141, Berkeley, May 2013

    Google Scholar 

  15. Kim, T.H.J., Basescu, C., Jia, L., Lee, S.B., Hu, Y.C., Perrig, A.: Lightweight source authentication and path validation. In: Proceedings ACM SIGCOMM, pp. 271–282, Chicago, August 2014

    Google Scholar 

  16. Kim, Y., Lau, W.C., Chuah, M.C., Chao, H.J.: Packetscore: a statistics-based packet filtering scheme against distributed denial-of-service attacks. IEEE Trans. Dependable Secure Comput. 3(2), 141–155 (2006)

    Article  Google Scholar 

  17. Kitsak, M., et al.: Identification of influential spreaders in complex networks. Nat. Phys. 6, 888–893 (2010)

    Article  Google Scholar 

  18. Lee, S.B., Gligor, V.D.: Floc : dependable link access for legitimate traffic in flooding attacks. In: IEEE International Conference on Distributed Computing Systems (2010)

    Google Scholar 

  19. Morone, F., Makse, H.A.: Influence maximization in complex networks through optimal percolation. Nature 524(7563), 65 (2015)

    Article  Google Scholar 

  20. Parno, B., Wendlandt, D., Shi, E., Perrig, A., Maggs, B., Hu, Y.C.: Portcullis: protecting connection setup from denial-of-capability attacks. ACM SIGCOMM Comput. Commun. Rev. 37(4), 289–300 (2007). https://doi.org/10.1145/1282427.1282413

    Article  Google Scholar 

  21. Rekhter, Y., Li, T.: A border gateway protocol 4 (BGP-4). RFC 1771, March 1995

    Google Scholar 

  22. Rouse, M.: ICANN (Internet Corporation for Assigned Names and Numbers) (2016). http://searchsoa.techtarget.com/definition/ ICANN

  23. Steve, H., Jun, D.: Understanding network concepts in modules. BMC Syst. Biol. 1(1), 24 (2007)

    Article  Google Scholar 

  24. Studer, A., Perrig, A.: The coremelt attack. In: Backes, M., Ning, P. (eds.) ESORICS 2009. LNCS, vol. 5789, pp. 37–52. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-04444-1_3

    Chapter  Google Scholar 

  25. Touch, J.: Updated specification of the IPv4 ID field. RFC 6864, February 2013

    Google Scholar 

  26. Xiao, P., Li, Z., Qi, H., Qu, W., Yu, H.: An efficient DDoS detection with bloom filter in SDN. In: 2016 IEEE Trustcom/BigDataSE/ISPA, pp. 1–6. IEEE (2016)

    Google Scholar 

  27. Xie, L., Zhang, Y., Zheng, Z., Zhang, X.: TRIP: a tussle-resistant internet pricing mechanism. IEEE Commun. Lett. 21(2), 270–273 (2017)

    Article  Google Scholar 

  28. Yaar, A., Perrig, A., Song, D.: SIFF: a stateless internet flow filter to mitigate DDoS flooding attacks. In: IEEE Symposium on Security and Privacy, 2004. Proceedings, 2004, pp. 130–143 (2004)

    Google Scholar 

  29. Yang, X., Wetherall, D., Anderson, T.: Tva: a dos-limiting network architecture. IEEE ACM Trans. Netw. 16(6), 1267–1280 (2008)

    Article  Google Scholar 

  30. Zhang, X., Xie, L., Yao, W.: Spatio-temporal heterogeneous bandwidth allocation mechanism against DDoS attack. J. Netw. Comput. Appl. 162, 102658 (2020)

    Article  Google Scholar 

  31. Zhang, Y., Wang, X., Perrig, A., Zheng, Z.: Tumbler: adaptable link access in the bots-infested internet. Comput. Netw. 105, 180–193 (2016)

    Article  Google Scholar 

  32. Zhang, Y., Xie, L., Zhang, D., Liu, G., Wang, Q.: Scalable bandwidth allocation based on domain attributes: towards a DDoS-resistant data center. In: Proceedings IEEE GLOBECOM, pp. 1–6, Singapore, December 2017

    Google Scholar 

Download references

Acknowledgement

This work is supported by National Key Research and Development Program of China (2020YFB1005702).

Author information

Authors and Affiliations

  1. LMIB and School of Mathematical Sciences, Beihang University, Beijing, China

    Lijia Xie, Xiao Zhang, Yiming Shi, Xin Xiao & Zhiming Zheng

  2. Peng Cheng Laboratory, Shenzhen, China

    Lijia Xie, Xiao Zhang, Yiming Shi, Xin Xiao & Zhiming Zheng

  3. Beijing Advanced Innovation Center for Big Data and Brain Computing, Beihang University, Beijing, China

    Lijia Xie, Xiao Zhang, Yiming Shi, Xin Xiao & Zhiming Zheng

  4. China Academy of Information and Communications Technology, Beijing, China

    Shuang Zhao

Authors
  1. Lijia Xie
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Shuang Zhao
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Xiao Zhang
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Yiming Shi
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Xin Xiao
    View author publications

    You can also search for this author in PubMed Google Scholar

  6. Zhiming Zheng
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Xiao Zhang .

Editor information

Editors and Affiliations

  1. Télécom SudParis, Institut Polytechnique de Paris, Palaiseau, France

    Joaquin Garcia-Alfaro

  2. University of Kent Canterbury, Canterbury, Kent, UK

    Shujun Li

  3. University of Washington, Seattle, WA, USA

    Radha Poovendran

  4. Télécom SudParis, Institut Polytechnique de Paris, Palaiseau, France

    Hervé Debar

  5. Google Inc., New York, NY, USA

    Moti Yung

Rights and permissions

Reprints and permissions

Copyright information

© 2021 ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Xie, L., Zhao, S., Zhang, X., Shi, Y., Xiao, X., Zheng, Z. (2021). Fine-Grained Intra-domain Bandwidth Allocation Against DDoS Attack. In: Garcia-Alfaro, J., Li, S., Poovendran, R., Debar, H., Yung, M. (eds) Security and Privacy in Communication Networks. SecureComm 2021. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol 398. Springer, Cham. https://doi.org/10.1007/978-3-030-90019-9_20

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-90019-9_20

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-90018-2

  • Online ISBN: 978-3-030-90019-9

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation