DefCOM: Defensive Cooperative Overlay Mesh

A Distributed Overlay Defense to Distributed Denial-of-Service Attacks

Distributed Denial-of-Service (DDoS) attacks are a current serious threat to critical infrastructure services. DDoS attacks use a large volume of traffic, from many attacking sources, to deny the services offered by the victim of the attack. The problem is difficult because of the large numbers of remote machines used in the attack under different administrative control, the ability for the attackers to use false source addresses, and the difficulty for the victim to differentiate between legitimate and attack traffic. There are no commercial or research defenses to DDoS attacks that make any guarantees of continued service to legitimate clients of the victim during the attack.

The DefCOM project at UCLA proposes to design and build a distributed, cooperative network of routers that respond effectively to DDoS attacks, while making some guarantees of continued service for legitimate clients. The distributed routers will work together to detect DDoS attacks, and adaptively and selectively limit traffic at various points in the network destined for the victim, while offering priority service to legitimate traffic. We will demonstrate a prototype of the system using Linux software routers and Intel IXP fast programmable hardware routers. Further, we will research securing the system itself.

Publications