Random early detection gateways for congestion avoidance
IEEE/ACM Transactions on Networking (TON)
Internet Denial of Service: Attack and Defense Mechanisms (Radia Perlman Computer Networking and Security)
IEEE Transactions on Dependable and Secure Computing
Computers & Mathematics with Applications
| Hi-index | 0.00 |
Distributed Denial of Service (DDoS) attack mitigation systems usually generate a list of filter rules in order to block malicious traffic. In contrast to this binary decision we suggest to use traffic shaping whereas the bandwidth limit is defined by the probability of a source to be a legal user. As a proof of concept, we implemented a simple high performance Linux kernel module nf-HiShape which is able to shape thousands of source IP addresses at different bandwidth limits even under high packet rates. Our shaping algorithm is comparable to Random Early Detection (RED) applied on every single source IP range. The evaluation shows, that our kernel module can handle up to 50,000 IP ranges at nearly constant throughput whereas Linux tc already decreases throughput at about 200 ranges.