dfence: transparent network-based denial of service mitigation

  • Authors:

  • Ajay Mahimkar;Jasraj Dange;Vitaly Shmatikov;Harrick Vin;Yin Zhang

  • Affiliations:

  • Department of Computer Sciences, The University of Texas at Austin;Department of Computer Sciences, The University of Texas at Austin;Department of Computer Sciences, The University of Texas at Austin;Department of Computer Sciences, The University of Texas at Austin;Department of Computer Sciences, The University of Texas at Austin

  • Venue:
  • NSDI'07 Proceedings of the 4th USENIX conference on Networked systems design & implementation
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

Denial of service (DoS) attacks are a growing threat to the availability of Internet services. We present dFence, a novel network-based defense system for mitigating DoS attacks. The main thesis of dFence is complete transparency to the existing Internet infrastructure with no software modifications at either routers, or the end hosts. dFence dynamically introduces special-purpose middlebox devices into the data paths of the hosts under attack. By intercepting both directions of IP traffic (to and from attacked hosts) and applying stateful defense policies, dFence middleboxes effectively mitigate a broad range of spoofed and unspoofed attacks. We describe the architecture of the dFence middlebox, mechanisms for ondemand introduction and removal, and DoS mitigation policies, including defenses against DoS attacks on the middlebox itself. We evaluate our prototype implementation based on Intel IXP network processors.