Abstract
Existing mechanisms for defending against distributed denial-ofservice (DDoS) attacks are generally reactive in nature. However, the onset of large-scale bandwidth-based attacks can occur suddenly, potentially knocking out substantial parts of a network before reactive defenses can respond. Even for traffic flows that are not under direct attack, significant collateral damage will result if these flows pass through links that are common to attack routes. This paper presents a proactive-surge-protection (PSP) mechanism that aims to provide a broad first line of defense against DDoS attacks. Our solution aims to minimize collateral damage by providing bandwidth isolation between traffic flows. This isolation is achieved through a combination of traffic forecasting, proportional allocation of network capacity, metering and tagging of packets at the network perimeter, and preferential dropping of packets inside the network. Our solution is readily deployable using existing router mechanisms. Simulations across three large backbone networks show that up to 95.5% of the network could suffer collateral damage without protection, but our solution was able to reduce the amount of collateral damage by 60.5-97.8%, even with a coarsegrained forecasting scheme. Copyright 2007 ACM.