PacketScore: A Statistical Packet Filtering Scheme against Distributed Denial-of-Service Attacks

Dwtributed Denial of Service @Dos) attack is a critical threat to the Internet Currently, most ISPs merely rely on manual detection of DhS attacks after which amine linegrain trallic analysis is performed and new Ptering rules are installed manually to the routers The need of human intervention results in poor response time and fails to protect the victim before severe damages are realized The expressiveness of existing tiltering rules is also too limited and rigid when compared to the ever-evolving characteristics of the attacking packets. Recently, we have proposed a DhS defense architecture that supports distributed detection and automated on-line attack characterizatioa In this paper, we will focus on the design and evaluation of the automated attack characterization, selective packet discarding and overload control portion of the proposed architecture. Our key idea is to prioritize packeb based on a perpacket score which estimates the legitimacy of a packet given the amibute values it carries. Special considerations are made to ensure that the scheme is amenable to high-sped hardware implementation. Once the score of a packet is computed, we perform score-based selective packet discarding where the dropping threshold is dynamically adjusted based on (1) the score distribution of recent incoming packets and (2) the current level of overload of the system.