Bridging Missing Gaps in Evaluating DDoS Research
Talkat 13th USENIX Workshop on Cyber Security Experimentation and Test (CSET '20) · on Monday, 2020-08-10·
summary
Claims that academic DDoS evaluations miss realistic traffic, mitigation-in-the-loop, and collateral-damage measurement, and delivers a container-based sandbox that emulates a mini Internet with realistic AS-level IP assignment and a traffic mimicker generating congestion-aware, closed-loop background flows. The platform reproduces traceroute-like paths for correctness, runs ~100 router containers on a 3-core/24GB host before swapping, shows near-linear scaling on larger AWS instances, and is extending to distributed containers and integrated attack/defense experiments.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:30Real-World Attacks Are Advancing
- 0:58Background: Pulsing-Based Attack
- 1:49Background: Carpet-Bombing Attack
- 2:54We Know Little About Advanced Attacks
- 3:35Better DDoS Detection Evaluation
- 4:16Collateral Damage in Mitigation
- 5:28DDoS SandBox -- Overview
- 6:18DDoS SandBox -- System Components
- 7:13DDoS SandBox -- An Example Workflow
- 7:58Preliminary Evaluation -- Setup
- 8:19Preliminary Evaluation -- Correctness
- 9:13Preliminary Evaluation -- Scalability
- 10:51Conclusion
related talks
45mAnatomy of a DDoS
37mAnatomy of a DDoS
35mHow We Organize Large-Scale DDoS Exercises in the Netherlands
40mThe new reality of DDOS
41mAre DDoS attacks a threat to the decentralised internet?
25mHow to Pull Off a Near Undetectable DDoS Attack...
52mInvestigating DDOS - Architecture Actors and Attribution
42mBypassing Anti-DDoS at Telecom Operators