DDoS Never Dies? An IXP Perspective on DDoS Amplification Attacks

03/07/2021
by   Daniel Kopp, et al.
0

DDoS attacks remain a major security threat to the continuous operation of Internet edge infrastructures, web services, and cloud platforms. While a large body of research focuses on DDoS detection and protection, to date we ultimately failed to eradicate DDoS altogether. Yet, the landscape of DDoS attack mechanisms is even evolving, demanding an updated perspective on DDoS attacks in the wild. In this paper, we identify up to 2608 DDoS amplification attacks at a single day by analyzing multiple Tbps of traffic flows at a major IXP with a rich ecosystem of different networks. We observe the prevalence of well-known amplification attack protocols (e.g., NTP, CLDAP), which should no longer exist given the established mitigation strategies. Nevertheless, they pose the largest fraction on DDoS amplification attacks within our observation and we witness the emergence of DDoS attacks using recently discovered amplification protocols (e.g., OpenVPN, ARMS, Ubiquity Discovery Protocol). By analyzing the impact of DDoS on core Internet infrastructure, we show that DDoS can overload backbone-capacity and that filtering approaches in prior work omit 97

READ FULL TEXT
research
09/16/2019

DDoS Hide Seek: On the Effectiveness of a Booter Services Takedown

Booter services continue to provide popular DDoS-as-a-service platforms ...
research
08/03/2018

An SDN-based Approach For Defending Against Reflective DDoS Attacks

Distributed Reflective Denial of Service (DRDoS) attacks are an immanent...
research
05/26/2022

DoS Attacks on Blockchain Ecosystem

Denial of Service (DoS) attacks are a growing threat in network services...
research
12/13/2021

A Structured Analysis of Information Security Incidents in the Maritime Sector

Cyber attacks in the maritime sector can have a major impact on world ec...
research
05/31/2019

Protocols for Checking Compromised Credentials

To prevent credential stuffing attacks, industry best practice now proac...
research
09/02/2021

QUICsand: Quantifying QUIC Reconnaissance Scans and DoS Flooding Events

In this paper, we present first measurements of Internet background radi...
research
09/02/2021

The Far Side of DNS Amplification: Tracing the DDoS Attack Ecosystem from the Internet Core

In this paper, we shed new light on the DNS amplification ecosystem, by ...

Please sign up or login with your details

Forgot password? Click here to reset