Anycast vs. DDoS: Evaluating the November 2015 Root DNS Event. Moura, G. C. M., de O. Schmidt, R., Heidemann, J., de Vries , W. B., Müller, M., Wei, L., & Hesselman, C. In Proceedings of the ACM Internet Measurement Conference, November, 2016.
Anycast vs. DDoS: Evaluating the November 2015 Root DNS Event [link]Paper  doi  abstract   bibtex   
Distributed Denial-of-Service (DDoS) attacks continue to be a major threat on the Internet today. DDoS attacks overwhelm target services with requests or other traffic, causing requests from legitimate users to be shut out. A common defense against DDoS is to replicate a service in multiple physical locations/sites. If all sites announce a common prefix, BGP will associate users around the Internet with a nearby site, defining the \emphcatchment of that site. Anycast defends against DDoS both by increasing aggregate capacity across many sites, and allowing each site's catchment to contain attack traffic, leaving other sites unaffected. IP anycast is widely used by commercial CDNs and for essential infrastructure such as DNS, but there is little evaluation of anycast under stress. This paper provides the \emphfirst evaluation of several IP anycast services under stress with public data. Our subject is the Internet's Root Domain Name Service, made up of 13 independently designed services (``letters'', 11 with IP anycast) running at more than 500 sites. Many of these services were stressed by sustained traffic at $100×$ normal load on Nov. 30 and Dec. 1, 2015. We use public data for most of our analysis to examine how different services respond to stress, and identify two policies: sites may \emphabsorb attack traffic, containing the damage but reducing service to some users, or they may \emphwithdraw routes to shift both good and bad traffic to other sites. We study how these deployment policies resulted in different levels of service to different users during the events. We also show evidence of \emphcollateral damage on other services located near the attacks.
@InProceedings{Moura16b,
	author = 	{Giovane C. M. Moura and Ricardo de O. Schmidt
                  and John Heidemann and Wouter B. {de Vries} and
                  Moritz M{\"u}ller and Lan Wei and Christian Hesselman},
	title = 	"Anycast vs.~{DDoS}: Evaluating the {November}
                  2015 Root {DNS} Event",
	booktitle = 	"Proceedings of the " # "ACM Internet Measurement Conference",
	year = 		2016,
	sortdate = "2016-11-15",
	project = "ant, lacrend, lander, retrofuture, researchroot, pinest, nipet",
	jsubject = "network_security",
	month = 	nov,
	jlocation = 	"johnh: pafile",
	keywords = 	"anycast, dns, design, ddos",
	url =		"https://ant.isi.edu/%7ejohnh/PAPERS/Moura16b.html",
	pdfurl =	"https://ant.isi.edu/%7ejohnh/PAPERS/Moura16b.pdf",
	doi = 	"http://dx.doi.org/10.1145/2987443.2987446",
	myorganization =	"USC/Information Sciences Institute",
	copyrightholder = "authors",
	abstract = "
Distributed Denial-of-Service (DDoS) attacks continue to be a major
threat on the Internet today.  DDoS attacks overwhelm target services
with requests or other traffic, causing requests from legitimate users
to be shut out.  A common defense against DDoS is to replicate a
service in multiple physical locations/sites.  If all sites announce a
common prefix, BGP will associate users around the Internet with a
nearby site, defining the \emph{catchment} of that site.  Anycast
defends against DDoS both by increasing aggregate capacity across many
sites, and allowing each site's catchment to contain attack traffic,
leaving other sites unaffected.  IP anycast is widely used by
commercial CDNs and for essential infrastructure such as DNS, but
there is little evaluation of anycast under stress.  This paper
provides the \emph{first evaluation of several IP anycast services
  under stress with public data}.  Our subject is the Internet's Root
Domain Name Service, made up of 13 independently designed services
(``letters'', 11 with IP anycast) running at more than 500 sites.
Many of these services were stressed by sustained traffic at
$100\times$ normal load on Nov.~30 and Dec.~1, 2015.  We use public
data for most of our analysis to examine how different services
respond to stress, and identify two policies: sites may \emph{absorb}
attack traffic, containing the damage but reducing service to some
users, or they may \emph{withdraw} routes to shift both good and bad
traffic to other sites.  We study how these deployment policies
resulted in different levels of service to different users during the
events.  We also show evidence of \emph{collateral damage} on other
services located near the attacks.",
}
Downloads: 0
About
Documentation
Keywords
Search
Users
Terms and Conditions of Use
Privacy Policy
Sitemap
© BibBase.org 2021