A Complete Detection and Mitigation Framework to Protect a Network from DDoS Attacks

In this paper we present a complete framework for detection and mitigation of different types of commonly seen deadly DDoS attacks. The system assumes bi-directional traffic information at an edge router to detect and mitigate the attacks. A router might not always see the outgoing traffic corresponding to the incoming traffic carried by the router and which has always been a problem for other approaches which assume bi-directionality of the traffic in the monitoring point. We introduce an agent-based technique which enables each edge router to validate the bi-directional nature of effectiveness of our detection and mitigation the incoming traffic passing through them. We present several experiments demonstrating the system. Also, we introduce a packet marking scheme called as XORID, which can be used to defend against spoofing based DDoS attacks.