Differential Packet Filtering Against DDoS Flood Attacks

We present a new packet filtering scheme, which is traffic-smart to defend against network worms and flood attacks. The scheme prevents malicious hackers from orchestrating DDoS flooding attacks on any IP-based public network. All packets from each IP source are counted and timed during their life cycles. Special IP counters and timers are used to support the filtering process. This new approach mitigates flood attacks through adaptive filtering with differential quality of services provided to good and bad packets. We show the implementation requirements of the schemes on network routers or firewalls. Through an example traffic and filter setting, we demonstrate the advantages of the differential packet filtering. An improvement factor of 45% was achieved, compared with the static routing without discrimination between good and bad packets.