Defending Against Slave And Reflector Attacks With Deterministic Edge Router Marking (DERM)

Identifying the sources of a Distributed Denial-ofService (DDoS) attack is among the hardest problems in the Internet security area. Use of reflectors in a DDoS attack makes the problem particularly difficult as the actual sources of attack (slaves) are camouflaged. In this paper we propose a modification to the traceback of Multiple Hash DERM [13], an effective deterrent against DDoS attacks. The proposed modification DERM Traceback Module, helps the victim not only in perpacket filtering of the attack traffic but also in identifying the nature of the attack and tracking the actual slaves involved in reflector attacks and mixed DDoS attacks. As in [13], the marking procedure at routers is simple, bandwidth overhead is nil, processing requirements at the victim are minimal, and a limited number of packets are required to carry out the traceback procedure.