Synchronizing DDoS defense at network edge with P4, SDN, and Blockchain

Abstract: 

Botnet-based distributed denial-of-service (DDoS) attacks are still a major problem on the internet and cause disruptions for legitimate users. Despite various proposals made over the past two decades, defenders face challenges as botnets possess orchestrated processes to launch disruptive attacks, while defenders rely on manual methods, siloed tools, and lack of orchestration among different organizations. As a result, defenders' unorchestrated efforts slow down the attack response and prolong the lifespan of botnet attacks. To tackle this issue, shieldSDN and shieldCHAIN are presented as an inter-organization collaborative defense framework using P4, SDN, and Blockchain. This framework extends the microVNF solution, which provides edge security for SIP-enabled IoT devices with P4 and produces attack fingerprints called Indicator of Compromise (IOC) records. ShieldSDN and shieldCHAIN distribute these IOCs to other organizations, enabling them to create their packet filters. By synchronizing packet filters for different organizations, shieldSDN and shieldCHAIN mitigate against the same botnet strain. Four experiments were conducted successfully to validate the functionalities of shieldSDN and shieldCHAIN. The first experiment was intra-company, while the second, third, and fourth experiments were inter-company. The experiments demonstrated that shieldSDN and shieldCHAIN extracted, shared, retrieved, and installed IOCs as packet filters, making them identical to those in the originating organization. This framework is the first of its kind to use the P4 switch, SDN controller, and Blockchain together for this use case. With the increasing acceptance of SDN and Blockchain, this framework can empower community members to collaborate and defend against botnet DDoS attacks.

Author: 

Aldo Febro, Hannan Xiao, Joseph Spring, Bruce Christianson

Year: 

2022

Domain: 

Dimension: 

Region: 

Data Type: 

Keywords: