Hybrid traceback-filtering (HTF): An efficient DoS/DDoS defense mechanism

Abstract

Denial of service attacks pose great threat to the Internet and many countermeasures have been proposed. However, few proposals address the issue of real time attack mitigation and minimizing false positive ratio and link bandwidth consumption. We propose a Hybrid Traceback-Filtering (HTF) mechanism to address these issues. By recursively activating the routers on the attack path to filter, HTF greatly improves the throughput of legitimate packets. Simulation results show that HTF drops 30% of bad packets at the start of the process and up to 100% when the traceback-filtering is completed. False positive ratio ranges from 15% to 0% at the beginning and end of the process respectively. Theoretical analysis shows that HTF saves link bandwidth consumption. For instances, when the bad packet traffic is 500 times that of the good ones, the link bandwidth consumption can be saved by more than 56%.