P-CCBFF: A Lightweight Cooperative Detection and Traceback Framework of DDoS/DoS Attacks

Abstract

Detection and traceback of distributed denial of service (DDoS/DoS) attacks have become a challenge for network security. This paper proposes a lightweight cooperative detection and traceback framework, i.e., P-CCBFF equipped on a router, to detect and trace the DDoS/DoS attacks online. The P-CCBFF includes a counting bloom filter (CBF1), a super alert link (SA-Link) and a complex structure, which is made up of parallel counting bloom filters and a single CBF (PCBF-CBF). The P-CCBFF uses the ＂options＂ field of IPV4 to distinguish different network connection topologies of the routers and stores the existing DDoS/DoS attacks and all connected devices addresses into CBF1. In addition, the P-CCBFF stores the suspicious packets with spoofed source address or attack features into the PCBF-CBF. By querying the CBF1 and PCBF-CBF, the P-CCBFF at the source-end recognizes suspicious packets and sends out super alerts to the victim. The P-CCBFF at the victim-end recognizes DDoS/DoS attacks by super alerts and sends back identify information to the sources. Experimental results show that the P-CCBFF is effective in detection and traceback different DDoS attacks at low memory and CPU costs.