Amplification Distributed Denial of Service (DDoS) attacks continue to be a high-impact force in the cybersecurity landscape. Programmable switching paves the way for revisiting the measurement of traffic integrity, offering a new opportunity to devise independent defense mechanisms against amplification traffic. A novel method capable of defending against DNS amplification distributed denial-of-service cyberattacks has been developed. The technique enables a programmable switch to independently drop up to 89% of untrusted DNS traffic. The coupling of programmable switching and sequence analysis to detect and drop amplification traffic at line rate appears to be both innovative and practical. A significant aspect of the methodology is that amplification traffic detection and prevention is accomplished in linear time. Another important advantage of this method is the suitability for applications of game theory as utility function. The contributions of this work can be summarized as follows: We present an intermediary algorithm that enables profile-agnostic defense against amplification traffic. The sequence analysis algorithm relies on parts of the packet payload to detect untrusted traffic at line rate. Furthermore, we gauge the potential benefit of in-switch sequence analysis that presents a fundamental step in the direction of more complex applications towards game theoretic trust.

In this paper we propose a new optimization for Apriori-based association rule mining algorithms where the frequency of items can be encoded and treated in a special manner drastically increasing the efficiency of the frequent itemset mining process. An efficient algorithm, called TFI-Apriori, is d eveloped for mining the complete set of frequent itemsets. In the preprocessing phase of the proposed algorithm, the most frequent items from the database are selected and encoded. The TFI-Apriori algorithm then takes advantage of the encoded information to decrease the number of candidate itemsets generated in the mining process, and consequently drastically reduces execution time in candidate generation and support counting phases. Experimental results on actual datasets – databases coming from applications with very frequent items – demonstrate how the proposed algorithm is an order of magnitude faster than the classical Apriori approach without any loss in generation of the complete set of frequent itemsets. Additionally, TFI-Apriori has a smaller memory requirement than the traditional Apriori-based algorithms and embedding this new optimization approach in well-known implementations of the Apriori algorithm allows reuse of existing processing flows.