DNS recursive resolver plays the role of intermediary agent in domain name query service, making it easy to observe various DNS flooding attack behaviors. The programmable data plane has promoted innovation in in-band attack detection, but previous work has not concentrated on DNS services, and there are concerns with mistakenly killing benign traffic and low classification accuracy. In this paper, we propose DNSGreen, a comprehensive defense system against bounce-style DNS DDoS attacks in the programmable data plane. DNSGreen discusses flow and packet characteristics under anomalous behavior, employing a “flow-detection and packet-filtering” pattern to ensure effective defense while allowing benign traffic to pass through as much as possible. Furthermore, DNSGreen designs a whitelist collection module, which eliminates the need to inspect trusted streams in subsequent filtering and thereby reducing the occurrence of false positives. Finally, DNSGreen improves the allocation method of the statistical structure to enhance the accuracy of system alarms. We deploy DNSGreen on BMv2 switches and conduct tests in three attack scenarios, demonstrating that DNSGreen safeguards normal users with excellentF0:5score while filtering attack traffic.

Distributed Reflection Denial-of-Service (DRDoS) attacks have caused significant destructive effects by virtue of emerging protocol vulnerabilities and amplification advantages, and their intensity is increasing. The emergence of programmable data plane supporting line-rate forwarding provides a new opportunity for fine-grained and efficient attack detection. This paper proposed a light-weight DRDoS attack detection and mitigation system called FAPM, which is deployed at the victim end with the intention of detecting the amplification behavior caused by the attack. It places the work of collecting and calculating reflection features on the data plane operated by “latter window assisting former window” mechanism, and arranges complex identification and regulation logic on the control plane. This approach avoids the hardware constraints of the programmable switch while leveraging their per-packet processing capability. Also, it reduces communication traffic significantly through feature compression and state transitions. Experiments show that FAPM has (1) fast response capability within seconds (2) a memory footprint at the KB level and communication overhead of 1 Kbps, and (3) good robustness.

Software-Defined Networking (SDN) is a new paradigm that facilitates network management by enabling programmability and disassociating the control plane from the data plane. SDN places the control plane into one or more controllers that take charge of the entire network. However, the logically centralized controller of SDN makes it subject to some security issues. Denial-of-Service (DoS) attacks are the main threat to SDN that can lead to impaired performance of the entire network. Low-rate Denial-of-Service (LDoS) attack is a variant of DoS attacks with a lower average attack rate and high concealability which is difficult to identify with traditional DDoS/DoS attack detection mechanisms. Additionally, existing LDoS attack detection and defense mechanisms often have weak real-time performance. To address this issue, we propose in this paper PeakSAX, a novel framework that can protect SDN against LDoS attacks in real-time by (1) Attack monitoring, (2) Traffic symbolization, (3) Malicious traffic identifying, (4) Attacker location, and (5) Mitigation strategy deployment. Simulation results show that PeakSAX can quickly identify and mitigate the impact of LDoS attacks about 4s, which improves over 70% compared to existing solutions.