A Distributed Denial-of-Service Defense System Using

Abstract. Distributed Denial of Service (DDoS) attacks have been a big threat to the Internet while no effective schemes have been proposed or deployed, leaving the Internet still vulnerable to such attacks. We propose a proactive DDoS defense scheme [Ki04] by having multiple routers form a defense perimeter. They collaboratively detect DDoS at-tacks, if exist, and differentiate attacking packets from good ones by scoring every arrival packet destined to identified victims, based on its attribute values, and discard those with scores less than a dynamic threshold. Those with lower scores are more likely to be the at-tacking ones. We extend the concept of packet-scoring and devise simpler schemes to calculate packets ’ scores and to determine the discarding threshold. For instance, scores are ob-tained based on a Laky-Bucket overflow control. We show that the new schemes are more adaptive to the attacks changing their attacking types dynamically