The probability Strata: Algorithmic approach to DRDoS defense

Distributed Reflection Denial of Service or DRDoS are attacks directed against a particular area in a network to force it to shut down normal operations by saturating the victim's link to the internet using a medium of reflection to bounce off the adversary's malicious intents hence providing complete anonymity on the point of attacker. Attackers have been able to throttle up the attack bandwidths to several Gbps in the past and this form of attack remains a potent threat due to the number of faulty servers currently available on the internet. In this paper we follow a two pronged approach to solving the DRDoS problem by (i) Studying effective ways to create DRDoS attacks in a testable environment and scale up their effects to the real-world scale and (ii) to provide effective countermeasures directed against these attacks and creating a secure networking environment without the threat of DRDoS attacks using Satisfaction Based Traffic Shaping Algorithm. In our research we focus on three vectors namely DNS, NTP and SNMP which have been touted as the most commonly used in these attacks.