Preliminary study of fission defenses against low-volume DoS attacks on proxied multiserver systems

Multiserver applications deployed in the public cloud infrastructure continue to be plagued by significant threat of Distributed Denial of Service (DDoS) attacks by large scale botnets, including very notable attack instances just this past Fall. Previously, proposed cloud-based defenses have attempted to address different aspects of this problem including: a proactive moving target approach to combat the reconnaissance phase where the botnet ascertains the identities (IP addresses) of the proxy (indirection) servers, and client-to-proxy-server assignment shuffling to deal with volumetric attacks. In this paper, we describe a “fission” quarantine approach to deal with low-volume DoS attacks targeting the application servers. We then overview a developing attack-defense emulation platform. Finally, we give the results of a preliminary, model based numerical evaluation of the performance and cost of fission defense.