Cyber Ares: Botnet Active Defense Method in Collaboration with Sava

Distributed denial-of-service (DDoS) attacks has always been a major threat to cyber security. The current defense against DDoS attacks is mostly divided into three stages: pre-event, during-event and post-event. Because the collection of prior intelligence can often help defend against DDoS attacks, current commercial DDoS defense solutions will focus on active defense against DDoS. Due to the high intensity of the new large-scale pulse-wave DDoS attack, DDoS active defense still cannot completely solve the problem. If the defense is completely close to the victim, pulse wave DDoS attacks may still affect actual services, making the intelligence collected by DDoS active defense unusable, and thus unable to effectively mitigate the intensity of DDoS attacks. We propose a method called Cyber Ares, which combines DDoS active defense with source address validation architecture (SAVA), and use the intelligence collected by active defense to move defense forward, achieving ideal DDoS mitigation effects. We use SAVA's capability blocking IP spoofing to reduce the intensity of the attack. We use the black and white lists provided by SAVA to block malicious IP traffic from botnets in advance. The final experiment shows that the method, the DDoS traffic of the attacked victim can be effectively mitigated.