7D: Demonstrating Drill-Down DDoS Destination Detection

Volumetric Distributed Denial of Service (DDoS) attacks are still an imminent threat in today’s Internet. Their impact on provided services continuously increases due to an ever-growing amount of connected devices and increasing data rates. At high data-rates, fine-granular traffic monitoring (e.g., micro-flow-based) is computationally infeasible without packet sampling. To avoid packet sampling, 7D utilizes coarse traffic monitoring, highly aggregating arriving traffic in only two dimensions, the source and destination IP address space. From monitored two-dimensional traffic distributions, a Convolutional Neural Network determines IP subnets receiving attack traffic. Only identified subnets receiving attack traffic are iteratively reinspected, providing a top-down drill-down approach through the IP address hierarchy, enabling sub-second DDoS destination detection with coarse traffic monitoring.