CAAMP: Completely automated DDoS attack mitigation platform in hybrid clouds

Distributed Denial of Service (DDoS) attacks are one of the main concerns for online service providers because of their impact on cost/revenue and reputation. This paper presents Completely Automated DDoS Attack Mitigation Platform (CAAMP), a novel platform to mitigate DDoS attacks on public cloud applications using capabilities of software defined infrastructure and network function virtualization techniques. When suspicious traffic is identified, CAAMP deploys a copy of the application's topology on-the-fly (a shark tank) on an isolated environment in a private cloud. It then creates a virtual network that will host the shark tank. Software defined networking (SDN) controller programs the virtual switches dynamically to redirect the suspicious traffic to the shark tank until final decision is made. If traffic is proved to be non-malicious, SDN controller installs flow rules on the switches to redirect the traffic back to the original application. Thus, CAAMP autonomically protects applications against potential DDoS threats and lowers the false positives associated with common detection mechanisms by leveraging resources from a private cloud.