Can we beat DDoS attacks in clouds?

Shui Yu, Yonghong Tian, Song Guo, Dapeng Oliver Wu

Research output: Journal article publicationJournal articleAcademic researchpeer-review

148 Citations (Scopus)

Abstract

Cloud is becoming a dominant computing platform. Naturally, a question that arises is whether we can beat notorious DDoS attacks in a cloud environment. Researchers have demonstrated that the essential issue of DDoS attack and defense is resource competition between defenders and attackers. A cloud usually possesses profound resources and has full control and dynamic allocation capability of its resources. Therefore, cloud offers us the potential to overcome DDoS attacks. However, individual cloud hosted servers are still vulnerable to DDoS attacks if they still run in the traditional way. In this paper, we propose a dynamic resource allocation strategy to counter DDoS attacks against individual cloud customers. When a DDoS attack occurs, we employ the idle resources of the cloud to clone sufficient intrusion prevention servers for the victim in order to quickly filter out attack packets and guarantee the quality of the service for benign users simultaneously. We establish a mathematical model to approximate the needs of our resource investment based on queueing theory. Through careful system analysis and real-world data set experiments, we conclude that we can defeat DDoS attacks in a cloud environment.
Original languageEnglish
Article number6567859
Pages (from-to)2245-2254
Number of pages10
JournalIEEE Transactions on Parallel and Distributed Systems
Volume25
Issue number9
DOIs
Publication statusPublished - 1 Jan 2014
Externally publishedYes

Keywords

  • Cloud computing
  • DDoS attacks
  • mitigation
  • resource investment
  • system modelling

ASJC Scopus subject areas

  • Signal Processing
  • Hardware and Architecture
  • Computational Theory and Mathematics

Cite this