“In computer networks, rate limiting is used to control the rate of traffic sent or received on a network interface. Traffic that is less than or equal to the specified rate is sent, whereas traffic that exceeds the rate is dropped or delayed” [81]. J. M¨ols¨a demonstrates the effectiveness of rate limiting to defend DDoS attacks in [52]. “Rate limiting can be used as a fast, automatic reaction mechanism to mitigate an attack without any undue penalties for legitimate traffic” [52]. In contrast, collateral damage for legitimate traffic is unavoidable in packet filtering because DDoS traffic cannot be easily distinguished from legitimate traffic [53].
The Max-Min fair share algorithm is usually used for resource management in IP network research. A traditional Max-Min share algorithm is to allow all routers to share the capacity of the victim equally. For example, the max-min share for each router among 5 routers is 2Mbps if the available bandwidth of the victim is 10Mbps. In [26], Y. Jing et al. treat DDoS attacks as a resource management problem [45]. To achieve better control under DDoS attacks, they modify the traditional Max-Min fair share algorithm by adding the reputation of monitored flows. If a monitored traffic flow is identified as an attack flow in a refresh time period, its reputation value will be degraded exponentially. During the next refresh time period, the flow’s reputation will be equal to one if the flow returns back to normal. When an attack happens, reputation will influence the calculation of the rate limit value for the flow. Based on NS2 simulations, better performance can be achieved than the traditional Max-Min algorithm. Furthermore, the volume of aggregated traffic is always below the limit of
CHAPTER 3. RELATED WORK 29
the victim-end network. However, the flow-based algorithm is not useful for spoofed DDoS attacks and the rate limit algorithm relies on highly accurate flow-based DDoS detection. Unfortunately, flow-based DDoS detection is difficult due to the similarity between legitimate traffic and attack traffic [53]. Finally, a more serious problem is that the reputation score does not represent the real history information of a flow very well. For example, an attack flow returns to normal for the victim after a rate limit works on it. Based on the algorithm, the reputation will be increased to one. In fact, there may still be a large number of dropped attack packets. Therefore, variation of the drop rate of a flow has no direct relationship with its reputation. In contrast, our proposed rate limit algorithm works on distance-based separated traffic instead of flow and directly combines the drop rate into its calculation of rate limit values.
To defend DDoS attacks, D. K. Y. Yau et al. propose a level-k Max-Min fair rate limit algorithm [45]. The algorithm can achieve level-k Max-Min fairness among the routers that are less than or equal to k hops away from the victim but are directly connected to a host. This means that allowed forwarding rate of traffic for the victim at each router among these routers is the Max-Min fair share of the victim’s capacity. The algorithm works based on the fact that the traffic rate at the victim end is normal if traffic rates forwarded to the victim by all level-k routers are normal. When attacks happen, the algorithm will set up an equal rate limit on all level-k routers to protect the victim. In particular, the algorithm gives better protection for the victim than the pushback rate limit algorithm proposed by R. Mahajan et al. [30]. One drawback of the algorithm is that the same rate limit for all level-k routers is unfair for these routers which forward little or no attack traffic. Collateral damage for legitimate traffic will be unavoidable in these routers. In our proposed rate limit algorithm,
CHAPTER 3. RELATED WORK 30
different rate limits are used for different routers at distance d based on their own drop rates. Lower rate limit values will be applied on the routers which are forwarding a large amount of attack traffic. Higher rate limit values will be applied on the routers which are forwarding little attack traffic. The algorithm will drop more attack packets while collateral damage for legitimate packets is less than level-k Max-Min fair rate limit algorithm.
Based on different attack flow features on different network protocols, J. Mirkovic
et al. propose a flow-based rate limit algorithm [39]. When a flow is identified as an
attack flow for the first time, its sending rate is exponentially decreased. This means that attack flows are quickly restricted to a very slow rate. Fast protection for the victim can be achieved. After attacks have gone, the recovery phase is divided into slow-recovery and exponential fast-recovery. In the beginning, the algorithm linearly increases rate limit values in order to limit the effectiveness of repeated attacks. After the network is stable enough, the algorithm increases rate limit values exponentially. As soon as the rate limit values reach the maximum value, the rate limit values will be removed. Like other flow-based rate limit algorithms, it cannot detect and react to current DDoS attacks fast and effectively because DDoS attack flows are hard to be distinguished from normal traffic flows. Another drawback of the algorithm is that the source-end rate limit algorithm cannot easily control attack traffic without information from the victim end. In our rate limit algorithm, calculation of rate limit values is based on information from the victim end. An better decision can be reached based on abundant information.
In [30], R. Mahajan et al. propose a recursive pushback rate limit algorithm which is implemented as a built-in component in each router. When a router detects
CHAPTER 3. RELATED WORK 31
that it is under heavy congestion, it identifies upstream routers which are sending offending aggregates. Usually, a aggregate is a subset of traffic with an identifiable attribute [79]. After an aggregate is detected, the pushback on the router calculates rate limit values based on the total arrival rate at its output queue and its drop history. The same limit value will be applied for each aggregate. The drawback of the algorithm is that it does not differentiate among aggregates. In fact, it just punishes them equally. In contrast, our rate limit algorithm can set up different rate limit values based on the drop rate of each aggregate in each router.