DDoS Attacks with Randomized Traffic Innovation: Botnet Identification Challenges and Strategies

摘要

Distributed Denial-of-Service (DDoS) attacks are usually launched through the$botnet$, an "army" of compromised nodes hidden in the network. Inferentialtools for DDoS mitigation should accordingly enable an early and reliablediscrimination of the normal users from the compromised ones. Unfortunately,the recent emergence of attacks performed at the application layer hasmultiplied the number of possibilities that a botnet can exploit to conceal itsmalicious activities. New challenges arise, which cannot be addressed by simplyborrowing the tools that have been successfully applied so far to earlier DDoSparadigms. In this work, we offer basically three contributions: $i)$ weintroduce an abstract model for the aforementioned class of attacks, where thebotnet emulates normal traffic by continually learning admissible patterns fromthe environment; $ii)$ we devise an inference algorithm that is shown toprovide a consistent (i.e., converging to the true solution as time progresses)estimate of the botnet possibly hidden in the network; and $iii)$ we verify thevalidity of the proposed inferential strategy over $real$ network traces.