Amplification/Reflection Attack Suppression Using Victim Separation

Abstract

Amplification and reflection attacks represent flavors of DDoS attacks which use servers such as DNS, NTP, SNMP, SSDP and CoAP as amplifier to launch the attacks. In this letter, we describe a method to minimize the effects of reflection and amplification DDoS attacks by separating the victim service under the attack. We propose three approaches involving container level separation, packet limiting, and network hardware level separation. Our detailed experimental results on DNS based amplification attacks show a ‘near-no-attack’ performance with an improvement of up to 88% in the test completion time while using the proposed approaches.