Distributed SIP DDoS Defense with P4

Aldo  Febro; Hannan Xiao; William Spring

doi:10.1109/WCNC.2019.8885926

Distributed SIP DDoS Defense with P4

Aldo Febro, Hannan Xiao, William Spring

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

6 Citations (Scopus)

195 Downloads (Pure)

Abstract

SIP DDoS attack is growing and has a real threat to crippling public communication infrastructure. The standard approach to building the defense is at or near the attack destination (i.e. victim’s location). This approach is struggling to keep up with the growing volume and attack sophistication. To be better prepared for future attacks, the workload needs to be distributed, and the attack needs to be mitigated as close to the attack source as possible. This paper experiments with data plane programming (P4) and control plane programming of Ethernet switches to provide first-hop detection and mitigation capability for SIP INVITE DDoS attack at every switch port. This approachcreates a distributed or source-based defense component which could be added to the existing destination-based components to create a more comprehensive overall solution that is extensible, economical, and scalable against SIP DDoS attack of the future.

Original language	English
Title of host publication	2019 IEEE Wireless Communications and Networking Conference (WCNC)
Subtitle of host publication	Proceedings
Publisher	Institute of Electrical and Electronics Engineers (IEEE)
Number of pages	8
ISBN (Electronic)	9781538676462
ISBN (Print)	9781538676479
DOIs	https://doi.org/10.1109/WCNC.2019.8885926
Publication status	Published - 31 Oct 2019
Event	2019 IEEE Wireless Communications and Networking Conference, WCNC 2019 - Marrakesh, Morocco Duration: 15 Apr 2019 → 19 Apr 2019

Conference

Conference	2019 IEEE Wireless Communications and Networking Conference, WCNC 2019
Country/Territory	Morocco
City	Marrakesh
Period	15/04/19 → 19/04/19

Access to Document

10.1109/WCNC.2019.8885926Licence: Unspecified

1570500591CNC2019 camera
© 2019 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.
Accepted author manuscript, 1.06 MBLicence: Unspecified

Cite this

@inproceedings{64d0a755f47941ae8644f3f779bac4d5,

title = "Distributed SIP DDoS Defense with P4",

abstract = "SIP DDoS attack is growing and has a real threat to crippling public communication infrastructure. The standard approach to building the defense is at or near the attack destination (i.e. victim{\textquoteright}s location). This approach is struggling to keep up with the growing volume and attack sophistication. To be better prepared for future attacks, the workload needs to be distributed, and the attack needs to be mitigated as close to the attack source as possible. This paper experiments with data plane programming (P4) and control plane programming of Ethernet switches to provide first-hop detection and mitigation capability for SIP INVITE DDoS attack at every switch port. This approachcreates a distributed or source-based defense component which could be added to the existing destination-based components to create a more comprehensive overall solution that is extensible, economical, and scalable against SIP DDoS attack of the future.",

author = "Aldo Febro and Hannan Xiao and William Spring",

note = "{\textcopyright} 2019 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.; 2019 IEEE Wireless Communications and Networking Conference, WCNC 2019 ; Conference date: 15-04-2019 Through 19-04-2019",

year = "2019",

month = oct,

day = "31",

doi = "10.1109/WCNC.2019.8885926",

language = "English",

isbn = "9781538676479",

booktitle = "2019 IEEE Wireless Communications and Networking Conference (WCNC)",

publisher = "Institute of Electrical and Electronics Engineers (IEEE)",

address = "United States",

}

TY - GEN

T1 - Distributed SIP DDoS Defense with P4

AU - Febro, Aldo

AU - Xiao, Hannan

AU - Spring, William

N1 - © 2019 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.

PY - 2019/10/31

Y1 - 2019/10/31

N2 - SIP DDoS attack is growing and has a real threat to crippling public communication infrastructure. The standard approach to building the defense is at or near the attack destination (i.e. victim’s location). This approach is struggling to keep up with the growing volume and attack sophistication. To be better prepared for future attacks, the workload needs to be distributed, and the attack needs to be mitigated as close to the attack source as possible. This paper experiments with data plane programming (P4) and control plane programming of Ethernet switches to provide first-hop detection and mitigation capability for SIP INVITE DDoS attack at every switch port. This approachcreates a distributed or source-based defense component which could be added to the existing destination-based components to create a more comprehensive overall solution that is extensible, economical, and scalable against SIP DDoS attack of the future.

AB - SIP DDoS attack is growing and has a real threat to crippling public communication infrastructure. The standard approach to building the defense is at or near the attack destination (i.e. victim’s location). This approach is struggling to keep up with the growing volume and attack sophistication. To be better prepared for future attacks, the workload needs to be distributed, and the attack needs to be mitigated as close to the attack source as possible. This paper experiments with data plane programming (P4) and control plane programming of Ethernet switches to provide first-hop detection and mitigation capability for SIP INVITE DDoS attack at every switch port. This approachcreates a distributed or source-based defense component which could be added to the existing destination-based components to create a more comprehensive overall solution that is extensible, economical, and scalable against SIP DDoS attack of the future.

U2 - 10.1109/WCNC.2019.8885926

DO - 10.1109/WCNC.2019.8885926

M3 - Conference contribution

SN - 9781538676479

BT - 2019 IEEE Wireless Communications and Networking Conference (WCNC)

PB - Institute of Electrical and Electronics Engineers (IEEE)

T2 - 2019 IEEE Wireless Communications and Networking Conference, WCNC 2019

Y2 - 15 April 2019 through 19 April 2019

ER -

Distributed SIP DDoS Defense with P4

Abstract

Conference

Access to Document

Fingerprint

Cite this