{"id":1829,"date":"2022-03-02T08:05:00","date_gmt":"2022-03-02T16:05:00","guid":{"rendered":"https:\/\/ant.isi.edu\/blog\/?p=1829"},"modified":"2022-03-03T11:03:34","modified_gmt":"2022-03-03T19:03:34","slug":"new-paper-anycast-agility-network-playbooks-to-fight-ddos-at-usenix-security-symposium-2022","status":"publish","type":"post","link":"https:\/\/ant.isi.edu\/blog\/?p=1829","title":{"rendered":"new paper “Anycast Agility: Network Playbooks to Fight DDoS” at USENIX Security Symposium 2022"},"content":{"rendered":"\n

We will publish a new paper titled “Anycast Agility: Network Playbooks to Fight DDoS<\/a>” by A S M Rizvi (USC\/ISI), Leandro Bertholdo (University of Twente), Jo\u00e3o Ceron (SIDN Labs), and John Heidemann (USC\/ISI) at the 31st USENIX Security Symposium <\/em>in Aug. 2022. <\/p>\n\n\n\n

\"\"<\/a>
A sample anycast playbook for a 3-site anycast deployment. Different routing configurations provide different traffic mixes. From [Rizvi22a, Table 5].<\/figcaption><\/figure><\/div>\n\n\n\n

From the abstract:<\/p>\n\n\n\n

IP anycast is used for services such as DNS and Content Delivery Networks (CDN) to provide the capacity to handle Distributed Denial-of-Service (DDoS) attacks. During a DDoS attack service operators redistribute traffic between anycast sites to take advantage of sites with unused or greater capacity. Depending on site traffic and attack size, operators may instead concentrate attackers in a few sites to preserve operation in others. Operators use these actions during attacks, but how to do so has not been described systematically or publicly. This paper describes several methods to use BGP to shift traffic when under DDoS, and shows that a response playbook<\/em> can provide a menu of responses that are options during an attack. To choose an appropriate response from this playbook, we also describe a new method to estimate true attack size, even though the operator\u2019s view during the attack is incomplete. Finally, operator choices are constrained by distributed routing policies, and not all are helpful. We explore how specific anycast deployment can constrain options in this playbook, and are the first to measure how generally applicable they are across multiple anycast networks.<\/p><\/blockquote>\n\n\n\n

Dataset used in this paper are listed at https:\/\/ant.isi.edu\/datasets\/anycast\/anycast_against_ddos\/index.html<\/a>, and the software used in our work is at https:\/\/ant.isi.edu\/software\/anygility<\/a>. They are provided as part of Call for Artifacts.<\/p>\n\n\n\n

Acknowledgments: A S M Rizvi and John Heidemann\u2019s work on this paper is supported, in part, by the DHS HSARPA Cyber Security Division via contract number HSHQDC-17-R-B0004-TTA.02-0006-I. Joao Ceron and Leandro Bertholdo\u2019s work on this paper is supported by Netherlands Organisation for scientific research (4019020199), and European Union\u2019s Horizon 2020 research and innovation program (830927). We would like to thank our anonymous reviewers for their valuable feedback. We are also grateful to the Peering and Tangled admins who allowed us to run measurements. We thank Dutch National Scrubbing Center for sharing DDoS data with us. We also thank Yuri Pradkin for his help to release our datasets.<\/p>\n","protected":false},"excerpt":{"rendered":"

We will publish a new paper titled “Anycast Agility: Network Playbooks to Fight DDoS” by A S M Rizvi (USC\/ISI), Leandro Bertholdo (University of Twente), Jo\u00e3o Ceron (SIDN Labs), and John Heidemann (USC\/ISI) at the 31st USENIX Security Symposium in Aug. 2022. From the abstract: IP anycast is used for services such as DNS and Content […]<\/p>\n","protected":false},"author":998,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[337,338,278],"tags":[43,166,71,339,154,63,58,29,225,5,57,144],"class_list":["post-1829","post","type-post","status-publish","format-standard","hentry","category-anycast","category-bgp","category-internet","tag-anycast","tag-bgp","tag-datasets","tag-ddidd","tag-ddos","tag-dns","tag-isi","tag-network-traffic","tag-paaddos","tag-papers","tag-usc","tag-utwente"],"_links":{"self":[{"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1829","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=\/wp\/v2\/users\/998"}],"replies":[{"embeddable":true,"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1829"}],"version-history":[{"count":10,"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1829\/revisions"}],"predecessor-version":[{"id":1842,"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1829\/revisions\/1842"}],"wp:attachment":[{"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1829"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1829"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1829"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}