@misc{WagnerKoppWichtlhuberetal., author = {Wagner, Daniel and Kopp, Daniel and Wichtlhuber, Matthias and Dietzel, Christoph and Hohlfeld, Oliver and Smaragdakis, Georgios and Feldmann, Anja}, title = {United We Stand: Collaborative Detection and Mitigation of Amplification DDoS Attacks at Scale}, series = {ACM CCS 2021 - November 15-19, Virtual Conference}, journal = {ACM CCS 2021 - November 15-19, Virtual Conference}, doi = {10.1145/3460120.3485385}, language = {en} } @misc{KoppWichtlhuberPoeseetal., author = {Kopp, Daniel and Wichtlhuber, Matthias and Poese, Ingmar and Cardoso de Santanna, Jos{\´e} Jair and Hohlfeld, Oliver and Dietzel, Christoph}, title = {DDoS Hide \& Seek: On the Effectiveness of a Booter Services Takedown}, series = {Proceedings of the Internet Measurement Conference (IMC 2019), Amsterdam, Netherlands — October 21 - 23, 2019}, journal = {Proceedings of the Internet Measurement Conference (IMC 2019), Amsterdam, Netherlands — October 21 - 23, 2019}, publisher = {ACM}, address = {New York, NY, USA}, isbn = {978-1-4503-6948-0}, doi = {10.1145/3355369.3355590}, pages = {65 -- 72}, language = {en} } @misc{KoppDietzelHohlfeld, author = {Kopp, Daniel and Dietzel, Christoph and Hohlfeld, Oliver}, title = {DDoS Never Dies? An IXP Perspective on DDoS Amplification Attacks}, series = {Proceedings of the Passive and Active Measurement (PAM) conference 2021}, journal = {Proceedings of the Passive and Active Measurement (PAM) conference 2021}, pages = {17}, abstract = {DDoS attacks remain a major security threat to the continuous operation of Internet edge infrastructures, web services, and cloud platforms. While a large body of research focuses on DDoS detection and protection, to date we ultimately failed to eradicate DDoS altogether. Yet, the landscape of DDoS attack mechanisms is even evolving, demanding an updated perspective on DDoS attacks in the wild. In this paper, we identify up to 2608 DDoS amplification attacks at a single day by analyzing multiple Tbps of traffic flows at a major IXP with a rich ecosystem of different networks. We observe the prevalence of well-known amplification attack protocols (e.g., NTP, CLDAP), which should no longer exist given the established mitigation strategies. Nevertheless, they pose the largest fraction on DDoS amplification attacks within our observation and we witness the emergence of DDoS attacks using recently discovered amplification protocols (e.g., OpenVPN, ARMS, Ubiquity Discovery Protocol). By analyzing the impact of DDoS on core Internet infrastructure, we show that DDoS can overload backbone-capacity and that filtering approaches in prior work omit 97\% of the attack traffic.}, language = {en} } @misc{KoppStrehleHohlfeld, author = {Kopp, Daniel and Strehle, Eric and Hohlfeld, Oliver}, title = {CyberBunker 2.0 - A Domain and Traffic Perspective on a Bullet Proof Hoster}, series = {CCS '21: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, November 2021}, journal = {CCS '21: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, November 2021}, doi = {10.1145/3460120.3485352}, pages = {3}, language = {en} } @misc{WichtlhuberStrehleKoppetal., author = {Wichtlhuber, Matthias and Strehle, Eric and Kopp, Daniel and Prepens, Lars and Stegmueller, Stefan and Rubina, Alina and Dietzel, Christoph and Hohlfeld, Oliver}, title = {IXP Scrubber: Learning from Blackholing Traffic for ML-Driven DDoS Detection at Scale}, series = {ACM SIGCOMM 2022 Conference, 2022}, journal = {ACM SIGCOMM 2022 Conference, 2022}, pages = {707 -- 722}, abstract = {Distributed Denial of Service (DDoS) attacks are among the most critical cybersecurity threats, jeopardizing the stability of even the largest networks and services. The existing range of mitigation services predominantly filters at the edge of the Internet, thus creating unnecessary burden for network infrastructures. Consequently, we present IXP Scrubber, a Machine Learning (ML) based system for detecting and filtering DDoS traffic at the core of the Internet at Internet Exchange Points (IXPs) which see large volumes and varieties of DDoS. IXP Scrubber continuously learns DDoS traffic properties from neighboring Autonomous Systems (ASes). It utilizes BGP signals to drop traffic for certain routes (blackholing) to sample DDoS and can thus learn new attack vectors without the operator's intervention and on unprecedented amounts of training data. We present three major contributions: i) a method to semi-automatically generate arbitrarily large amounts of labeled DDoS training data from IXPs' sampled packet traces, ii) the novel, controllable, locally explainable and highly precise two-step IXP Scrubber ML model, and iii) an evaluation of the IXP Scrubber ML model, including its temporal and geographical drift, based on data from 5 IXPs covering a time span of up to two years.}, language = {en} }