TY - GEN A1 - Wagner, Daniel A1 - Kopp, Daniel A1 - Wichtlhuber, Matthias A1 - Dietzel, Christoph A1 - Hohlfeld, Oliver A1 - Smaragdakis, Georgios A1 - Feldmann, Anja T1 - United We Stand: Collaborative Detection and Mitigation of Amplification DDoS Attacks at Scale T2 - ACM CCS 2021 - November 15-19, Virtual Conference Y1 - 2021 UR - https://sigsac.org/ccs/CCS2021/accepted-papers.html U6 - https://doi.org/10.1145/3460120.3485385 ER - TY - GEN A1 - Kopp, Daniel A1 - Wichtlhuber, Matthias A1 - Poese, Ingmar A1 - Cardoso de Santanna, José Jair A1 - Hohlfeld, Oliver A1 - Dietzel, Christoph T1 - DDoS Hide & Seek: On the Effectiveness of a Booter Services Takedown T2 - Proceedings of the Internet Measurement Conference (IMC 2019), Amsterdam, Netherlands — October 21 - 23, 2019 Y1 - 2019 UR - https://arxiv.org/abs/1909.07455 SN - 978-1-4503-6948-0 U6 - https://doi.org/10.1145/3355369.3355590 SP - 65 EP - 72 PB - ACM CY - New York, NY, USA ER - TY - GEN A1 - Kopp, Daniel A1 - Dietzel, Christoph A1 - Hohlfeld, Oliver T1 - DDoS Never Dies? An IXP Perspective on DDoS Amplification Attacks T2 - Proceedings of the Passive and Active Measurement (PAM) conference 2021 N2 - DDoS attacks remain a major security threat to the continuous operation of Internet edge infrastructures, web services, and cloud platforms. While a large body of research focuses on DDoS detection and protection, to date we ultimately failed to eradicate DDoS altogether. Yet, the landscape of DDoS attack mechanisms is even evolving, demanding an updated perspective on DDoS attacks in the wild. In this paper, we identify up to 2608 DDoS amplification attacks at a single day by analyzing multiple Tbps of traffic flows at a major IXP with a rich ecosystem of different networks. We observe the prevalence of well-known amplification attack protocols (e.g., NTP, CLDAP), which should no longer exist given the established mitigation strategies. Nevertheless, they pose the largest fraction on DDoS amplification attacks within our observation and we witness the emergence of DDoS attacks using recently discovered amplification protocols (e.g., OpenVPN, ARMS, Ubiquity Discovery Protocol). By analyzing the impact of DDoS on core Internet infrastructure, we show that DDoS can overload backbone-capacity and that filtering approaches in prior work omit 97% of the attack traffic. Y1 - 2021 UR - https://arxiv.org/abs/2103.04443 UR - https://www.springerprofessional.de/ddos-never-dies-an-ixp-perspective-on-ddos-amplification-attacks/19017760 ER - TY - GEN A1 - Kopp, Daniel A1 - Strehle, Eric A1 - Hohlfeld, Oliver T1 - CyberBunker 2.0 - A Domain and Traffic Perspective on a Bullet Proof Hoster T2 - CCS '21: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, November 2021 Y1 - 2021 U6 - https://doi.org/10.1145/3460120.3485352 ER - TY - GEN A1 - Wichtlhuber, Matthias A1 - Strehle, Eric A1 - Kopp, Daniel A1 - Prepens, Lars A1 - Stegmueller, Stefan A1 - Rubina, Alina A1 - Dietzel, Christoph A1 - Hohlfeld, Oliver T1 - IXP Scrubber: Learning from Blackholing Traffic for ML-Driven DDoS Detection at Scale T2 - ACM SIGCOMM 2022 Conference, 2022 N2 - Distributed Denial of Service (DDoS) attacks are among the most critical cybersecurity threats, jeopardizing the stability of even the largest networks and services. The existing range of mitigation services predominantly filters at the edge of the Internet, thus creating unnecessary burden for network infrastructures. Consequently, we present IXP Scrubber, a Machine Learning (ML) based system for detecting and filtering DDoS traffic at the core of the Internet at Internet Exchange Points (IXPs) which see large volumes and varieties of DDoS. IXP Scrubber continuously learns DDoS traffic properties from neighboring Autonomous Systems (ASes). It utilizes BGP signals to drop traffic for certain routes (blackholing) to sample DDoS and can thus learn new attack vectors without the operator’s intervention and on unprecedented amounts of training data. We present three major contributions: i) a method to semi-automatically generate arbitrarily large amounts of labeled DDoS training data from IXPs’ sampled packet traces, ii) the novel, controllable, locally explainable and highly precise two-step IXP Scrubber ML model, and iii) an evaluation of the IXP Scrubber ML model, including its temporal and geographical drift, based on data from 5 IXPs covering a time span of up to two years. KW - Machine Learning, Traffic Classification, Denial of Service Y1 - 2022 UR - https://dl.acm.org/doi/pdf/10.1145/3544216.3544268 SP - 707 EP - 722 ER -