TY - GEN A1 - Kopp, Daniel A1 - Strehle, Eric A1 - Hohlfeld, Oliver T1 - CyberBunker 2.0 - A Domain and Traffic Perspective on a Bullet Proof Hoster T2 - CCS '21: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, November 2021 Y1 - 2021 U6 - https://doi.org/10.1145/3460120.3485352 ER - TY - GEN A1 - Wichtlhuber, Matthias A1 - Strehle, Eric A1 - Kopp, Daniel A1 - Prepens, Lars A1 - Stegmueller, Stefan A1 - Rubina, Alina A1 - Dietzel, Christoph A1 - Hohlfeld, Oliver T1 - IXP Scrubber: Learning from Blackholing Traffic for ML-Driven DDoS Detection at Scale T2 - ACM SIGCOMM 2022 Conference, 2022 N2 - Distributed Denial of Service (DDoS) attacks are among the most critical cybersecurity threats, jeopardizing the stability of even the largest networks and services. The existing range of mitigation services predominantly filters at the edge of the Internet, thus creating unnecessary burden for network infrastructures. Consequently, we present IXP Scrubber, a Machine Learning (ML) based system for detecting and filtering DDoS traffic at the core of the Internet at Internet Exchange Points (IXPs) which see large volumes and varieties of DDoS. IXP Scrubber continuously learns DDoS traffic properties from neighboring Autonomous Systems (ASes). It utilizes BGP signals to drop traffic for certain routes (blackholing) to sample DDoS and can thus learn new attack vectors without the operator’s intervention and on unprecedented amounts of training data. We present three major contributions: i) a method to semi-automatically generate arbitrarily large amounts of labeled DDoS training data from IXPs’ sampled packet traces, ii) the novel, controllable, locally explainable and highly precise two-step IXP Scrubber ML model, and iii) an evaluation of the IXP Scrubber ML model, including its temporal and geographical drift, based on data from 5 IXPs covering a time span of up to two years. KW - Machine Learning, Traffic Classification, Denial of Service Y1 - 2022 UR - https://dl.acm.org/doi/pdf/10.1145/3544216.3544268 SP - 707 EP - 722 ER -