Fighting Fire with Light: A Case for Defending DDoS Attacks Using the Optical Layer
This addresses DDoS defense for network operators by leveraging optical networking innovations, though it is incremental as it builds on existing optical technologies.
The paper tackles the growing DDoS attack problem by proposing an optical layer-aware defense (O-LAD) that uses dynamic wavelength reconfiguration to isolate attack traffic, showing improved throughput and latency for legitimate flows during attacks.
The DDoS attack landscape is growing at an unprecedented pace. Inspired by the recent advances in optical networking, we make a case for optical layer-aware DDoS defense (O-LAD) in this paper. Our approach leverages the optical layer to isolate attack traffic rapidly via dynamic reconfiguration of (backup) wavelengths using ROADMs---bridging the gap between (a) evolution of the DDoS attack landscape and (b) innovations in the optical layer (e.g., reconfigurable optics). We show that the physical separation of traffic profiles allows finer-grained handling of suspicious flows and offers better performance for benign traffic in the face of an attack. We present preliminary results modeling throughput and latency for legitimate flows while scaling the strength of attacks. We also identify a number of open problems for the security, optical, and systems communities: modeling diverse DDoS attacks (e.g., fixed vs. variable rate, detectable vs. undetectable), building a full-fledged defense system with optical advancements (e.g., OpenConfig), and optical layer-aware defenses for a broader class of attacks (e.g., network reconnaissance).