A New Smart Router-Throttling Method to Mitigate DDoS Attacks

Abstract

The distributed denial of service (DDoS) attack is one of the most server threats to the current Internet and brings huge losses to society. Furthermore, it is challenging to defend DDoS due to the case that the DDoS traffic can appear similar to the legitimate ones. Router throttling is an accessible approach to defend DDoS attacks. Some existing router throttling methods dynamically adjust a given threshold value to keep the server load safe. However, these methods are not ideal as they exploit the information of the current time, so the perception of time series variations is poor. The DDoS problem can be seen as a Markov decision process (MDP). Multi-agent router throttling (MART) method based on hierarchical communication mechanism has been proposed to address this problem. However, each agent is independent with each other and has no communication among them, therefore, it is hard for them to collaborate to learn an ideal policy to defend DDoS. To solve this multi-agent partially observable MDP problem, we propose a centralized reinforcement learning router throttling method based on a centralized communication mechanism. Each router sends its own traffic reading to a central router, the central router then makes a decision for each router to choose the throttling rate. We also simulate the environment of the DDoS problem more realistic while modify the reward function of the MART to make the reward function of more coherent. To decrease the communication costs, we add a deep deterministic policy gradient network for each router to decide whether or not to send information to the central agent. The experiments validate that our proposed new smart router throttling method outperforms existing methods to the DDoS instruction response.INDEX TERMS Distributed denial of service, router throttling, Markov decision process, multi-agent router throttling, hierarchical communication, centralized communication, communication costs.

ReCEIF: Reinforcement Learning-Controlled Effective Ingress Filtering

“…After processing all packets in time step t, the algorithm generates the input state of the RL agent (lines [16][17][18]. Specifically, the number of generated filter rules r t , the number of HHHs generated at each hierarchy level h t , and the tensor F t .…”

Applications of Multi-Agent Reinforcement Learning in Future Internet: A Comprehensive Survey

“…The authors in [180] and [181] propose to adopt MARL framework for the purpose of collaborative DDoS defending. The system model involves hosts, routers, and servers.…”

“…The action of each agent is to decide whether to send the aggregate traffic. The authors in [180] propose to use a fully centralized collaborative method, namely Centralized Reinforcement Learning Router Throttling (CRLRT) to train the agents. Each agent first transmits its aggregate traffic information to the central DDPG agent for joint action decision-making.…”

“…3) Malicious packet knowledge: In security solutions, such as [181] and [180], MARL is used to enable each router to learn an collaborative traffic control policy that aims to maximize the average legitimate traffic rate of all the routers. For this, the rewards in these solutions are defined based on the assumption of the knowledge of malicious packets.…”

Agentes Inteligentes baseados em Aprendizado por Reforço para Alocação Dinâmica de Tráfego em Nuvens

“…A técnica consiste em utilizar um agente, definido como um módulo computacional capaz de agir de maneira autônoma para alcançar os objetivos para os quais foi desenvolvido [Isbell et al, 2001]. O agente analisa o estado atual do ambiente, responde com uma ação e recebe em retorno uma recompensa ou uma punição pela ação tomada [Xia et al, 2019]. Com o retorno, o agente altera seus parâmetros e se adapta ao ambiente em uma velocidade proporcionalà modelagem das recompensas adquiridas e punições sofridas.…”