Anycast and Its Potential for DDoS Mitigation

Abstract

IP anycast is widely being used to distribute essential Internet services, such as DNS, across the globe. One of the main reasons for doing so is to increase the redundancy of the service and reduce the impacts of the growing threat of DDoS attacks. IP anycast can be further used to mitigate DDoS attacks by confining the attack traffic to certain areas. This might cause the targeted service to become unavailable only to a fraction of its users. In this PhD research we aim at investigating how IP anycast can be optimized both statically and dynamically to support the mitigation of DDoS attacks.

A Cognitive Anycast Routing Method for Delay-Tolerant Networks

“…It plays a vital role for DNS and CDN and services, but different issues have been noted, including the detection latency of IP anycast prefixes [20], AS-level anycast path inflation [21], and client-server mapping limitations that arise in CDN routing [2]. Several enhancements have been discussed focusing on either performance, see, e.g., [22,23], or security, e.g., to mitigate distributed denial-of-service (DDoS) attacks [5]. It has been shown that anycast routing can achieve near-optimal response times and that it can be tailored to suit the QoS requirements of DiffServ networks [24], but these techniques often require knowledge about the global network state (i.e., router loads) [25,26].…”

“…A common application involves information retrieval in content-delivery networks (CDN), where user requests can be served from the most appropriated data center hosting a geographically replicated service [1][2][3][4]. This alternative to unicast routing helps to reduce service latency that can originate from normal or intended network congestion, e.g., as produced by a denial-of-service attack [5]. In addition, it helps improve service resiliency to partial network outages [6].…”

BGP Anycast Tuner: Intuitive Route Management for Anycast Services

“…Early studies focused on the first large-scale application of anycast to the DNS [9] [21] [22], and on architectures for creating a global anycast service [3] [4]. More recently, anycast was used as a security tool [23] [6] [24]. Hesselman et al [25] study how to provide a control plane for DNS top-level domain (TLD) operators to increase security and stability of TLDs, while Rizvi et al [8] describe a method for building a "response playbook" for the use of BGP to shift anycast traffic when under DDoS attacks.…”

Tangled: A Cooperative Anycast Testbed

“…In the following years, we expanded our community network around the testbed, deploying anycast sites around the world. Several researches were carried out along the years using the TANGLED network: anycast catchment studies [26] and the tool called VERFPLOETER [27]; and several anti-DDoS studies from [14], [15] were carried out using our testbed. Moreover, the TANGLED testbed is actively being used in the projects SAND [28] and PaaDDoS [29].…”