Evaluating Drill-Down DDoS Destination Detection

Volumetric Distributed Denial of Service (DDoS) attacks remain a persistent threat to network infrastructures. The increasing number of devices connected to the Internet, e.g., through the Internet of Things, and growing data rates make volumetric DDoS attacks easier to execute at a large scale, resulting in a high impact on the target. Drill-down DDoS Destination Detection aggregates ingress traffic in two dimensions, the source and destination IP address space, represented as a fixed-state image. A Convolutional Neural Network (CNN) identifies the attack’s target subnet using multi-class classification. Iteratively monitoring only the subnet detected by the CNN at a finer granularity leads to increasingly accurate results until the exact destination IP address is determined. The destination drill-down is evaluated on synthetic and authentic traffic, detecting an attack with 2.5% of the background traffic within 275 milliseconds.