Defid: Detecting and Filtering Distributed Denial of Service Attack in Edge Computing Environment

Edge computing has evolved as a decentralised technology for processing data closer to its source, thus reducing latency and improving bandwidth utilisation. However, this shift also introduces new security challenges, particularly Distributed Denial of Service (DDoS) attacks. As there are numerous components associated with the edge computing environment, the effect of an attack on one component can be cascaded to other components which can severely disrupt the application execution. To handle that, this paper presents DEFID, a framework for DDoS attack detection and filtering in the edge computing environment. Defid utilises Extended Berkeley Packet Filter (eBPF) to detect and filter the DDoS attack. Since eBPF allows efficient execution of custom monitoring and filtering programs executing directly within the Linux kernel, it provides a lightweight, high-performance and flexible framework for real-time network traffic analysis. The effectiveness of Defid is analysed using three separate attack programs, Goldeneye, SlowLoris and Tor's Hammer Attack in a test environment which shows that the proposed solution is able to accurately detect and filter various types of DDoS attack traffic with minimal overhead.