Wire-speed DDoS Attack Mitigation using Hardware Acceleration of Programmable DPUs

Service providers face significant challenges from Distributed Denial of Service (DDoS) attacks since existingmitigation techniques, including various Machine Learning and flow-based approaches, often lack efficiency due to high latencyand inadequate filtering. This paper proposes a novel DDoS mitigation strategy using programmable Data Processing Units(DPUs) to offload detection and mitigation processes, utilizing hardware acceleration. Our approach leverages DPUs to executeflow-based filtering, focusing on mitigating TCP SYN flood attacks. We demonstrate that our DPU-based hardware-accelerated framework successfully eliminates, after a fast learning phase, all the malicious traffic while maintaining high data throughput up to 100 Gbps.