Distributed denial of service is one of the most critical threats to the availability of Internet services. A botnet with only 0.01 percent of the 50 billion connected devices in the Internet of Things is sufficient to launch a massive DDoS flooding attack that could exhaust resources and interrupt any target. However, the mobility of user equipment and the distinctive characteristics of traffic behavior in mobile networks also limit the detection capabilities of traditional anti-DDoS techniques. In this article, we present a novel collaborative DDoS defense architecture called MECPASS to mitigate the attack traffic from mobile devices. Our design involves two filtering hierarchies. First, filters at edge computing servers (i.e., local nodes) seek to prevent spoofing attacks and anomalous traffic near sources as much as possible. Second, global analyzers located at cloud servers (i.e., central nodes) classify the traffic of the entire monitored network and unveil suspicious behaviors by periodically aggregating data from the local nodes. We have explored the effectiveness of our system on various types of application- layer DDoS attacks in the context of web servers. The simulation results show that MECPASS can effectively defend and clean an Internet service provider core network from the junk traffic of compromised UEs, while maintaining the false-positive rate of its detection engine at less than 1 percent.

中文翻译：

---

MECPASS：用于移动网络的分布式拒绝服务防御体系结构

分布式拒绝服务是对Internet服务可用性的最严重威胁之一。一个仅占物联网500亿连接设备中0.01％的僵尸网络足以发起大规模的DDoS泛洪攻击，这可能耗尽资源并中断任何目标。但是，用户设备的移动性和移动网络中流量行为的独特特征也限制了传统抗DDoS技术的检测能力。在本文中，我们提出了一种新颖的协作式DDoS防御体系结构，称为MECPASS，以减轻来自移动设备的攻击流量。我们的设计涉及两个过滤层次结构。首先，边缘计算服务器（即本地节点）上的过滤器试图尽可能防止欺骗攻击和源附近的异常流量。第二，位于云服务器（即中央节点）的全局分析器通过定期汇总来自本地节点的数据来对整个受监控网络的流量进行分类，并揭示可疑行为。我们已经探索了我们的系统在Web服务器环境中对各种类型的应用程序层DDoS攻击的有效性。仿真结果表明，MECPASS可以有效地保护和清除受感染UE的垃圾流量，并保护Internet服务提供商核心网络，同时将其检测引擎的误报率保持在不到1％。我们已经探索了我们的系统在Web服务器环境中对各种类型的应用程序层DDoS攻击的有效性。仿真结果表明，MECPASS可以有效地保护和清除受感染UE的垃圾流量，并保护Internet服务提供商核心网络，同时将其检测引擎的误报率保持在不到1％。我们已经探索了我们的系统在Web服务器环境中对各种类型的应用程序层DDoS攻击的有效性。仿真结果表明，MECPASS可以有效地保护和清除受感染UE的垃圾流量，并保护Internet服务提供商核心网络，同时将其检测引擎的误报率保持在不到1％。