DDoS attacks are rampant in cloud environments and continually evolve into more sophisticated and intelligent modalities, such as low-rate DDoS attacks. But meanwhile, the cloud environment is also developing in constant. Now container technology and microservice architecture are widely applied in cloud environment and compose container-based cloud environment. Comparing with traditional cloud environments, the container-based cloud environment is more lightweight in virtualization and more flexible in scaling service. Naturally, a question that arises is whether these new features of container-based cloud environment will bring new possibilities to defeat DDoS attacks. In this paper, we establish a mathematical model based on queueing theory to analyze the strengths and weaknesses of the container-based cloud environment in defeating low-rate DDoS attack. Based on this, we propose a dynamic DDoS mitigation strategy, which can dynamically regulate the number of container instances serving for different users and coordinate the resource allocation for these instances to maximize the quality of service. And extensive simulations and testbed-based experiments demonstrate our strategy can make the limited system resources be utilized sufficiently to maintain the quality of service acceptable and defeat DDoS attack effectively in the container-based cloud environment.

中文翻译：

---

探索在基于容器的云环境中击败低速率 DDoS 攻击的新机会

DDoS 攻击在云环境中猖獗，并不断演变成更复杂和更智能的方式，例如低速率 DDoS 攻击。但与此同时，云环境也在不断发展。现在容器技术和微服务架构广泛应用于云环境，构成了基于容器的云环境。与传统云环境相比，基于容器的云环境在虚拟化上更加轻量级，在服务扩展上更加灵活。自然而然，随之而来的一个问题是，基于容器的云环境的这些新特性是否会给抵御DDoS攻击带来新的可能性。在本文中，我们建立了基于排队论的数学模型，分析了基于容器的云环境在抵御低速率 DDoS 攻击方面的优势和劣势。基于此，我们提出了一种动态 DDoS 缓解策略，该策略可以动态调节为不同用户服务的容器实例数量，并协调这些实例的资源分配，以最大限度地提高服务质量。大量的模拟和基于测试平台的实验表明，我们的策略可以充分利用有限的系统资源，以在基于容器的云环境中保持可接受的服务质量并有效抵御 DDoS 攻击。它可以动态调节为不同用户服务的容器实例数量，并协调这些实例的资源分配，以最大限度地提高服务质量。大量的模拟和基于测试平台的实验表明，我们的策略可以充分利用有限的系统资源，以在基于容器的云环境中保持可接受的服务质量并有效抵御 DDoS 攻击。它可以动态调节为不同用户服务的容器实例数量，并协调这些实例的资源分配，以最大限度地提高服务质量。大量的模拟和基于测试平台的实验表明，我们的策略可以充分利用有限的系统资源，以在基于容器的云环境中保持可接受的服务质量并有效抵御 DDoS 攻击。