A Novel High-Speed Architecture for Integrating Multiple DDoS Countermeasure Mechanisms Using Reconfigurable Hardware

In this paper, we proposed a novel high-speed architecture to incorporate multiple stand-alone DDoS countering mechanisms. The architecture separates DDoS filtering mechanisms, which are algorithms, out of packet decoder, which is the basement. The architecture not only helps developers to give more concentration on optimizing algorithms but also integrate multiple algorithms to achieve more efficient DDoS defense mechanism. The architecture is implemented on reconfigurable hardware, which helps algorithms to be flexibly changed or updated. We implemented and experimented the system using NetFPGA 10G board with incorporation of Port Ingress/Egress Filtering and Hop-Count Filtering to classify IP spoofing packets. The synthesis results show that the system runs at 118.907 MHz, utilizes 38.99% Registers, and 44.75% BlockRAMs/FIFOs of the NetFPGA 10G board. The system achieves the detection rate of 100% with false negative rate at 0%, and false positive rate closed to 0.16%. The experimental results prove that the system achieves packet decoding throughput at 9.869 Gbps in half-duplex mode and 19.738 Gbps in full-duplex mode

FPGA-Based Multiple DDoS Countermeasure Mechanisms System Using Partial Dynamic Reconfiguration

In this paper, we propose a novel FPGA-based high-speed DDoS countermeasure system that can flexibly adapt to DDoS attacks while still maintaining system performance. The system includes a packet decoder module and multiple DDoS countermeasure mechanisms. We apply dynamic partial reconfiguration technique in this system so that the countermeasure mechanisms can be flexibly changed or updated on-the-fly. The proposed system architecture separates DDoS protection modules (which implement DDoS countermeasure techniques) from the packet decoder module. By using this approach, one DDoS protection module can be reconfigured without interfering with other modules. The proposed system is implemented on a NetFPGA 10G board. The synthesis results show that the system can work at up to 116.782 MHz while utilizing up to 39.9% Registers and 49.85% BlockRAM of the Xilinx Virtex xcv5tx240t FPGA device on the NetFPGA 10G board. The system achieves the detection rate of 100% with the false negative rate at 0% and false positive rate closed to 0.16%. The prototype system achieves packet decoding throughput at 9.869 Gbps in half-duplex mode and 19.738 Gbps in full-duplex mode

The cerebral network of COVID-19-related encephalopathy: a longitudinal voxel-based 18F-FDG-PET study

International audienc