Enhancing Mitigation of Volumetric DDoS Attacks: A Hybrid FPGA/Software Filtering Datapath

Area of Science:

• Computer Engineering
• Network Security
• Cybersecurity

Background:

• Modern internet demands high-performance network devices for packet classification and filtering.
• Volumetric Distributed Denial-of-Service (DDoS) attacks necessitate efficient packet processing and filtering solutions.
• Existing solutions often lack affordability, flexibility, or ready availability.

Purpose of the Study:

• To investigate a hybrid hardware/software packet filter prototype.
• To address the need for high-speed, configurable network processing devices.
• To provide a cost-effective alternative for DDoS packet filtering.

Main Methods:

• Developed a hybrid filter combining reconfigurable FPGA technology and high-speed software filtering on commodity hardware.
• Implemented a novel approach offloading filtering rules to hardware.
• Utilized Longest Prefix Matching (LPM) algorithm with allowlists/blocklists for millions of IP prefixes.

Main Results:

• Achieved performance gains of nearly 30% compared to software-only filtering.
• Demonstrated improvements dependent on rulesets, offloading methods, and traffic types.
• Validated the effectiveness for high-speed DDoS packet filtering for IPv4 traffic.

Conclusions:

• The hybrid filter offers a cost-effective solution for network security.
• Deployment at the network edge can mitigate DDoS attacks and protect devices, including IoT.
• Enhances overall network security by providing efficient packet filtering capabilities.