![](https://csdnimg.cn/release/download_crawler_static/15384729/bg3.jpg)
global view of the network [20–22]. The global view can
help the network perform load balance or other tasks bet-
ter than when they are performed by each router with a lo-
cal view. IP spoofing identification requires a lot of
resource on routers; however, if this task is performed by
a separate server, the resource on routers can be saved. Be-
sides, the server can perform better filtering because it has
the global view of the network.
Another feature to reduce data plane cost is the protec-
tion perimeter. For a network with a certain scale, the
number of interfaces managed by the VASE server can be
enormous. In order to make the solution scalable, a perim-
eter concept is introduced. The routers chosen to filter
spoofing traffic can form one or more perimeters separat-
ing the inside routers from the other part of the network,
as illustrated in Fig. 1. Inside the perimeters, sampling
and filtering are only performed at the interfaces where
the perimeter connects with the other part of the network
and the interface attached by the stub network. There is no
need to check packet on the interfaces connected to other
routers inside the perimeter, because the incoming traffic
has either been validated whenever it intersects the perim-
eter, or leaves the stub network. The perimeter concept is
essential: however large the VASE coverage is, the number
of interfaces to manage is only the sum of the amount of
stub networks in the perimeter and the amount of links
intersecting the perimeter. It is worth noting that when-
ever all the routers are contained in VASE, filtering will
be only performed on interfaces attached by the stub
network.
Hereafter, the perimeters are named by VASE perimeter
and the routers inside the perimeters are named by VASE
router. Interfaces on which sampling and filtering are per-
formed are denoted by VASE interface, specially, the inter-
faces on links that intersect VASE perimeter are denoted by
VASE border interface.
2.2. Traffic sampling and sample collecting
Whenever routers to perform filtering are determined,
sampling is configured on the VASE interfaces. Traffics
arriving at VASE interfaces are sampled to the VASE server
by sampling mechanism on routers, discussed in Section
5.2.
The sampling rate must be set with the considering of
the tradeoff between the recall ratio of spoofing flow and
load on routers. To capture an attack, at least one spoofing
packet must be sampled in the attacking period. Three
parameters are essential for designing an appropriate sam-
pling rate: (1) the duration of attacks; (2) the ratio of
spoofing packets to all the packets; (3) the rate of packet
on the link.
Inspired by the shape of pdf (probability density
function) diagram of duration in [7], we use log-normal
distribution Log N(
l
,
r
2
) to model the spoofing flow
duration, as illustrated in Fig. 2. Levenberg–Marquardt
algorithm [23] is used to get the nonlinear least squares fit-
ting result based on samples from the statistic result of [7],
the estimated parameters based on these given values are
l
= 3.0541,
r
2
= 1.0804. Based on the model of attack dura-
tion, more than 99.9% spoofing flows last more than
0.85 min. Note that attacks with less duration than 1 min
are eliminated from the statistic result; thus the result is
biased. However, an attack of very short duration is not
of great damage. Thus, the bias is not vital.
To launch an successful (D)DoS attack, attackers will try
their best to utilize the available bandwidth to send attack-
ing traffic. Denote the ratio of spoofing packet by r.If
attacks are required to be captured with probability no less
than P, the required sampling times c is:
c P
lnð1 PÞ
lnð1 rÞ
The corresponding sampling rate is determined by the
packet per second (PPS) on interface. Denote the PPS of link
by pps. If requiring capturing attacks with duration no less
than m seconds, the required sampling rate is:
rate P
c
pps m
P
lnð1 P Þ
pps m lnð1 rÞ
Take 1% link occupation as a serious attack and 90% as
the required capture rate. It requires 1:10
6
sampling rate
on a 10 GE interface when average packet size is 1500 -
bytes, and the link is of 10% load, or 1:2.2 10
7
in the case
that link is of 100% load and average packet size is
64 bytes.
10
0
10
1
10
2
10
3
0
0.005
0.01
0.015
0.02
0.025
0.03
0.035
Duration(min)
pdf
Log-Normal Fitting Model
Sampled Value
Fig. 2. The fitting model of duration distribution of spoofing attacks.
Fig. 1. The Virtual Anti-Spoofing Edge architecture.
G. Yao et al. / Computer Networks 57 (2013) 243–257
245