Autonomous Cyber Defense Against Dynamic Multi-strategy Infrastructural DDoS Attacks

Conference · Fri Oct 27 04:00:00 EDT 2023

DOI:https://doi.org/10.1109/CNS59707.2023.10288937· OSTI ID:2228809

Dutta, Ashutosh ^[1]; Al-Shaer, Ehab ^[2]; Chatterjee, Samrat ^[3]; Duan, Qi ^[2]

---

1. University of North Carolina at Charlotte
2. Carnegie Mellon University
3. BATTELLE (PACIFIC NW LAB)

Dynamic Infrastructural Distributed Denial of Service (I-DDoS) attacks constantly change attack vectors to congest core backhaul links and disrupt critical network availability while evading end-system defenses. To effectively counter these highly dynamic attacks, defense mechanisms need to exhibit adaptive decision strategies for real-time mitigation. This paper presents a novel Autonomous DDoS Defense framework that employs model-based reinforcement agents. The framework continuously learns attack strategies, predicts attack actions, and dynamically determines the optimal composition of defense tactics such as filtering, limiting, and rerouting for flow diversion. Our contributions include extending the underlying formulation of the Markov Decision Process (MDP) to address simultaneous DDoS attack and defense behavior, and accounting for environmental uncertainties. We also propose a fine-grained action mitigation approach robust to classification inaccuracies in Intrusion Detection Systems (IDS). Additionally, our reinforcement learning model demonstrates resilience against evasion and deceptive attacks. Evaluation experiments using real-world and simulated DDoS traces demonstrate that our autonomous defense framework ensures the delivery of approximately 96 - 98% of benign traffic despite the diverse range of attack strategies.

• Research Organization: Pacific Northwest National Laboratory (PNNL), Richland, WA (United States)
• Sponsoring Organization: USDOE
• DOE Contract Number: AC05-76RL01830
• OSTI ID: 2228809
• Report Number(s): PNNL-SA-189781
• Country of Publication: United States
• Language: English