论文标题
Anycast敏捷性：与DDOS作战的网络剧本
Anycast Agility: Network Playbooks to Fight DDoS
论文作者
论文摘要
IP Anycast用于DNS和内容输送网络（CDN）等服务，以提供处理分布式拒绝服务（DDOS）攻击的能力。在DDOS攻击服务中，运营商在各个站点之间重新分布流量，以利用无用或更大容量的站点。根据现场流量和攻击尺寸，操作员可以将攻击者集中在几个站点中，以保留其他站点的操作。操作员在攻击过程中使用这些动作，但是如何进行系统或公开描述。本文介绍了使用BGP在DDOS下移动流量的几种方法，并表明响应剧本可以提供响应菜单，这些响应是攻击过程中选项的菜单。为了从本剧本中选择适当的响应，我们还描述了一种估计真实攻击大小的新方法，即使操作员在攻击过程中的视图不完整。最后，操作员的选择受分布式路由策略的约束，而不是所有人都有帮助。我们探讨了特定的任何cast部署如何限制本剧本中的选项，并且是第一个衡量它们在多个任何cast网络中通常适用的人。
IP anycast is used for services such as DNS and Content Delivery Networks (CDN) to provide the capacity to handle Distributed Denial-of-Service (DDoS) attacks. During a DDoS attack service operators redistribute traffic between anycast sites to take advantage of sites with unused or greater capacity. Depending on site traffic and attack size, operators may instead concentrate attackers in a few sites to preserve operation in others. Operators use these actions during attacks, but how to do so has not been described systematically or publicly. This paper describes several methods to use BGP to shift traffic when under DDoS, and shows that a response playbook can provide a menu of responses that are options during an attack. To choose an appropriate response from this playbook, we also describe a new method to estimate true attack size, even though the operator's view during the attack is incomplete. Finally, operator choices are constrained by distributed routing policies, and not all are helpful. We explore how specific anycast deployment can constrain options in this playbook, and are the first to measure how generally applicable they are across multiple anycast networks.
