Patronum: In-network Volumetric DDoS Detection and Mitigation with Programmable Switches

Distributed Denial-of-Service (DDoS) attacks continue to pose a significant threat to the Internet. While middlebox-based defenses offer high performance, they are costly and lack flexibility. Software-based defenses, on the other hand, provide flexibility but suffer from low performance. Recently, programmable switches have emerged and present an opportunity for efficient in-network defenses against DDoS attacks at line speed. Unfortunately, most existing in-network defenses fail to run on the switch data plane and introduce high latency. To address these issues, we propose Patronum, an in-network defense system running entirely in the data plane of programmable switches to defend against various volumetric DDoS attacks. We summarize volumetric DDoS attacks into two distinct threat models with thoroughly study: many-to-few (M2F) and few-to-few (F2F). With this basis, we implement two independent approaches to detect M2F and F2F, respectively. For M2F attacks, we devise an entropy-based approach and employ an approximate calculation method to facilitate its execution within the switch data plane. In addressing F2F attacks, we further design a bandwidth monitor with a fine-grained time window management mechanism to detect these types of attacks. We implement Patronum based on an Intel Tofino switch and compare it with the state-of-the-art DDoS defense systems, AccTurbo and Jaqen, under CAIDA and MAWI datasets. The experimental results show that the average impact of Patronum on benign traffic is only 28% of that of AccTurbo, while its mitigation effect on attack traffic is 16% better than that of Jaqen.