Denying denial-of-service attacks: A router based solution

Distributed Denial-of-Service (DDoS) attacks prevent users from accessing services on the target network by flooding the target network with a large volume of traffic. In this paper, we propose a "Hardened Network" system, which is based on intelligent routers. This network can be incrementally deployed on the Internet and can be used to detect, stop, and recover from DDoS attacks. This Hardened Network does not require any modification to the end-systems, such as the client and server hosts. It can detect a DDoS attack before it severely slows down the target machine or the network. Then, it can selectively drop packets close to the sources and hence stop the attack at points that are closer to the attack origin, and continue to provide service.