Distributed DDOS Prevention

Distributed Denial of Service attacks work by having lots of Web clients access a particular Web site or service at the same time. Since each access looks like a genuine request for information the server cannot differentiate between the traffic which it was designed to serve and that which is intended to distract it. It gets swamped.

It wouldn't be so bad if networking systems worked well at high capacity but, in general, they don't. The high level of traffic results in everything slowing down to a crawl and the server spending all of its time spitting out the same information to people who aren't even listening. They may have even spoofed their return address so that they don't get the traffic.

Distributed DDOS Prevention would involve using the infrastructure to handle such attacks. The system would work as a co-operation between servers and routers:
- Each server would communicate its maximum traffic level to its local router and would never get swamped.
- The router would analyse traffic patterns and would set limits to all its nearest neighbours.
- They, in turn, could do the same until the problem is spread out enough that none of the infrastructure is unduly taxed.

So, what happens to the extra traffic. Well, the simple solution would be to just drop it. This would still make the DDOS attck have some success since the dropped traffic would be a mix of genuine and malicious packets.

The more complex solution would be for the router itself to issue a challenge and response to detrmine that there is someone at the other end. It could supply the user with web page containing one of those images that contain a word obscured in an image so that a human can read it but it foxes an machine. When the person enters the word their IP address is remembered and the traffic passed with a higher priority.

Packets with faked source addresses wouldn't receive the challenge and packets auto-generated by some trojan on a vulnerable machine wouldn't be capable of proving the response. At enough hops away from the server to make the traffic managable, genuine attempts to access the server would be passed and malicious attempts to disrupt the server dropped.

It's not a complete solution, but might be another step in the arms race.