Protective Networking (ProNet). A framework for coordinated responses to distributed attacks

A DDoS (Distributed Denial of Service) attack is an attempt to make network resources, computing resources or even access to services unavailable to their users. In most cases, such attacks can be massive, compromising several hundred thousand endpoints, which in turn can be used as relays to amplify the attack's damaging power. The 2019 edition of the Symantec report includes:

• 24,000 applications embedded in mobile terminals are blocked on a daily basis;

• a 600% increase between 2016 and 2017 in the number of attacks targeting connected objects (Internet of Things);

• an increase in the volume of attack traffic between 2016 and 2017. In 2016, attack traffic represented 5% of global web traffic, and 7.8% in 2017.

Recent statistics also show a marked change in the duration of attacks: the vast majority (77%) of attacks detected in 2017 lasted more than an hour, and 6% of them lasted at least 12 hours, or even more than a day (3%). In the last quarter of 2018, an attack lasted 329 hours (practically two weeks), according to data from a Kaspersky report.

In addition, the ATLAS report revealed that :

• 274 attacks exceeded the 100 Gbit/s threshold in the first half of 2016, compared with 223 attacks for the whole of 2015 ;

• 46 attacks exceeded the 200 Gbit/s threshold in the first half of 2016, while only 16 attacks were observed in 2015;

• the United States, France and Great Britain are prime targets for attacks with volumes in excess of 10 Gbit/s.

Since the publication of these reports, DDoS attacks have become increasingly frequent and intense, such as the attack suffered by a French provider, which exceeded 1 Tbit/s in volume. What's more, with the advent of "Booters" (or "stressers", platforms for selling denial of service) and the concept of "DDoS-as-a-Service", executing large-scale DDoS attacks has practically become within everyone's reach.

According to another study :

• more than 20 million IP spoofing attacks targeting more than 2 million IPv4 (/24) prefixes were carried out. These prefixes represent more than a third of all prefixes advertised on the Internet;

• 4.3% of attack targets subscribed to a DMS mitigation...