Selectivity and Autoscaling as Complementary Defenses for DDoS Protection to Cloud Services

Distributed Denial-of-Service (DDoS) is becoming an even more complex problem with the migration of these services and applications to shared and centralized cloud infrastructures. Application layer Denial-of-Service attacks (ADDoS) is an special type of DDoS attacks, and the main problem in mitigating these attacks is because attacker requests are similar to legitimate clients. This paper proposes to use the scalability feature of cloud infrastructure as a defense from high-rate DDoS attacks, and selectivity defense to mitigate low-rate ADDoS attacks. Experiments are conducted in an OpenStack cloud environment to show that the combined use of selectivity and autoscaling can be used as a defense against low- and high-rate DDoS attacks.