Attack Survival Moving Target

Attack SurvivalMoving Target

DDoS attacks involve many hosts sending random data to a target. In
most cases, the data is spoofed, typically with random source addresses
for each packet. One method of surviving an attack is to change the IP
address of the target system. This causes the remainder of the attack
packets to be delivered to the old, now invalid IP address.
Depending on whether the routers are flooded, it may be necessary to
remove the routes to the old IP address from the Internet (e.g. using
BGP). In order to maintain connectivity during the IP address change, it
will be necessary to update DNS. To perform the IP address change
with the minimum amount of downtime to the host system it would be
best to have a separate NAT system, and change the address of the NAT
system. This makes the change transparent to the actual target. It might
be possible to create an automated system that detects the attack and
makes the necessary DNS, BGP and NAT changes to safeguard the
availability on the target site.
Alternatively, rather than applying changes only when an attack is
detected, one can instead change the IP addresses periodically (every
day, every hour,…) and/or when an attack occurs. This forces the
attacker to perform frequent DNS requests, and these requests can
provide useful forensics information.
Filtering
There are two possibilities for flood packet filtering:
• Flood Packet Signatures.
• Reject First IP packets.