A simple response packet confirmation method for DRDoS detection

In this paper, we propose a simple but tough method for confirming response packets to detect DRDoS attack packets. In DRDoS attacks, the victim suffers from reflected response packets from legitimate hosts, and it is difficult to distinguish attack packets from legitimate packets. We focus on the fact that the types of packet used for DRDoS are limited and predictable. Thus, the proposed method uses only a pair of request/response, and does not need complicated state management like the stateful inspection method. We demonstrate that the proposed method can accurately detect DRDoS packets with fewer cost.