  Despite the proliferation of traffic filtering capabilities throughout the
Internet, attackers continue to launch distributed denial-of-service (DDoS)
attacks to successfully overwhelm the victims with DDoS traffic. In this paper,
we introduce a distributed filtering system that leverages nodes distributed
along the paths of DDoS traffic to filter the DDoS traffic. In particular, we
focus on adaptive distributed filtering, a new direction in filtering DDoS
traffic. In our design, a subscriber to the distributed filtering service can
act on behalf of a DDoS victim and generate filtering rules that not only adapt
to the most suitable and effective filtering granularity (e.g., IP source
address and a port number vs. an individual IP address vs. IP prefixes at
different lengths), but also adapt to the preferences of the subscriber (e.g.,
maximum coverage of DDoS traffic vs. minimum collateral damage from dropping
legitimate traffic vs. minimum number of rules).
  We design an efficient algorithm that can generate rules adaptive toward
filtering granularities and objectives, which can further help determine where
to deploy generated rules for the best efficacy. We evaluated our system
through both large-scale simulations based on real-world DDoS attack traces and
pilot studies. Our evaluations confirm that our algorithm can generate rules
that adapt to every distinct filtering objective and achieve optimal results.
We studied the success rate and distribution of rule deployment under different
Internet-scale rule deployment profiles, and found a small number of autonomous
systems can contribute disproportionately to the defense. Our pilot studies
also show our adaptive distributed filtering system can effectively defend
against real-world DDoS attack traces in real time.
