An Extremely Lightweight Approach for DDoS Detection at Home Gateways

A major threat to the Internet infrastructure and, more broadly, to its culture is posed by DDoS attacks. To mitigate their impact, detection should preferably occur close to the attack origin, e.g., at home-routers. However, these devices typically have limited resources and an approach that relies on packet inspection does not bode well with such devices.We propose a lightweight approach for DDoS detection that solely employs network interface byte and packet counts. To detect attacks with such a limited amount of information, our key insight consists in training classifiers to make use of workload data from 1,823 home-users augmented with attacks generated in a controlled environment. In our experiments, we selected seven attack vectors generated using Mirai and BASHLITE malwares. We then conduct a device-agnostic detection of attacks vectors, obtaining F1 scores typically higher than 0.99. To cope with the evolving nature of DDoS attacks, we also report results indicating the detection power of the proposed methodology when different attack vectors are used for training and testing.