Introduction

Protective Networking (ProNet). A framework for coordinated responses to distributed attacks

Figure 1 - Requesting
a DMS service

Figure 2 - Example
of an attack

Figure 3 - BGP
connection status (Source ihr.iijlab.net)

Figure 4 - Simplified
DOTS architecture

Figure 5 - Example
of mitigation (source [16])

Figure 6 - Example
of cooperation between DMS departments

Figure 7 - An
example of cooperation between DMS services, where a DOTS server hosted
by the forwarder responds to requests from DOTS clients hosted by
the ISP.

Figure 8 - Exchange
attack information with a DOTS server

Figure 9 - Example
of outgoing DDoS attacks

Figure 10 - Example of collaboration for source filtering

Figure 11 - Attack example (before DOTS solicitation)

Figure 12 - Attack example (after DOTS solicitation)

Figure 13 - DOTS channels

Figure 14 - Example of a DDoS attack detection message

Figure 15 - Example of setting up a filter on prefix 1.2.3.4/24

Figure 16 - Example of an attack on a first network

Figure 17 - Example of the same attack on
a second network

Figure 18 - Point-to-point mode

Figure 19 - Federation mode

Figure 20 - Federation mode (bis)

Figure 21 - Subscribe to ProNet service

Figure 22 - Procedure for sending ProNet service subscription messages

Figure 23 - ProNet service subscription processing procedure

Figure 24 - Mutual subscription to ProNet service

Figure 25 - Procedure for generating ProNet notifications

Figure 26 - Example of ProNet notification by sending a NOTIFY message

Figure 27 - Example of proactive mitigation of DDoS attacks

Figure 28 - Example of a ProNet notification (NOTIFY messages) describing the
characteristics of an attack

Figure 29 - Example of ProNET notification with a NOTIFY message describing a
mitigation action

Figure 30 - Example of ProNet notification with a NOTIFY message requesting assistance

Figure 31 - Modeling an attack using
YANG semantics

Figure 32 - Example
of ProNet notification by sending a SHARE-ACTION message to share
a mitigation plan

Figure 33 - Example of attack description updates

Figure 34 - Example of attack correlation

Figure 35 - Procedure for handling ProNet notifications

Figure 36 - Example of filter installation on source network 1.2.3.0/24

Figure 37 - Example of how an FD handles a SHARE_ACTION message

Figure 38 - Example of a response to a query for an address or range of addresses

Figure 39 - Cooperation with ISPs to prevent attacks (1)

Figure 40 - Cooperation with ISPs to prevent attacks (2)