Uma abordagem leve para detecção de DDoS a partir de roteadores domésticos

DDoS attacks are prevalent. To mitigate their impact, detection should preferably occur closest to the attack origin, at the network edge, e.g., at home routers. However, these devices typically have limited resources and the use of approaches that resort on packet inspection do not bode well with such devices. We propose an extremely lightweight approach for DDoS detection that employs solely network interface byte counts. To detect attacks with such limited amount of information, our key insight consists in training classifiers making use of real workload data from nearly one thousand home-users augmented with attacks generated in a controlled environment. We show that our classifiers are very efficient in detecting attacks with different vectors.