CIRL: DDoS mitigation in eFIT

DDoS attacks have been a topic of research for some time, and a number of solutions have been proposed which address their prevention or mitigation. However, none of these proposed systems have been widely deployed, and as a result the internet at large remains susceptible to relatively simple, stealthy, and potent DDoS attacks. We conjecture that there are two related fundamental reasons that the proposed systems have not been widely deployed: many of the proposed systems require either large-scale deployment to be successful, or cannot be incrementally deployed, or both. In this paper, we present a new system, Core Ingress Rate Limiting (CIRL), which attempts to address both of these problems by working in the context of a new internet architecture, eFIT, and borrowing some techniques from existing proposals. eFIT is designed to solve a dierent problem in the internet, but its architecture provides useful facilities for CIRL and its incremental deployment could be used to ensure a wide deployment of CIRL thereby avoiding incremental deployability concerns.