Defensive Network Architectures Against Distributed Denial-of-Service Attacks

Abstract

Distributed Denial-of-Service (DDoS) attacks persistently threaten network availability and service reliability. Designing resilient networks capable of withstanding such attacks is critical. This paper surveys architecturelevel strategies and defense mechanisms developed before 2019 to bolster network resilience against DDoS threats. We categorize approaches into proactive and reactive overlays, Software-Defined Networking (SDN) and Network Functions Virtualization (NFV)-based defenses, and overlay-based session-shielding techniques. The methodology includes systematic literature analysis, performance comparison across key metrics (latency, deployment transparency, collateral damage), and integration of case studies such as Bohatei (SDN/NFV defense) and overlay frameworks like AID, WebSOS, and MOVE. Findings indicate that proactive overlays provide low latency during normal operation, while reactive overlays maintain service continuity during attacks with minimal collateral damage. SDN/NFV solutions, exemplified by Bohatei, demonstrate elastic, scalable, and responsive defense against high-throughput attacks. In Named Data Networking, Poseidon mitigates interest flooding via architectural modifications . Limitations include complexity in deployment, reliance on ISP cooperation, vulnerabilities of fixed overlay nodes, and the need for rapid detection. The proposed workflow guides deployment: threat modeling, selecting defense architecture, deploying monitoring/mitigation (e.g., SDN controllers, overlays), testing, and iterative refinement. Advantages include scalability, flexibility, and improved availability; disadvantages include cost, complexity, and potential latency during attacks. Results emphasize that hybrid models combining overlay techniques and SDN/NFV can achieve robust resilience. We conclude that multi-layered strategies are most effective, and future research should explore machine learning–enhanced detection, blockchain-assisted distributed mitigation, and real-time adaptive defense mechanisms.