Analysis of NTP DRDoS attacks’ performance effects and mitigation techniques

Abstract

Denial of Service (DoS) attacks are a type of interruption (malicious and/or unintended) that restrict or completely deny services meant for legitimate users. One of the most relevant DoS attacks is Distributed Denial of Service (DDoS) attack which is a variant of DoS, but on a larger scale using previously compromised, malware infected computers known as “bots” or “zombies”. DDoS attack occurs by generating large amounts of traffic towards an intended victim.

This paper focuses on analyzing a variant of DDoS attacks known as Network Time Protocol (NTP) Distributed Reflective Denial of Service (DRDoS) attack. The impact of the attack will be measured in the utilization of processor, memory, network and ping of most relevant devices. Further focus is on the host and network based layered “defense indepth” of NTP DRDoS attack mitigation techniques.