Pisces: In-Path Distributed Denial-of-Service Defense via Efficient Authentication Code Embedded in IP Address

High-volume brute-force distributed denial-of-service (DDoS) attack is among the top threats on the Internet. Existing widely deployed methods (e.g., BGP blackhole and scrubbing center) have difficulty achieving legitimate traffic friendliness, low cost, low latency, and high accuracy. We present an in-path DDoS defense mechanism, namely Pisces. Without requiring modifications to existing IP protocols, Pisces embeds authentication information into the IP address. Simultaneously, we design a QUIC-based extension to distribute authentication information. Pisces incorporates a translator module and a filter module, which accurately identifies malicious and legitimate traffic. These multi-dimensional compatibility advantages make it easy to deploy in the real world. We implement Pisces on a high-end commercial router with service processing units. Even without hardware acceleration, a single CPU can achieve 20 Gbps throughput and the performance can scale linearly with the number of CPUs. The additional latency for the victim-related traffic and other traffic is around 27 us and 0.5 us, respectively, whose cost is far less than the scrubbing center. Remarkably, Pisces without false positives can provide high-quality datasets for intelligent approaches and form a prominent complementary effect.