3 ms·

Could we not solve the problem of DDOS through collaboration between hosts and ISP's? 1) DDOS attack is detected 2) Attacking IP addresses are sent automated D

Could we not solve the problem of DDOS through collaboration between hosts and ISP's? 1) DDOS attack is detected 2) Attacking IP addresses are sent automated DDOS abuse notifications 3) ISP, like your credit card company when it's machine learning algos detect fraud ask for human back channel verification like SMS. 4) ISP notifies user of suspected bot on one of their devices. The onus is put on the user to run a secure network and remove or fix offending devices. This system could work well for residential connections at least. It could be implemented similarly to the way spam is handled by the internet, bad neighborhoods and networks that don't self police are treated as second class citizens.

therealidiot 10y ago
> It could be implemented similarly to the way spam is handled by the internet, bad neighborhoods and networks that don't self police are treated as second class citizens. Please no, the way spam is handled on the internet means that anyone who isn't already a massive internet company is usually treat as a second class citizen
- willholloway 10y ago
  On second thought, agreed. I hope that is not part of the solution. I think that our routers may be the key, or are at least completely negligent at the moment. A normal consumer router is essentially a black box, but it should be a watchdog. The router should alert users when suspect outbound traffic is originating from it's network. Of course the router could be compromised, and router patch cycles are atrocious generally, but this method could notify in case of hacked IP cameras and thermostats.
rtpg 10y ago
ISPs do this for bittorrent, I imagine similar things could be set up for DDOS attacks. A little message from the ISP like "hey, you were sending out some DDoS stuff, please check your devices."
marcosdumay 10y ago
This. But with ISP procedures mandated by governments, with international synchronization of rules. This already works well for medicine, aviation, telephone systems, transit signaling, and a huge number of other things. There's no reason to believe this wouldn't work for internet security. We could start by mandating the network best practices RFC.

therealidiot 10y ago

> It could be implemented similarly to the way spam is handled by the internet, bad neighborhoods and networks that don't self police are treated as second class citizens. Please no, the way spam is handled on the internet means that anyone who isn't already a massive internet company is usually treat as a second class citizen

willholloway 10y ago
On second thought, agreed. I hope that is not part of the solution. I think that our routers may be the key, or are at least completely negligent at the moment. A normal consumer router is essentially a black box, but it should be a watchdog. The router should alert users when suspect outbound traffic is originating from it's network. Of course the router could be compromised, and router patch cycles are atrocious generally, but this method could notify in case of hacked IP cameras and thermostats.

rtpg 10y ago

ISPs do this for bittorrent, I imagine similar things could be set up for DDOS attacks. A little message from the ISP like "hey, you were sending out some DDoS stuff, please check your devices."

marcosdumay 10y ago

This. But with ISP procedures mandated by governments, with international synchronization of rules. This already works well for medicine, aviation, telephone systems, transit signaling, and a huge number of other things. There's no reason to believe this wouldn't work for internet security. We could start by mandating the network best practices RFC.