Network Security Solutions สำหรับลดทอน DoS/DDoS Attacks
2 โซลูชันหลักที่ Mitigate DoS Attacks ได้โดยตรง
1. DDoS Mitigation Service / Scrubbing Center (Cloud-based)
- ตัวอย่าง: Cloudflare, Akamai, AWS Shield Advanced, Google Cloud Armor, Radware, NETSCOUT Arbor, Imperva, F5 Silverline, Azure DDoS Protection
- หลักการ: BGP Anycast / DNS Redirection → ส่ง Traffic ผ่าน Scrubbing Centers ทั่วโลก → กรอง Malicious Traffic → ส่ง Clean Traffic กลับ Origin
- จุดแข็ง: จัดการ Volumetric Attacks (Tbps+), Layer 3/4/7, Zero-day Signatures, Global Capacity, No On-prem Hardware
- ใช้สำหรับ: Volumetric DDoS, Application Layer DDoS (HTTP Flood, Slowloris), DNS Amplification
2. On-premises DDoS Mitigation Appliance (Inline/Out-of-band)
- ตัวอย่าง: Arbor TMS (NETSCOUT), Radware DefensePro/Alteon, FortiDDoS, Corero SmartWall, NSFocus, Huawei AntiDDoS, Cisco Traffic Anomaly Detector/Xtreme
- หลักการ: Inline (Transparent Bridge/Router) หรือ Out-of-band (SPAN/TAP + BGP FlowSpec/RTBH) → Behavioral Analysis, Signature, Reputation, Rate Limiting, Challenge-Response
- จุดแข็ง: Low Latency (< 1ms), Full Control, No Data Leaves Network, Immediate Response, Custom Signatures
- ใช้สำหรับ: Application Layer Attacks, State Exhaustion (TCP SYN Flood, Connection Flood), Encrypted Attack Visibility (SSL Inspection)
โซลูชันเสริม (Complementary Controls) - สำคัญไม่แพ้
| Control | DoS Mitigation Role | ตัวอย่าง |
|---|
| WAF (Web Application Firewall) | Layer 7 Protection: HTTP Flood, SQLi, XSS, Bot Mitigation, Rate Limiting per IP/User | Cloudflare WAF, AWS WAF, Imperva, F5 ASM, ModSecurity |
| Load Balancer / ADC | Traffic Distribution, Connection Limiting, SSL Offload, Health Checks, TCP Optimization | F5 BIG-IP, Citrix ADC, A10, HAProxy, NGINX Plus |
| Next-Gen Firewall (NGFW) | Stateful Inspection, DoS Protection Profiles (Zone/Interface), TCP SYN Cookie, Connection Limits | Palo Alto, Fortinet, Check Point, Cisco FTD, Sophos XGS |
| Router/Switch Features | Control Plane Policing (CoPP), uRPF, ACL Rate Limiting, BGP FlowSpec, RTBH, Storm Control | Cisco (CoPP, uRPF, FlowSpec), Juniper, Arista |
| DNS Protection | DNSSEC, Rate Limiting, Anycast DNS, Response Rate Limiting (RRL) | Cloudflare DNS, Infoblox, Cisco Umbrella, Quad9 |
| CDN (Content Delivery Network) | Absorb Traffic at Edge, Cache Static Content, Hide Origin IP, WAF Integration | Cloudflare, Akamai, Fastly, CloudFront, Azure CDN |
DoS Attack Types และ Mitigation Mapping
| Attack Type | Layer | Primary Mitigation | Secondary |
|---|
| Volumetric (UDP Flood, DNS/NTP/SSDP Amplification, ICMP Flood) | L3/4 | Cloud Scrubbing (Anycast) | RTBH, FlowSpec, Router ACL |
| Protocol/State Exhaustion (SYN Flood, ACK Flood, Connection Flood) | L4 | On-prem DDoS Appliance / NGFW SYN Cookie | Cloud Scrubbing, Load Balancer |
| Application Layer (HTTP Flood, Slowloris, RUDY, API Abuse) | L7 | WAF + Rate Limiting + Bot Management | Cloud Scrubbing, ADC |
| SSL/TLS Exhaustion (SSL Renegotiation, Handshake Flood) | L4/7 | SSL Offload (ADC) + DDoS Appliance | Cloud Scrubbing (w/ SSL Visibility) |
| IoT/Botnet (Mirai, Meris, DDoS-for-hire) | L3/4/7 | Cloud Scrubbing (Scale) + Threat Intel | On-prem + ISP Collaboration |
Best Practice Architecture: Hybrid DDoS Protection
Internet
│
▼
Cloud Scrubbing (Always-on hoặc On-demand) ──► Volumetric, L3/4, Global Capacity
│
▼ (Clean Traffic via GRE/IPinIP/Cross-connect)
Edge Router (CoPP, uRPF, FlowSpec, RTBH) ──► Infrastructure Protection
│
▼
On-prem DDoS Appliance (Inline) ──► L4 State Exhaustion, L7 Encrypted, Low Latency
│
▼
NGFW (DoS Profiles, Zone Protection) ──► Policy Enforcement, App-ID
│
▼
ADC/Load Balancer (Connection Limits, SSL Offload) ──► App Availability
│
▼
WAF (L7 Rules, Bot Management, Rate Limit) ──► App Layer Protection
│
▼
Application Servers (Auto-scaling, Circuit Breaker, Retry Logic)
สรุป: 2 โซลูชันหลักที่ตอบคำถามโดยตรง
- Cloud-based DDoS Mitigation / Scrubbing Service (Cloudflare, AWS Shield, Akamai, Radware, Arbor Cloud, ฯลฯ)
- On-premises DDoS Mitigation Appliance (Arbor TMS, Radware DefensePro, FortiDDoS, Corero, NSFocus, ฯลฯ)
ข้อสำคัญ: ใช้ทั้งคู่แบบ Hybrid (Cloud volumetric + On-prem application/state) พร้อม Layered Controls (WAF, ADC, NGFW, Router Features) เพื่อ Defense in Depth ที่ครอบคลุมทุก Layer และ Attack Vector
