A framework for generating realistic traffic for Distributed Denial-of-Service attacks and Flash Events

•A framework for generating realistic attack and benign traffic.•The framework uses modest hardware and a customised traffic generator – Botloader.•IP-aliasing is used to create thousands of interactive UDP/TCP endpoints.•The framework successfully emulates a real-world DDoS attack and Flash Event.

An intrinsic challenge associated with evaluating proposed techniques for detecting Distributed Denial-of-Service (DDoS) attacks and distinguishing them from Flash Events (FEs) is the extreme scarcity of publicly available real-word traffic traces. Those available are either heavily anonymised or too old to accurately reflect the current trends in DDoS attacks and FEs. This paper proposes a traffic generation and testbed framework for synthetically generating different types of realistic DDoS attacks, FEs and other benign traffic traces, and monitoring their effects on the target. Using only modest hardware resources, the proposed framework, consisting of a customised software traffic generator, ‘Botloader’, is capable of generating a configurable mix of two-way traffic, for emulating either large-scale DDoS attacks, FEs or benign traffic traces that are experimentally reproducible. Botloader uses IP-aliasing, a well-known technique available on most computing platforms, to create thousands of interactive UDP/TCP endpoints on a single computer, each bound to a unique IP-address, to emulate large numbers of simultaneous attackers or benign clients.

Graphical abstractFigure optionsDownload full-size imageDownload as PowerPoint slide