ddosflowgen (2017-09-01)

ddosflowgen is a tool that models a DDoS attack and generates synthetic traffic datasets from multiple views. You can define the number of attacking networks and adjust parameters such as the attack vectors present, the amplification factor, and the number of attack sources per network. Our tool includes non-attack traffic in the output by rewriting IP addresses from a reference noise dataset.

Unlike packet-based simulations, which are not feasible at terabit scales, ddosflowgen simulates traffic using a "flow" representation. This format (implemented with SiLK) uses summaries of IP headers to describe traffic in a compact form. Flow representation makes it possible to simulate extremely high packet and bit rates, and we're currently experimenting with 1.2 Tbps attack scenarios.

ddosflowgen simulates a variety of threats:

* amplifiers/reflectors, such as DNS and NTP servers * flooders within a botnet, like Mirai in attack mode * probes from a botnet, like Mirai scanning for IoT

ddosflowgen is open source, and is available on Github. We are releasing this primarily as an aid to other researchers, and to start a discussion about how best to generate repeatable test cases for defenses against massive attacks. Please enjoy, and we're happy to consider updates, but understand that we intend this tool largely as reference material rather than as a long-running software project.

https://github.com/GaloisInc/ddosflowgen

This project is the result of funding provided by the Science and Technology Directorate of the United States Department of Homeland Security under contract number D15PC00186. The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of the Department of Homeland Security, or the U.S. Government.