arXiv:2609.33308 · v3

SweepSketch: Detecting Carpet-Bombing Attacks Before They End

首次提交 2026-09-27 15:20

版本更新 2026-10-29 17:15

雷达观测 2026-10-30 13:28

摘要

Carpet-bombing DDoS attacks spread traffic almost uniformly across a destination prefix, keeping each host below alarm thresholds while exhausting prefix-level resources; spoofed sources make source-side evidence unreliable. Existing detectors either decide on windows of seconds, alarming only at window boundaries, or depend on supervised training, so short attacks often end before the first alarm. We present SweepSketch, a destination-anchored, per-packet sketch detector that keeps no source-side state, needs no training, and alarms while the attack is still in progress. Its core is a tagged self-cleaning windowed HyperLogLog (T-HLL) that turns uniformity testing into one event per distinct destination per window; per-packet cumulative-sum (CUSUM) decisions and dual exponentially weighted moving average (EWMA) gates form the decision chain. The reference state occupies 512 KB, and a bit-exact C++ implementation reaches 13.2 Mpps per core. On attacks lasting only 0.5 s, it raises its first alarm before the attack ends in 95.6% of attacks; on real captures, 49.3% alarm within the first second; static and mixed-traffic F1 both reach 0.991. SweepSketch is deployed in two hardware forms: a Tofino2 program carries the complete per-packet state chain and places the final gates on the control plane, while a DPU micro-engine keeps the entire decision chain in the fast path.

作者备注：19 pages, 6 figures, 11 tables; final version: new title and abstract, updated evaluation and hardware-deployment results