Collaboratively Increasing the DDoS-Resilience of Digital Societies Through Anti-DDoS Coalitions - read online free

Sep 16, 2026

Distributed denial-of-service (DDoS) attacks undermine Internet availability and threaten critical digital services relied on in everyday life, including financial systems and core infrastructure. The paper proposes an Anti-DDoS Coalition (ADC) where network operators collaboratively increase DDoS readiness by sharing DDoS attack fingerprints and running joint DDoS exercises. A multidisciplinary blueprint and legal governance mechanisms support ADC deployment, alongside two open-source systems and practical validation via the Netherlands’ national ADC.

LanguageEnglish

CategoryPaper Templates

FormatPDF

Pages7

Reading Time3 min

AccessFree to download

Abstract

Index Terms

I. INTRODUCTION

DDoS threats and mitigation approaches

Downsides of isolated and outsourced defenses

Collaborative mitigation and learning from peers

Collaboratively Increasing the DDoS-Resilience of Digital Societies Through Anti-DDoS Coalitions Ramin Yazdani∗, Thijs van den Hout†, Remco Poortinga -van Wijnen‡, Karl Lovink§, Cristian Hesselman†∗ ∗ University of Twente, {r.yazdani, [c.e.w.hesselman](c.e.w.hesselman}@utwente.nl)[}](c.e.w.hesselman}@utwente.nl)[@utwente.nl](c.e.w.hesselman}@utwente.nl)[ ](c.e.w.hesselman}@utwente.nl)†SIDN Labs, {thijs.vandenhout, [cristian.hesselman](cristian.hesselman}@sidn.nl)[}](cristian.hesselman}@sidn.nl)[@sidn.nl](cristian.hesselman}@sidn.nl) ‡SURF, [remco.poortinga@surf.nl](remco.poortinga@surf.nl) § The Dutch Tax and Customs Administration, [kw.lovink@belastingdienst.nl](kw.lovink@belastingdienst.nl) Abstract—Distributed denial-of-service (DDoS) attacks continue to plague the Internet and are a risk to the availability of critical digital systems that we increasingly depend on in our daily lives, such as financial services and the Internet infrastructure. To curb this problem, we propose the novel concept of an Anti-DDoS Coalition (ADC), which is a group of network operators that collaboratively increase their DDoSreadiness by (1) sharing fingerprints of the DDoS attacks they handle and (2) carrying out DDoS exercises together. The novelty of an ADC is that it combines the technical systems for both of these activities with the legal and governance means to deploy ADCs in practice. This multidisciplinary approach is unlike previous work on collaborative DDoS mitigation that focused on technology development (and largely failed). We make three contributions. First, we develop a multidisciplinary blueprint for ADCs, in terms of their activities (sharing DDoS fingerprints and carrying out DDoS exercises) and supporting legal agreements and governance mechanisms. Second, we design two open-source technical systems for ADCs: a “DDoS Clearing House” for sharing DDoS fingerprints, and a“DDoS-CH Cyber Range” for carrying out small-scale DDoS exercises, both of which extend network operators’ existing scrubbing services and other standard anti-DDoS measures. Third, we validate the concept of an ADC in practice with the Netherlands’ national Anti-DDoS Coalition (Dutch ADC), a joint effort of 22 network operators from industry, government, and academia that are currently deploying the DDoS-CH and the Cyber Range in production. Index Terms—DDoS clearing house, collaborative DDoS mitigation, DDoS fingerprints, threat intelligence sharing, anti-DDoS coalitions. I. INTRODUCTION THE digitalization of societal services eases our daily lives but also introduces new risks and challenges. A common threat in the modern Internet is a so-called Distributed Denial of Service (DDoS) attack [1] . In a DDoS attack, malicious actors send a flood of network traffic toward a victim, disrupting the legitimate traffic and services running on the target system. Such disruptions are particularly crucial when the target is a critical cyber-physical infrastructure, such as energy grids, water management systems, or smart transport systems, which increasingly rely on the Internet for their communications. Network operators can employ various layers of defense against DDoS attacks, such as DDoS scrubbing services or IP anycast. They can utilize such mitigation solutions onpremises or outsource them to a third-party provider. Outsourcing DDoS mitigation is popular because handling large attacks typically needs abundant resources and infrastructure, as well as specialized expertise. Hybrid solutions also exist where the low-profile attacks are dealt with on-premises and the more powerful ones are handled through a scrubbing service. Upstream network operators, such as Internet exchange points, can also deploy DDoS protection for their customers as they usually have high-capacity resources at their disposal. Handling DDoS attacks this way has two downsides. First, network operators tackling DDoS attacks themselves must do so with their narrow view o

FAQs

What is an Anti-DDoS Coalition (ADC) in this work?

An ADC is a group of network operators that collaboratively increase DDoS readiness by sharing fingerprints of handled DDoS attacks and conducting joint DDoS exercises.

How does the proposed ADC combine technical and governance aspects?

It integrates technical systems for fingerprint sharing and exercise execution with legal and governance mechanisms to enable ADCs to be deployed in practice.

What systems are designed and validated for ADC operations?

The work proposes a “DDoS Clearing House” for sharing DDoS fingerprints and a “DDoS-CH Cyber Range” for small-scale DDoS exercises, validated through the Netherlands’ national ADC deploying these components in production.

Sep 16, 2026

Upload by Ethan Miller