{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,13]],"date-time":"2026-03-13T11:35:16Z","timestamp":1773401716863,"version":"3.50.1"},"reference-count":85,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"4","funder":[{"name":"National Key R&D Program of China","award":["2017YFB0801701"],"award-info":[{"award-number":["2017YFB0801701"]}]},{"DOI":"10.13039\/501100001809","name":"National Science Foundation of China","doi-asserted-by":"publisher","award":["61872426"],"award-info":[{"award-number":["61872426"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Science Foundation of China","doi-asserted-by":"publisher","award":["61625203"],"award-info":[{"award-number":["61625203"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Science Foundation of China","doi-asserted-by":"publisher","award":["61832013"],"award-info":[{"award-number":["61832013"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE\/ACM Trans. Networking"],"published-print":{"date-parts":[[2021,8]]},"DOI":"10.1109\/tnet.2021.3062621","type":"journal-article","created":{"date-parts":[[2021,3,26]],"date-time":"2021-03-26T19:37:22Z","timestamp":1616787442000},"page":"1509-1526","source":"Crossref","is-referenced-by-count":22,"title":["Enabling Performant, Flexible and Cost-Efficient DDoS Defense With Programmable Switches"],"prefix":"10.1109","volume":"29","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7939-7367","authenticated-orcid":false,"given":"Guanyu","family":"Li","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5274-5512","authenticated-orcid":false,"given":"Menghao","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8380-9136","authenticated-orcid":false,"given":"Shicheng","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Chang","family":"Liu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4847-4585","authenticated-orcid":false,"given":"Mingwei","family":"Xu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ang","family":"Chen","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8710-247X","authenticated-orcid":false,"given":"Hongxin","family":"Hu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Guofei","family":"Gu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8776-8730","authenticated-orcid":false,"given":"Qi","family":"Li","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jianping","family":"Wu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1145\/2934872.2934906"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1145\/3234200.3234205"},{"key":"ref71","first-page":"19","article-title":"The crosspath attack: Disrupting the SDN control channel via shared links","author":"cao","year":"2019","journal-title":"Proc USENIX Security07"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_8"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2013.031413.00127"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2018.2805600"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1145\/3230543.3230544"},{"key":"ref39","article-title":"On a new class of pulsing denial-of-service attacks and the defense","author":"luo","year":"2005","journal-title":"Proc NDSS"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1145\/3286062.3286063"},{"key":"ref38","year":"2019","journal-title":"Ts3booter net"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2016.7524500"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2017.8057008"},{"key":"ref33","year":"2018","journal-title":"AT&T Distributed Denial of Service (DDoS) Defense"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3302424.3303979"},{"key":"ref31","first-page":"35","article-title":"Netchain: Scale-free sub-rtt coordination","author":"jin","year":"2018","journal-title":"Proc NSDI"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3190508.3190558"},{"key":"ref37","year":"2019","journal-title":"The Next Generation IP Stresser"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3274694.3274717"},{"key":"ref35","year":"2018","journal-title":"Dayu Anti-DDoS"},{"key":"ref34","year":"2018","journal-title":"Anti-DDoS Basic"},{"key":"ref60","first-page":"299","article-title":"Elastic scaling of stateful network functions","author":"woo","year":"2018","journal-title":"Proc NSDI"},{"key":"ref62","year":"2017","journal-title":"Learn How to Get Involved With DPDK"},{"key":"ref61","year":"2017","journal-title":"World's fastest P4-programmable Ethernet switch ASICs"},{"key":"ref63","year":"2019","journal-title":"MAWI working group traffic archive"},{"key":"ref28","article-title":"Cleaning up the Internet of evil things: Real-world evidence on isp and consumer efforts to remove mirai","author":"\u00e7etin","year":"2019","journal-title":"NDSS"},{"key":"ref64","year":"2019","journal-title":"DARPA 2009 Intrusion Detection Dataset"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23147"},{"key":"ref65","year":"2019","journal-title":"A Realistic Cyber Defense Dataset"},{"key":"ref66","year":"2019","journal-title":"Ufonet—Denial of Service Toolkit"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/2740070.2626317"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23233"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516684"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2018.00047"},{"key":"ref2","author":"turton","year":"2017","journal-title":"An Interview With Lizard Squad The Hackers Who Took Down Xbox Live"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24007"},{"key":"ref20","year":"2018","journal-title":"Mirai Variant Targets Financial Sector With IoT DDoS Attacks"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/2785956.2787484"},{"key":"ref21","first-page":"249","article-title":"Network requirements for resource disaggregation","volume":"16","author":"gao","year":"2016","journal-title":"Proc OSDI"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3098822.3098824"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/2486001.2486011"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/2656877.2656890"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/3132747.3132764"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/3387514.3405855"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3098822.3098829"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1145\/2619239.2626313"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243862"},{"key":"ref57","first-page":"239","article-title":"Paving the way for NFV: Simplifying middlebox modifications using statealyzr","author":"khalid","year":"2016","journal-title":"Proc NSDI"},{"key":"ref56","year":"2019","journal-title":"Mathematical programming solver"},{"key":"ref55","first-page":"103","article-title":"Compiling packet programs to reconfigurable switches","author":"vass","year":"2020","journal-title":"Proc 3rd P4 Workshop Eur"},{"key":"ref54","first-page":"287","article-title":"Botz-4-sale: Surviving organized DDoS attacks that mimic flash crowds","author":"kandula","year":"2005","journal-title":"Proc NSDI"},{"key":"ref53","first-page":"78","article-title":"Defending against denial-of-service attacks with puzzle auctions","author":"wang","year":"2003","journal-title":"Proc 19th Int Conf Data Eng"},{"key":"ref52","first-page":"151","article-title":"Client puzzles: A cryptographic countermeasure against connection depletion attacks","volume":"99","author":"juels","year":"1999","journal-title":"Proc NDSS"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3133968"},{"key":"ref11","year":"2019","journal-title":"New dos Attack Exploits Algorithms to Knock Sites Offline"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/637209.637210"},{"key":"ref12","year":"2018","journal-title":"The Evolution of DDoS Protection"},{"key":"ref13","first-page":"327","article-title":"Dfence: Transparent network-based denial of service mitigation","volume":"7","author":"mahimkar","year":"2007","journal-title":"Proc NSDI"},{"key":"ref14","year":"2018","journal-title":"Nsfocus Anti DDoS solution"},{"key":"ref15","year":"2018","journal-title":"Cisco Guard XT 5650"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1145\/3230543.3230555"},{"key":"ref16","first-page":"817","article-title":"Bohatei: Flexible and elastic DDoS defense","author":"fayaz","year":"2015","journal-title":"Proc USENIX Security07"},{"key":"ref81","first-page":"161","article-title":"Blink: Fast connectivity recovery entirely in the data plane","author":"holterbach","year":"2019","journal-title":"Proc NSDI"},{"key":"ref17","first-page":"1092","article-title":"Understanding the mirai botnet","author":"antonakakis","year":"2017","journal-title":"Proc USENIX Security07"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1145\/2034574.2034812"},{"key":"ref18","author":"weagle","year":"2018","journal-title":"The Rise of IoT Botnet Threats and DDoS Attacks"},{"key":"ref83","first-page":"365","article-title":"Chimera: A declarative language for streaming network traffic analysis","author":"borders","year":"2012","journal-title":"Proc USENIX Security07"},{"key":"ref19","author":"rayome","year":"2018","journal-title":"Ddos attacks increased 91% in 2017 thanks to iot"},{"key":"ref80","first-page":"67","article-title":"Evaluating the power of flexible packet processing for network resource allocation","author":"sharma","year":"2017","journal-title":"Proc NSDI"},{"key":"ref4","author":"moss","year":"2016","journal-title":"Major ddos attack on dyn disrupts aws twitter spotify and more"},{"key":"ref3","author":"pauli","year":"2016","journal-title":"Chinese Gambling Site Served Near Record-Breaking Complex DDoS"},{"key":"ref6","year":"2019","journal-title":"DDoS Attacks 2018 New Records and Trends"},{"key":"ref5","author":"scroxton","year":"2016","journal-title":"Dyn Reveals Details of Complex and Sophisticated IoT Botnet Attack"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23200"},{"key":"ref8","first-page":"127","article-title":"The crossfire attack","author":"suk kang","year":"2013","journal-title":"Proc IEEE Symp Secur Privacy"},{"key":"ref7","year":"2018","journal-title":"5 most famous ddos attacks"},{"key":"ref49","first-page":"29","article-title":"Software defined traffic measurement with OpenSketch","volume":"13","author":"yu","year":"2013","journal-title":"Proc NSDI"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.19"},{"key":"ref46","first-page":"1","article-title":"Composing software defined networks","volume":"13","author":"monsanto","year":"2013","journal-title":"Proc NSDI"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/ICNP.2019.8888057"},{"key":"ref48","first-page":"531","article-title":"Flowblaze: Stateful packet processing in hardware","author":"pontarelli","year":"2019","journal-title":"Proc NSDI"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/2535838.2535862"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/2934872.2934892"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/997150.997156"},{"key":"ref44","first-page":"823","article-title":"Scaling hardware accelerated network monitoring to concurrent and dynamic queries with flow","author":"sonchack","year":"2018","journal-title":"Proc ATC"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/2934872.2934900"}],"container-title":["IEEE\/ACM Transactions on Networking"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/90\/9515194\/09387461.pdf?arnumber=9387461","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,11,1]],"date-time":"2021-11-01T19:58:37Z","timestamp":1635796717000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9387461\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,8]]},"references-count":85,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.1109\/tnet.2021.3062621","relation":{},"ISSN":["1063-6692","1558-2566"],"issn-type":[{"value":"1063-6692","type":"print"},{"value":"1558-2566","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,8]]}}}