## 5 DoS and DDoS Defense
### Security Architecture  
A security architecture involves several elements: servers, switch controller, protocols, router and applications. **Security Aware Cloud Architecture. ** [PERSON] et al. [45] highlight that the abstraction level of the Cloud model (SaaS being the most abstract and IaaS being the least abstract) influences the number of security aspects that will be handled by the provider (more abstraction means the provider will be in charge of more security aspects). In the intermediate case of PaaS, users remain in charge of confidentiality and data privacy, yet the provider is responsible for data integrity and availability. Generally speaking, they propose a Security Aware Cloud Architecture that offers protection to secure public Clouds and data centers. The mechanisms are (1) trust delegation and negotiation architecture; (2) worm containment and DDoS defense; (3) reputation system of resource sites; (4) fine-grain access control and (5) collusive privacy prevention. No tests assess the performance of their architecture. **DDoS Attack Mitigation Architecture: DaMask. ** [PERSON] et al. [46] propose a DDoS attack mitigation architecture. The Software-Defined Networking (SDN) is an approach that allows network administrators to manage network services by way of abstraction of lower-level functionality. The authors find that the SDN and Cloud Computing can enhance the DDoS attack defense. The DaMask architecture has three layers: network switches, network controllers and network applications. There are two separate modules: (1) DaMask-D, a network attack detection system, and (2) DaMask-M, an attack reaction module. DaMask-D already has an efficient attack detection algorithm with a very low overhead. DaMask-M defines three basic operations: forward, drop and modify the packet. Those operations are implemented as a set of APIs. Consequently, the defenders can customize the countermeasures. **Security Architecture based on Defense. ** [PERSON] et al. [47] propose the security architecture composed of different types of firewalls that cooperate in defense zones. It includes a set of layers: (1) the perimeter defense; (2) the deceptive; (3) the detection and (4) the cryptography. The security mechanisms proposed in each layer are implemented in the defense zones and collaborate to protect the data. The perimeter defense consists of a border router and two stateful firewalls. Between the provided service and the rest of the Internet, this defense provides the core security functionality to protect the classified data in defense zones. The deceptive layer operate in every defense zone with a honeynet to identify new attacks and vulnerabilities of their systems. The detection layer consists of IDSs that analyze the network traffic with a predefined rule set. The cryptography layer into the cloud environment is the elliptic curve cryptography. This attacks the following: address spoofing, tiny fragment attacks, buffer overflows, port scans, OS fingerprinting, web attacks, Trojan attacks, viruses and worms, insider threats, attacks on virtualization, DoS and DDoS attacks, which are mitigated by a number of security components in the architecture. The authors do not evaluate the cost of implementing such an architecture. [PERSON] et al. [18] propose a federated cloud architecture to use migration of virtual machines to defense against cloud DDoS attacks. The architecture is composed of (1) Scalable Cloud DDoS Probe Manager that is responsible for monitoring the user Internet access; (2) Scalable Cloud DDoS Correlation Analysis Manager is responsible for performing correlation analysis in each Cloudinfrastructure; (3) DDooS Cloud Migration Manager is responsible for the availability by migrating the attacked Virtual Machine to physical machines not under DDoS attack; and (4) DDoS Cloud ReRoute Manager is responsible for the network interconnections. **Hybrid Firewalling Architecture. ** [PERSON] et al.