## 5 DoS and DDoS Defense
### Attack Mitigation  
To eradicate an attack, there are five general requirements [18]. First, detect the attack as quickly as possible and determine its magnitude (determine the impact and their level of significance). Second, try to mitigate the effects of the attack as much as possible. Third, if step two is not sufficient enough or impossible, migrate the VM under attack to safe physical servers. In order to do so, there is a fourth requirement guaranteeing network bandwidth. Eventually, put an end to the attack with countermeasures that rank from very basic to highly complex. Whatever the measure, it will not be perfect for every situation. Often a compromise must be made when choosing one or another. As a general rule, to prevent such attacks, the resources allocated to users must be limited to a bare minimum. For authenticated users, it is possible to establish quotas to limit the load a particular user can put on the system. In particular, one might consider handling only a single request per user at one given time, by synchronizing the users' sessions. However, this solution remains problematic due to the choice of quotas and the resulting quality of service for the end user, as it may deteriorate. A more efficient solution would be to dynamically use the scalability of Cloud infrastructures to maintain availability while the attack is being eradicated. **Virtual Machine Monitor (VMM). ** [PERSON] et al. [34] propose a VMM composed of a tagger, a duplicator and a detector. The goal is to monitor and compute the amount of available resources and to compare it to a threshold to detect the presence of an attack. Since the VMM has greater privileges than the guest operating system, it can monitor and evaluate the guest's performance. When under attack, the OS and all the applications are moved to a new isolated entity. During the migration process, there is no service interruption for the user under attack since the applications are still running in both the original VM and in the new isolated VM. Basically, the only difference with duplication is that the original VM is destroyed when the migration is complete. This way, the attack has no more influence on the user's applications. The difficulty is to correctly set the threshold value that indicates an attack. Another difficulty lies in the fact that the VMM exists whether or not there is an attack. Thus, most of the time, it is likely to be idle. However, the advantage of this system is the possibility to migrate the VM without interrupting the service which is a significant advantage of this system. There is no need to migrate the entire VM, only the selected applications and OS. [PERSON] et al. [35] define a strategy to detect the attack using DCT (Discrete Cosine Transform) to collect the workload signals of co-resident VMs. If the correlation between signals is higher than normal and keeps increasing with time, it strong indicates that an internal DoS attack is underway. **Intrusion Detection Systems (IDS). ** An IDS can be used in VMs. IDS can be classified in two categories [36]: Host-based Intrusion Detection Systems (HIDS) and Network-based Intrusion Detection Systems (NIDS). For HIDS, the detection applies for a specific host, whereas an NIDS is used for all the traffic inside a particular network. [PERSON] et al. [37] propose IDSs installed on the virtual switch. With the analysis of inbound-outbound traffic, the IDS blocks the intruder's addresses. They suppose that the IP addresses are not spoofing. IDS, Behavior and Knowledge Analysis. ** [PERSON] et al. [PERSON] et al. (2018) propose an architecture (node, service, event auditor, storage service) for IDS to examine network traffic, log files and user behaviours. Each node must alert other nodes when an attack occurs.