SC-FLARE: Cooperative DDoS Signaling based on Smart Contracts Bruno Rodrigues, Spasen Trendaﬁlov, Eder Scheid, Burkhard Stiller Communication Systems Group CSG, Department of Informatics IfI, University of Zurich UZH Binzm¨uhlestrasse 14, CH-8050 Z¨urich E-mail: [rodrigues,scheid,stiller]@iﬁ.uzh.ch spasen.trendaﬁlov@uzh.ch Abstract—Distributed Denial-of-Service (DDoS) attacks re- mains as one of the major causes of concerns for service providers around the world. This paper introduces SC-FLARE, a Smart Contract (SC) based cooperative signaling protocol built on top of a Ethereum Proof-of-Authority Blockchain (BC) for the sharing of attack information, the exchange of incentives, and the tracking of reputation in a fully distributed and automated fashion. By making use of BC and SC, SC-FLARE provide the required collaborative platform without the burden to maintain, design, and develop special registries and gossip protocols for a cooperative defense. I. INTRODUCTION The growing number of insecure devices inﬂated Distributed Denial-of-Service (DDoS) statistics to unprecedented levels. Recent attacks demonstrated their power with new records in the volume of trafﬁc and greater attack frequency [1]. While 2018 registered the largest ever DDoS attack in terms of trafﬁc volume, the frequency of DDoS attacks also increased more than 2.5 times between 2014 and 2017 [2]. Botnets (e.g., Mirai [3]) taking advantage of insecure devices ranging from small sensors to baby cameras and home gateways connected to the Internet are the main reason behind the escalation. The distributed nature of DDoS attacks suggests that an ideal defense would be equally distributed. Advantages of cooperative defenses have been widely recognized in literature [4], [5]. It expands the detection and mitigation capabilities over the network, it also enables to block malicious trafﬁc near its source. While our previous work [6] presented the initial structure of a collaborative defense based on Blockchain (BC) and Smart Contracts (SC), the SC design had no mechanisms to ensure the provision of incentives for mitigation services, nor assess the reputations of the actors involved. SC-FLARE proposes a cooperative defense providing in- centives and reputation tracking capabilities based on a per- missioned Proof-of-Authority (PoA) Ethereum Blockchain. The main advantages are the deployment of existing public and distributed infrastructure to ﬂare white or blacklisted IP addresses and to distribute incentives related to the requested mitigation activities. This work is structured as follows. Sec- tion II present related work. Section III presents the design and implementation. Evaluation is presented in Section IV and considerations and future work, in Section V. II. RELATED WORK The literature contains a number of industry and academia proposals to detect and mitigate DDoS attacks, being cate- gorized as in-house or off-house approaches [4]. While in- house defenses are based on resources available locally (e.g., ﬁrewall, load balancer, intrusion detection/prevention systems) to protect a single target or network, an off-house defense involves a third-party to detect and/or mitigate the attack. In this regard, an off-house defense can be cloud-based or cooperative [5]. While the former serves as a proxy receiving, analyzing and redirecting trafﬁc to the target, which delegate detection and mitigation tasks to the protection provider (e.g., Akamai [1] or CloudFlare [7]), the latter is a decentralized approach typically implemented as an overlay network. Secure Overlay Services (SOS) [8], COSSACK [9], and DefCOM [10] paved the way for cooperative defenses in the early 2000s. While SOS’s approach focused on identifying legitimate sources for time-sensitive networks (i.e., requiring peers to authenticate to the overlay network), COSSACK and DefCOM based their approach on detection and enforcement points in access networks. However, despite pioneering the decentralization