Re: [Dots] Target-Attack-type expansion: more discussion

["MeiLing Chen" <[e-mail]>]

>On Mon, May 6, 2019, 11:57 AM MeiLing Chen <[e-mail]> wrote:
Not mean the affected layer, but at the exploited protocol layer.

>a) Then the Memcached reflection would be layer 7, as the Memcached ASCII protocol belongs to the application layer;
>b) Honestly, I don't see how the "exploited protocol layer" could be of *any* use for mitigation.
[MeiLing]Actually, It is more inclined to use TCP/IP four-layer protocol. 
use "exploited protocol layer" for attack type classification and unified naming, then use the parameter of attack type for faster mitigation response, that's mean if Reporting sources are credible for attack type, the mitigator can use directly to dispatch the clean devices.

it is still necessary to unify the types of classified attacks.

>Not only it is operationally close to impossible in the foreseeable future,  it it is also really of questionable use.  You would still need a device on your network which would be >responsible for handling "the rest" of DDoS attacks: not falling under any known type, 0-day, etc.
[MeiLing]The attack type here refers to DDoS attacks, Indeed, as you said, we did consider scalability to deal with possible types of attacks in the future.

>IMO the best you could *possibly* achieve is the classification similar to what anti-virus vendors provide ("Win32/Conficker.A"-style, you know), but even then no one tries to >handle different malware with multiple anti-virus installations on the same machine.  This architecture wouldn't really fly.

--
Töma