Re: [Dots] Target-Attack-type expansion: more discussion

[Töma Gavrichenkov <[e-mail]>]

On Mon, May 6, 2019, 11:57 AM MeiLing Chen <[e-mail]>
wrote:

> Not mean the affected layer, but at the exploited protocol layer.
>
>
a) Then the Memcached reflection would be layer 7, as the Memcached ASCII
protocol belongs to the application layer;
b) Honestly, I don't see how the "exploited protocol layer" could be of
*any* use for mitigation.

it is still necessary to unify the types of classified attacks.
>
>
Not only it is operationally close to impossible in the foreseeable
future,  it it is also really of questionable use.  You would still need a
device on your network which would be responsible for handling "the rest"
of DDoS attacks: not falling under any known type, 0-day, etc.

IMO the best you could *possibly* achieve is the classification similar to
what anti-virus vendors provide ("Win32/Conficker.A"-style, you know), but
even then no one tries to handle different malware with multiple anti-virus
installations on the same machine.  This architecture wouldn't really fly.

--
Töma

>