Defense mechanisms against Distributed Denial of Service attacks : A survey

•Classifying DDoS attacks as network/transport layer and application layer.•Classifying defense mechanisms against DDoS as network/transport and application layer.•Reviewing class properties and introducing defensive mechanisms of each class.•Comparing defense mechanisms categorization and discussing each category’s properties.•Surveying challenges present in defense mechanisms and directing future works. Distributed Denial of Service (DDoS) attacks are a group of collaborative attacks performed by attackers threatening internet security and violating services. In this attack, the attacker makes use of compromised systems to prevent legitimate users from having access to the server resources and use them to provide extensive attacks against the victim. In this paper, we surveyed defense mechanisms against DDoS attacks which are useful in internet. We categorized the mechanisms into two layer-based main groups of network/transport layer and application layer. Then, the network/transport layer is classified into four classes of source-based, network-based, destination-based and hybrid mechanisms, and the application layer mechanisms are categorized into two classes of destination-based and hybrid mechanisms. We surveyed important developments in each of the aforementioned classes and outlined new challenges. This survey paper provides a discussion of the difference between the aforementioned mechanisms categorizations based on characteristics of the way of detection, defense, and response as well as orientations for future researches.