DDoS Detection at the Scale of One Hundred Tbps#

Yunming Xiao (CUHK Shenzhen and Tencent), Xijun Luo, et al. (Tencent), Heng Yu, Jiahao Cao (Tsinghua), Yan Chen (Northwestern), Congcong Miao (Tencent)

• Why: Existing programmable-device DDoS detectors top out around Tbps per box; cloud incumbents see ~100 Tbps aggregate. This is the production answer to two orders of magnitude more traffic — with the scaling lessons made explicit.
• What: "Canopy," a DDoS detection system deployed in Tencent production that scales past 100 Tbps via distributed detection across many servers — dynamic load balancing that adapts to mice/elephant mixes, plus traffic compression at the programmable switch to shrink per-server workload.
• How: Instead of naive flow-level load balancing across detection servers (which skews badly), Canopy dynamically rebalances under fluctuating traffic patterns, and pre-aggregates/compresses traffic in the switch offload stage before it reaches the servers.
• Where applicable: Tencent-specific production deployment, but the architecture (switch-side compression + adaptive distribution over a detection-server fleet) generalizes to any large scrubbing/detection pipeline. Real-world attack mitigation in production validates it.