Could a dynamic security system prevent DDoS attacks?

Question

I don't know much about security, but here's what I think I understand about my question, at a high level:

1. DDoS attacks are caused by a LOT of network traffic, which can be hard to mitigate because you can't anticipate where they're coming from.
2. One method of two-factor authentication is to set up a trusted connection to a synchronized system that dynamically generates a security token.
3. During a recent DDoS attack on my favorite MMO, one of my friends made a comment about "the only thing they can do is change ports and hope the attackers don't pick up the change for a while".

So, one question is: is it an accurate assumption that it would be hard to keep up a DDoS attack if the provider kept changing the ports that it expects data to come into? This seems reasonable to me.

And the second question is: if so, are there any drawbacks to using some kind of synchronized system to change the ports every so often, to make it harder for the DDoS attack to persist? So, if you have a trusted client, you would have "your current port" to talk to, and when it's time to change, your client would know to make the change.

Like I said, I don't know enough to know all the (I'm sure) massive flaws in my question, but this doesn't seem like something that would have a crazy performance hit, and it seems like a good way to keep attackers out of your system.

Answer 1

It really depends on the type of attack that your target is dealing with, however the solution you presented while very creative, doesn't solve the problem unless you have an unskilled attacker who only uses application attacks

Types of Attacks (and how to stop them):

A volumetric attack sends a large amount of raw traffic to saturate the network's uplink taking the entire server offline.

Solutions to block volumetric attacks are pretty much limited to Cloud "scrubbing centers" which utilize advanced rulesets to choose which traffic to forward to a server and which to discard, these "scrubbing centers" are only possible because they have an insane amount of hardware and available bandwidth topping multiple Tbps of capacity.

An application attack sends a small amount of specialized traffic to target the running application, for example you could send let's say 10,000 HTTP requests per second to a web server to crash it making the website unavailable.

Solutions to block application attacks have a larger variety, realistically rate limit the functions in your application, if a single IP is hitting the limit too often, automatically issue a firewall rule to block further requests to the application.

A few things to consider

• 2-factor cannot mitigate DDoS Attacks, it's a nice security tool, but it's not very effective in blocking DDoS Attacks.
• The main drawback would be constant disconnects and reconnects ruining the fun of your game server. Sure you could keep changing the port to prevent an application attack, but you would go down and stay down the moment your attacker switched to a volumetric attack.

A more practical solution

I would switch to a server provider who offers to filter very large attacks. Some providers include Voxality, OVH, and DDoS-Guard.net (they protect datacenters, you normally wouldn't buy from them directly, Blazingfast uses them for added filtering). From there you only have to deal with application attacks if not filtered by the provider. It's going to save you a lot of headache, the gamer community will only be targeted more and more by DDoS Attacks, you should be prepared to be under constant attack.