Double Proxy Architecture for Data Center DDoS Mitigation

Abstract

The increasing frequency and complexity of Distributed Denial-of-Service (DDoS) attacks present serious challenges to data center availability and service reliability. Conventional single-layer defense mechanisms are often insufficient to handle high-volume and multi-vector attacks, resulting in excessive resource consumption on critical servers. This study proposes a data center security architecture based on a double proxy system to enhance resilience against DDoS attacks. The architecture consists of two sequential reverse proxy layers, namely a public-facing proxy and an internal proxy, which collaboratively perform traffic filtering, request validation, and load isolation before forwarding requests to the application servers. Experimental evaluations were conducted under simulated TCP- and UDP-based DDoS attack scenarios to assess system performance. The results indicate that the proposed double proxy architecture significantly reduces CPU utilization by up to 76% and decreases network bandwidth consumption by up to 352 Mbps compared to a traditional single-proxy configuration. Memory and disk usage remain stable during attack conditions, demonstrating minimal performance overhead. Furthermore, the architecture effectively absorbs malicious traffic, prevents direct exposure of backend servers, and preserves data integrity. These findings suggest that the double proxy approach provides a practical, efficient, and scalable solution for mitigating modern DDoS attacks in data center environments and can be adapted to evolving cyber threat landscapes.