doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in Self-Aware Networks <s> The capacity to learn from examples is one of the most desirable features of neural network models. We present a learning algorithm for the recurrent random network model (Gelenbe 1989, 1990) using gradient descent of a quadratic error function. The analytical properties of the model lead to a "backpropagation" type algorithm that requires the solution of a system of n linear and n nonlinear equations each time the n-neuron network "learns" a new input-output pair. <s> BIB001 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in Self-Aware Networks <s> Abstract As the size of the Internet grows by orders of magnitude both in terms of users, number of IP addresses, and number of routers, and as the links we use (be they wired, optical or wireless) continuously evolve and provide varying reliability and quality of service, the IP based network architecture that we know so well will have to evolve and change. Both scalability and QoS have become key issues. We are currently conducting a research project that revisits the IP routing architecture issues and proposes new designs for routers. As part of this effort, this paper discusses a packet network architecture called a cognitive packet network (CPN), in which intelligent capabilities for routing and flow control are moved towards the packets, rather than being concentrated in the nodes. In this paper we outline the design of the CPN architecture, and discuss the quality-of-service based routing algorithm that we have designed and implemented. We then present our test-bed and report on extensive measurement experiments that we have conducted. <s> BIB002 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in Self-Aware Networks <s> Reliability, security, scalability and QoS (quality-of-service) have become key issues as we envision the future Internet. The paper presents the "cognitive packet network" (CPN) architecture in which intelligent peer-to-peer routing is carried out with the help of "smart packets" based on best-effort QoS goals. Since packetized voice has stringent QoS requirements, we then discuss the choice of a "goal" and "reward" function for this application and present experiments we have conducted for "voice over CPN". Its performance is detailed via several measurements, and the resulting QoS is compared with that of the IP routing protocol under identical conditions showing the gain resulting from the use of CPN. <s> BIB003 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in Self-Aware Networks <s> Novel user-oriented networked systems will simultaneously exploit a variety of wired and wireless communication modalities to offer different levels of quality of service (QoS), including reliability and security to users, low economic cost, and performance. Within a single such user-oriented network, different connections themselves may differ from each other with respect to QoS needs. Similarly, the communication infrastructure used by such a network will, in general, be shared among many different networks and users so that the resources available will fluctuate over time, both on the long and short term. Such a user-oriented network will not usually have precise information about the infrastructure it is using at any given instant of time, so that its knowledge should be acquired from online observations. Thus, we suggest that user-oriented networks should exploit self-adaptiveness to try to obtain the best possible QoS for all their connections. In this paper we review experiments which illustrate how "self-awareness," through online self-monitoring and measurement, coupled with intelligent adaptive behavior in response to observations, can be used to offer user-oriented QoS. Our presentation is based on ongoing experimental work with several "cognitive packet network" testbeds that we have developed. <s> BIB004 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in Self-Aware Networks <s> Denial of service attacks, viruses and worms are common tools for ::: malicious adversarial behavior in networks. Experience shows that ::: over the last few years several of these techniques have probably ::: been used by governments to impair the Internet communications of ::: various entities, and we can expect that these and other ::: information warfare tools will be used increasingly as part of ::: hostile behavior either independently, or in conjunction with ::: other forms of attack in conventional or asymmetric warfare, as ::: well as in other forms of malicious behavior. In this paper we ::: concentrate on Distributed Denial of Service Attacks (DDoS) where ::: one or more attackers generate flooding traffic and direct it from ::: multiple sources towards a set of selected nodes or IP addresses ::: in the Internet. We first briefly survey the literature on the ::: subject, and discuss some examples of DDoS incidents. We then ::: present a technique that can be used for DDoS protection based on ::: creating islands of protection around a critical information ::: infrastructure. This technique, that we call the CPN-DoS-DT ::: (Cognitive Packet Networks DoS Defence Technique), creates a ::: self-monitoring sub-network surrounding each critical ::: infrastructure node. CPN-DoS-DT is triggered by a DDoS detection ::: scheme, and generates control traffic from the objects of the DDoS ::: attack to the islands of protection where DDOS packet flows are ::: destroyed before they reach the critical infrastructure. We use ::: mathematical modelling, simulation and experiments on our test-bed ::: to show the positive and negative outcomes that may result from ::: both the attack, and the CPN-DoS-DT protection mechanism, due to ::: imperfect detection and false alarms. <s> BIB005 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in Self-Aware Networks <s> Denial of service attacks, viruses and worms are common tools for malicious adversarial behaviour in networks. We propose the use of our autonomic routing protocol, the cognitive packet network (CPN), as a means to defend nodes from distributed denial of service (DDoS) attacks, where one or more attackers generate flooding traffic from multiple sources towards selected nodes or IP addresses. We use both analytical and simulation modelling, and experiments on our CPN testbed, to evaluate the advantages and disadvantages of our approach in the presence of imperfect detection of DDoS attacks, and of false alarms. <s> BIB006 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in Self-Aware Networks <s> We present a vision of an Intelligent Network in which users dynamically indicate their requests for services and formulate needs in terms of quality of service (QoS) and price. Users can also monitor on-line the extent to which their requests are being satisfied. In turn the services will dynamically try to satisfy the user as best as they can and inform the user of the level at which the requests are being satisfied, and at what cost. The network will provide guidelines and constraints to users and services, to avoid that they impede each others' progress. This intelligent and sensible dialogue between users, services and the network can proceed constantly based on mutual observation, network and user self-observation, and on-line adaptive and locally distributed feedback control which proceeds at the same speed as the traffic flows and events being controlled. We review issues such as network `situational awareness', self-organisation and structure, and relate these concepts to the ongoing research on autonomic communication systems. We relate the search for services in the network to the question of QoS and routing. We examine the need to dynamically protect the networked system from denial of service (DoS) attacks and propose an approch to DoS defence which uses the detection of violations of QoS constraints and the automatic throttling or dropping of traffic to protect critacl nodes. We also discuss how this vision of an Intelligent Network can benefit from techniques that have been experimented in the cognitive packet network test-bed at Imperial College, thanks to `smart packets' and reinforcement learning, which offers routing that is dynamically modified using on-line sensing and monitoring, based on users' QoS needs and overall network objectives. (A) <s> BIB007 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in Self-Aware Networks <s> Denial of service (DoS) attacks are a serious security threat for Internet based organisations, and effective methods are needed to detect an attack and defend the nodes being attacked in real time. We propose an autonomic approach to DoS defence based on detecting DoS flows, and adaptively dropping attacking packets upstream from the node being attacked using trace-back of the attacking flows. Our approach is based on the Cognitive Packet Network infrastructure which uses smart packets to select paths based on Quality of Service. This approach allows paths being used by a flow (including an attacking flow) to be identified, and also helps legitimate flows to find robust paths during an attack. We evaluate the proposed approach using a mathematical model, as well as using experiments in a laboratory test-bed. We then suggest a more sophisticated defence framework based on authenticity tests as part of the detection mechanism, and on assigning priorities to incoming traffic and rate-limiting it on the basis of the outcome of these tests. <s> BIB008 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in Self-Aware Networks <s> Smart networks have grown out of the need for stable, reliable, and predictable networks that will guarantee packet delivery under Quality of Service (QoS) constraints. In this article we present a measurement-based admission control algorithm that helps control traffic congestion and guarantee QoS throughout the lifetime of a connection. When a new user requests to enter the network, probe packets are sent from the source to the destination to estimate the impact that the new connection will have on the QoS of both the new and the existing users. The algorithm uses a novel algebra of QoS metrics, inspired by Warshall's algorithm, to look for a path with acceptable QoS values to accommodate the new flow. We describe the underlying mathematical principles and present experimental results obtained by evaluating the method in a large laboratory test-bed operating the Cognitive Packet Network (CPN) protocol. <s> BIB009 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in Self-Aware Networks <s> High demand and network congestion, can prevent multimedia applications and users from obtaining the network service they require for a successful operation. A way to control traffic congestion and satisfy all users' QoS requirements, without overprovisioning, is admission control (AC). This work presents a measurement-based AC mechanism, which improves the performance of a self-aware network (SAN) (E. Gelenbe et al., 2004) and provides QoS throughout the lifetime of all connections. Our algorithm is a multiple criteria AC algorithm, where each user can specify the QoS metrics that interest him/her. Our scheme which decides whether a new call should be allowed to enter the network based on measurements of the QoS metrics on each link of the network before and after the transmission of probe packets. The decision is based on a novel algebra of QoS metrics, inspired by Warshal's algorithm, that searches whether there is a feasible path to accommodate the new flow with out affecting the existing users. Our algorithm and the underlying mathematical principles was briefly described and we present experimental results, conducted in a large laboratory test-bed, under highly congested circumstances. <s> BIB010 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in Self-Aware Networks <s> Network worms are malicious self-replicating applications that propagate in a network by infecting node after node. They can cause significant damage by reducing the system performance or totaly disabling nodes, which results into considerable degradation of the quality of service (QoS) that the users experience. The Cognitive Packet Network (CPN) is an adaptive routing protocol that attempts to address the QoS requirements of the network’s users by routing their traffic according to them. Although it is generally very resilient to network changes, it may suffer worse performance during a worm attack. Here we evaluate its performance in such crises and compare it with the Open Shortest Path First (OSPF) routing protocol, the current industry standard and widely used in Internet Protocol networks. Then we improve it by introducing a failure detection element that reduces packet loss and delay during failures. Our experiments were performed in a large networking testbed. <s> BIB011 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in Self-Aware Networks <s> Current and future multimedia networks require connections under specific quality of service (QoS) constraints which can no longer be provided by the best-effort Internet. Therefore, ‘smarter’ networks have been proposed in order to cover this need. The cognitive packet network (CPN) is a routing protocol that provides QoS-driven routing and performs self-improvement in a distributed manner, by learning from the experience of special packets, which gather on-line QoS measurements and discover new routes. The CPN was first introduced in 1999 and has been used in several applications since then. Here we provide a comprehensive survey of its variations, applications and experimental performance evaluations. <s> BIB012
Denial of service attacks harm Self-Aware Networks (SAN) BIB004 in the same way they harm conventional networks, only to a different degree for the various network resources, with the factor of differentiation being the dynamic routing BIB007 . In a conventional network, the attack paths can be several but remain constant, which results into complete overwhelming of specific nodes or specific links on those static attack paths. A legitimate flow which does not use any of these paths would be relatively unaffected by the attack, while the rest would suffer complete outages. In a SAN, such as the Cognitive Packet Network (CPN) BIB002 , the routing protocol attempts to accommodate all traffic by dynamically changing the paths. As a result, the attack is distributed in the whole network and affects the quality of service of the legitimate flows in a more balanced manner. All flows may be affected, but fewer suffer complete outage. In CPN, this is achieved with the use of "smart packets" that constantly explore the network, "dumb packets" that carry the data and acknowledgement packets that help monitor the condition of the network. Each user specifies its QoS requirements in the form of a QoS "goal" and at each CPN node a local reinforcement learning (RL) algorithm based on online measurements elicit a decision from the node as to the next hop to travel to. The arrival of a smart packet triggers the execution of the RL algorithm. Each router stores a specific Random Neural Network (RNN) BIB001 for each QoS class and for each active source-destination pair. Each RNN node represents the decision to choose a given output link for a smart packet and has as many neurons as the possible outgoing links. Decisions are taken by selecting the output link for which the corresponding neuron is the most excited BIB012 . The performance of the CPN protocol has been extensively evaluated both in normal operating conditions BIB003 and under failures BIB011 . An admission control system makes sure that the quality of service for the traffic of new users will satisfy their requirements and that existing users will not be affected BIB009 BIB010 . The natural adaptability and resilience of CPN in adverse network conditions has been further improved with the DoS-specific defence system presented in BIB005 BIB006 and later extended in BIB008 . Each network node informed of a DoS attack contributes to the defence by examining incoming packets for deviations from normal behaviour. Packets undergo a collection of anomaly-based tests which may differ for each type of traffic. Nodes that take part in the defence prioritise traffic according to the results of the tests. Additionally, the upstream routers are instructed to rate-limit any traffic directed towards the victim node. With this two-fold protection framework, packets with higher probability of being both valid and harmless are offered preferential service, while packets that have been marginally classified as invalid will still receive service if there is available bandwidth, so as to minimise the collateral damage inflicted by false detection. Packets that have been identified as harmful are either dropped or delayed by being assigned low priority. The authors also discuss various simplifications of the scheme.