doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> MATHEMATICAL MODELLING OF DENIAL OF SERVICE <s> We present a network architecture and accompanying algorithms for countering distributed denial-of-service (DDoS) attacks directed at an Internet server. The basic mechanism is for a server under stress to install a router throttle at selected upstream routers. The throttle can be the leaky-bucket rate at which a router can forward packets destined for the server. Hence, before aggressive packets can converge to overwhelm the server, participating routers proactively regulate the contributing packet rates to more moderate levels, thus forestalling an impending attack. In allocating the server capacity among the routers, we propose a notion of level-k max-min fairness. We present a control-theoretic model to evaluate algorithm convergence under a variety of system parameters. In addition, we present packet network simulation results using a realistic global network topology, and various models of good user and attacker distributions and behavior. Using a generator model of Web requests parameterized by empirical data, we also evaluate the impact of throttling in protecting user access to a Web server. First, for aggressive attackers, the throttle mechanism is highly effective in preferentially dropping attacker traffic over good user traffic. In particular, level-k max-min fairness gives better good-user protection than recursive pushback of max-min fair rate limits proposed in the literature. Second, throttling can regulate the experienced server load to below its design limit - in the presence of user dynamics - so that the server can remain operational during a DDoS attack. <s> BIB001 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> MATHEMATICAL MODELLING OF DENIAL OF SERVICE <s> Denial of service (DoS) attacks are a serious security threat for Internet based organisations, and effective methods are needed to detect an attack and defend the nodes being attacked in real time. We propose an autonomic approach to DoS defence based on detecting DoS flows, and adaptively dropping attacking packets upstream from the node being attacked using trace-back of the attacking flows. Our approach is based on the Cognitive Packet Network infrastructure which uses smart packets to select paths based on Quality of Service. This approach allows paths being used by a flow (including an attacking flow) to be identified, and also helps legitimate flows to find robust paths during an attack. We evaluate the proposed approach using a mathematical model, as well as using experiments in a laboratory test-bed. We then suggest a more sophisticated defence framework based on authenticity tests as part of the detection mechanism, and on assigning priorities to incoming traffic and rate-limiting it on the basis of the outcome of these tests. <s> BIB002 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> MATHEMATICAL MODELLING OF DENIAL OF SERVICE <s> In this paper, we considera queueing model of computer network under DoS attacks.The arrival of SYN packets contains two types: the regular request packets and the attack packets that request for connections. We assume that the connection requests arrive according to a Poisson processes and the service times are general but different for the two types of requests. A maximum number of connections can be served at the same time. Each half-open connection is held for at most a deterministic or random period of time (timeout). We obtain the steady-state probability distribution of the stochastic process describing the evolution of such a system. Next, we show how to compute some security metrics such as the loss-probability or the buffer occupancy percentage of half-open connections for attack packets. <s> BIB003
In most of the existing literature on DoS defence systems, the classification and response mechanisms consist of checking each incoming packet or flow for their legitimacy according to some predefined rules and then dropping those that do not abide by them. There are important differences between the various proposals, but most do belong to this same family of mechanisms. For this reason, the authors of BIB002 have developed a queuing network model to predict the impact that both attack and defence have on the performance of a network. With this approach, the total traffic rate λ i arriving externally to node i is composed of two parts: , where λ n i,n is the "normal" or benign incoming traffic rate which belongs to normal flow n, and λ is the arrival rate of DoS packets belonging to attack flow d. Each node is modelled by a single server queue with service time s i representing both the time it takes to process the packet in the node and the actual transmission time. The traffic intensity parameter ρ i is then: is the arriving traffic rate of a DoS flow d. Assuming that any traffic that is correctly or mistakenly thought to be DoS traffic is dropped at the input of the node, and since the traffic which effectively enters a node has been filtered in this manner, the traffic equations for the system become: where f nl is the probability that a normal packet is mistakenly dropped by the defence mechanism at the l-th node on the route of normal flow n, and d dl is the probability that an attack packet will be correctly dropped at the l-th node on the route of attack flow d. The specific mathematical model is particularly suitable for flood attacks, as it considers the disruption in the victim network to be the result of congestion in the nodes and links. In BIB002 , it is validated by comparison with the results of simulation in NS-2 and experiments in a networking testbed. Recently, a new queuing model has been proposed for the analysis of networks under DoS attacks BIB003 . The model assumes normal packets and attack packets arriving according to Poisson processes and that the service times are general but different for the two types of requests, while there is a maximum number of connections that can be served at each time. In BIB001 , a specialised mathematical model for router throttling is formulated. The system parameters include feedback delays, the hysteresis control limits, and the traffic source rates, and each router is modelled as a source of traffic for a server S which is to be protected. The server generates a throttle signal Φ(t) as a function of the aggregate traffic workload and the hysteresis control limits L S and U S : A differential equation is used for the throttle rate: where β i > 0 is the incremental step size for router i. The forwarding traffic route at router i is then given by: This control-theoretic model is designed to explore how specific system parameters can affect the performance and stability of router throttling as a DoS response strategy, and also to study various multisource flow control problems. Mathematical models such as the two summarised in this section can be particularly useful not only to understand the dynamics of DoS attacks, but also to predict the performance of various defence methods before implementing them. Mathematical modelling can also be used to fine-tune existing defence methods and suggest optimal configurations that can respond to specific threats. For the time being this practice is rarely followed among DoS researchers, but we expect it to become more widespread as accuracy and optimality in defence are needed to respond to the latest attack trends.