doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in conventional networks <s> Distributed denial of service (DDoS) attacks exploit the acute imbalance between client and server workloads to cause devastation to the service providers. We propose a distributed gateway architecture and a payment protocol that imposes dynamically changing prices on network, server, and information resources in order to push some cost of initiating service requests - in terms of monetary payments and/or computational burdens back onto the requesting clients. By employing different price and purchase functions, the architecture can provide service quality differentiation and furthermore, select good client behavior and discriminate against adversarial behavior. If confirmed by additional experiments, judicious partitioning of resources using different pricing functions can improve overall service survivability. <s> BIB001 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in conventional networks <s> The current Internet infrastructure has very few built-in protection mechanisms, and is therefore vulnerable to attacks and failures. In particular, recent events have illustrated the Internet's vulnerability to both denial of service (DoS) attacks and flash crowds in which one or more links in the network (or servers at the edge of the network) become severely congested. In both DoS attacks and flash crowds the congestion is due neither to a single flow, nor to a general increase in traffic, but to a well-defined subset of the traffic --- an aggregate. This paper proposes mechanisms for detecting and controlling such high bandwidth aggregates. Our design involves both a local mechanism for detecting and controlling an aggregate at a single router, and a cooperative pushback mechanism in which a router can ask upstream routers to control an aggregate. While certainly not a panacea, these mechanisms could provide some needed relief from flash crowds and flooding-style DoS attacks. The presentation in this paper is a first step towards a more rigorous evaluation of these mechanisms. <s> BIB002 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in conventional networks <s> Denial of service (DoS) attacks continue to threaten the reliability of networking systems. Previous approaches for protecting networks from DoS attacks are reactive in that they wait for an attack to be launched before taking appropriate measures to protect the network. This leaves the door open for other attacks that use more sophisticated methods to mask their traffic.We propose an architecture called Secure Overlay Services (SOS) that proactively prevents DoS attacks, geared toward supporting Emergency Services or similar types of communication. The architecture is constructed using a combination of secure overlay tunneling, routing via consistent hashing, and filtering. We reduce the probability of successful attacks by (i) performing intensive filtering near protected network edges, pushing the attack point perimeter into the core of the network, where high-speed routers can handle the volume of attack traffic, and (ii) introducing randomness and anonymity into the architecture, making it difficult for an attacker to target nodes along the path to a specific SOS-protected destination.Using simple analytical models, we evaluate the likelihood that an attacker can successfully launch a DoS attack against an SOS-protected network. Our analysis demonstrates that such an architecture reduces the likelihood of a successful attack to minuscule levels. <s> BIB003 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in conventional networks <s> As more and more critical services are provided over the Internet, the risk to these services from malicious users is also increasing. Several networks have witnessed denial of service attacks in the past. This paper reports on our experience in building a Linux-based prototype to mitigate the effect of such attacks. Our prototype provides an efficient way to keep track of server and network resources at the network layer and allows aggregate resource regulation. Our scheme provides a general, and not attack specific, mechanism to provide graceful server degradation in the face of such an attack. We report on the rationale of our approach, the experience in building the prototype, and the results from real experiments. We show that traditional rate-based regulation combined with proposed window-based regulation of resources at the aggregate level at the network layer is a feasible vehicle for mitigating the impact of DOS attacks on end servers. <s> BIB004 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in conventional networks <s> It is widely recognized that distributed denial-of-service (DDoS) attacks can disrupt electronic commerce and cause large revenue losses. However, effective defenses continue to be mostly unavailable. We describe and evaluate VIPnet, a novel value-added network service for protecting e-commerce and other transaction-based sites from DDoS attacks. In VIPnet, e-merchants pay Internet Service Providers (ISPs) to carry the packets of the e-merchants' best clients (called VIPs) in a privileged class of service (CoS), protected from congestion, whether malicious or not, in the regular CoS. VIPnet rewards VIPs with not only better quality of service, but also greater availability. Because VIP rights are client- and server-specific, cannot be forged, are usage-limited, and are only replenished after successful client transactions (e.g., purchases), it is impractical for attackers to mount and sustain DDoS attacks against an e-merchant's VIPs. VIPnet can be deployed incrementally and does not require universal adoption. Experiments demonstrate VIPnet's benefits. <s> BIB005 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in conventional networks <s> We propose a framework based on proactive server roaming to mitigate the effects of denial-of-service (DoS) attacks. The active server proactively changes its location within a pool of servers to defend against unpredictable and undetectable attacks. Only legitimate clients can follow the active server as it roams. We present algorithms that are secure, distributed, randomized, and adaptive for triggering the roaming and determining the next server to roam to. We propose some modifications to the state recovery process of existing TCP connection-migration schemes to suit roaming. Preliminary experiments in a FreeBSD network show that the overhead of server roaming is small, in terms of response time, in the absence of attacks. Further, during an attack, roaming significantly improves the response time. <s> BIB006 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in conventional networks <s> DDoS attacks are highly distributed, well coordinated, offensive assaults on services, hosts, and infrastructure of the Internet. Effective defensive countermeasures to DDoS attacks require equally sophisticated, well coordinated, monitoring, analysis, and response. The Cossack project is developing technology to thwart such attacks by deploying a set of watchdogs at edge networks, which employ distributed coordination to rapidly detect, and neutralize attacks. <s> BIB007 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in conventional networks <s> Honeypots have been proposed to act as traps for malicious attackers. However, because of their deployment at fixed (thus detectable) locations and on machines other than the ones they are supposed to protect, honeypots can be avoided by sophisticated attacks. We propose roaming honeypots, a mechanism that allows the locations of honeypots to be unpredictable, continuously changing, and disguised within a server pool. A (continuously changing) subset of the servers is active and providing service, while the rest of the server pool is idle and acting as honeypots. We utilize our roaming honeypots scheme to mitigate the effects of service-level DoS attacks, in which many attack machines acquire service from a victim server at a high rate, against back-end servers of private services. The roaming honeypots scheme detects and filters attack traffic from outside a firewall (external attacks), and also mitigates attacks from behind a firewall (internal attacks) by dropping all connections when a server switches from acting as a honeypot into being active. Through ns-2 simulations, we show the effectiveness of our roaming honeypots scheme. In particular, against external attacks, our roaming honeypots scheme provides service response time that is independent of attack load for a fixed number of attack machines. <s> BIB008 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in conventional networks <s> Low rate TCP denial-of-service attacks are a new type of DoS attacks that are carefully orchestrated to exploit the fixed minimum TCP RTO property and thereby deny services to legitimate users. This type of attacks is different from traditional flood-based attacks and hence conventional solutions to detect these attacks are not applicable. We propose a novel approach to detect these attack flows at edge routers. A flow exhibiting a periodic pattern is marked malicious if its burst length is greater than or equal to RTTs of other connections with the same server and its time period is equal to the fixed minimum RTO. A carefully designed light weight data structure is proposed to store the necessary flow history at edge routers. Simulation results show that such flows can be detected by our proposed approach, which does not require any modification to TCP congestion control algorithms like randomizing the fixed minimum RTO. <s> BIB009 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in conventional networks <s> Router queues buffer packets during congestion epochs. A recent result by Appenzeller et al. showed that the size of FIFO queues can be reduced considerably without sacrificing utilization. While Appenzeller showed that link utilization is not affected, the impact of this reduction on other aspects of queue management such as fairness, is unclear. Recently, a new class of low-rate DoS attacks called shrews was shown to throttle TCP connections by causing periodic packet drops. Unfortunately, smaller buffer sizes make shrew attacks more effective and harder to detect since shrews need to overflow a smaller buffer to cause drops. In this paper, we investigate the relation between buffer size and the shrew sending rate required to cause damage. Using a simple mathematical model, we show that a relatively small increase in the buffer size over the value proposed by Appenzeller is sufficient to render the shrew attack ineffective. Intuitively, bigger buffers require the shrews to transmit at much higher rates to fill the router queue. However, by doing so, shrews are no longer low-rate attacks and can be detected by active queue management (AQM) techniques such as RED-PD. We verified our analysis through simulations showing that a moderate increase in the buffer size, coupled with an AQM mechanism is adequate to achieve high link utilization while protecting TCP flows from shrew attacks. <s> BIB010 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> DoS response in conventional networks <s> Denial of Service attacks are presenting an increasing threat to the global inter-networking infrastructure. While TCP's congestion control algorithm is highly robust to diverse network conditions, its implicit assumption of end-system cooperation results in a well-known vulnerability to attack by high-rate non-responsive flows. In this paper, we investigate a class of low-rate denial of service attacks which, unlike high-rate attacks, are difficult for routers and counter-DoS mechanisms to detect. Using a combination of analytical modeling, simulations, and Internet experiments, we show that maliciously chosen low-rate DoS traffic patterns that exploit TCP's retransmission timeout mechanism can throttle TCP flows to a small fraction of their ideal rate while eluding detection. Moreover, as such attacks exploit protocol homogeneity, we study fundamental limits of the ability of a class of randomized timeout mechanisms to thwart such low-rate DoS attacks. <s> BIB011
One of the most influential works on DoS response is presented in BIB002 , which introduces a generic system for Aggregate-based Congestion Control (ACC) that learns a congestion signature and identifies the small number of aggregates responsible for congestion. During times of sustained high congestion, the ACC system tries to find the congestion signature using the latest packet drop history. The authors propose a destination-based identification algorithm, which first draws out a list of high-bandwidth 32-bit addresses based on the drop history or a random sample and then clusters these addresses into 24-bit prefixes. For each of the clusters, it tries to find a longer prefix that still contains all the dropped packets, since a longer prefix characterises a congestion signature better and does not punish a large category of traffic. Although this algorithm is simple to implement, it results in unfairness for the legitimate traffic to the congested destination. A more accurate and flexible identification algorithm is needed to maintain the fairness between friendly and misbehaving aggregates. Once the router knows the congestion signature, it then filters the bad traffic according to this signature. Furthermore, a pushback scheme  is given to let the router ask its adjacent routers to filter the bad traffic at an earlier stage. This is a mechanism which adds functionality to the routers to detect and preferentially drop packets that probably belong to an attack. Upstream routers are also notified to drop such packets so that their resources are used to route only legitimate traffic. This is an effective scheme for various types of DDoS attacks, but its success heavily depends on the congestion signature, which is not always sufficiently accurate. Another of the first significant approaches for proactive defence against DoS is Secure Overlay Services (SOS) BIB003 , which is geared towards emergency communications. The architecture of SOS is constructed using a combination of overlay tunnelling, routing via consistent hashing, and filtering. It reduces the probability of successful attacks by performing intensive filtering near protected network edges introducing randomness and anonymity. The former helps push the attack point perimeter into the core of the network, where highspeed routers can handle the volume of attack traffic, while the latter makes it difficult to target nodes along the path to a specific SOS-protected destination. The goal of SOS is to route only the authenticated users' traffic to the server and drop everything else. The clients are authenticated at the overlay entrance and they use the overlay network to reach the server. Only a small set of source addresses are approved to reach the server, while all other traffic is heavily filtered out. The main advantage of SOS is that it can be applied over existing IP infrastructure and can guarantee to some extent that in times of crisis an authenticated user will have access to the victim server. However, SOS is more difficult to deploy in a fully public network, since the clients must be aware of the overlay network and use it to access the victim. Also, it does not offer protection for the incoming links of the filtering router in front of the client, which can be quite easily overwhelmed by sheer volumes of DoS traffic. The SOS approach is generalised by Mayday  , in which overlay networks and lightweight packet filtering are combined. The overlay nodes perform client authentication and protocol verification, and then relay the requests to a server, which is Pricing techniques have also been suggested for protection against DoS attacks. Dynamic Resource Pricing BIB001 is a distributed gateway architecture and a payment protocol that imposes dynamically changing prices on both network, server, and information resources. In this way it manages to push the cost of initiating service requests back to the requesting clients, which theoretically should at least slow down the attacker. In BIB004 , a defence method based on regulation of resource consumption is presented. The authors use a Linux based prototype to show that traditional QoS rate-based regulation combined with their proposed window-based regulation of aggregated resources at the network layer can mitigate the impact of DOS attacks on end servers. Traffic regulation policies are enforced across traffic classes according to the resource usage of packets or flows and is done at an aggregate level and not the individual flow level. In BIB005 , it is proposed that the ISPs carry the packets of the victim's "VIP" clients in a privileged class of service, protected from congestion, whether malicious or not, while all non-VIP traffic is considered as low-priority and can be dropped in the case of an attack. The approach is simple but can prove very useful for transaction-based websites, such as ecommerce ones. Quite similar, in the sense that its users are also considered as "VIP" or not, proactive server roaming is a novel proposal where an active server changes its location within a pool of physical servers to defend itself against unpredictable or untraceable attacks BIB006 . Again, only known legitimate users are explicitly informed by the roamer of its IP address and are able to follow the active server as it roams. The same authors have incorporated this idea of roaming to the concept of honeypots. Honeypots are nodes which attempt to appear as attractive targets for attackers, but provide no service to legitimate users; they only exist to capture and analyse attack traffic, and they do not receive any legitimate traffic. Since honeypots can be avoided by sophisticated attacks, in BIB008 they propose roaming honeypots, a mechanism that allows the locations of honeypots to be unpredictable, continuously changing, and disguised within a server pool. So, in this scheme a continuously changing subset of the servers remain active and provide service, while the rest are acting as honeypots. Another contribution to DoS response is DEFCOM  , which suggests that the current paradigm of designing isolated defence systems should be abandoned. DEFCOM is a distributed framework that enables the exchange of information and services between existing defence nodes. For example, since attack detection is best done near the victim, while response is most effective at the source of the attack, each node should be specialised in a different aspect of the defence. Defence nodes must be able to communicate and must support at least the following messages: Attack alerts (generated from the Alert Generators to the rest of the network), RateLimit requests (the rate-limit requests should be sent upstream), Resource requests (each node should be able to issue a resource request to its downstream neighbours), and Traffic Classification (classifier nodes must communicate with their downstream neighbours to ensure that the bulk of legitimate traffic will not be dropped). A similar distributed approach to DoS response is explored in BIB007 , with an architecture that coordinates the countermeasures using multi-cast, annotated topology information and blind detection techniques. The main element of the architecture is the cossack watchdog, which is software located at edge networks, able to monitor traffic, detect attacks and communicate with other watchdogs to filter the traffic collectively. A particularly interesting branch of DoS research is that of low-rate attacks, also known as shrew attacks, where a well orchestrated periodic burst can achieve disruption for which a flood-based attack would need volumes of traffic. These shrew attacks, first presented in BIB011 , exploit the fixed minimum TCP RTO property. Some related work has appeared since, including detection of such attacks at the edge routers BIB009 and a study for the related effect of buffer sizes BIB010 . Detection is also achieved with a hypothesis testing scheme, when the autocorrelation functions and power spectrum densities of the traffic are obtained  . Also dealing with advanced DoS attacks, DDoS Shield is a recently developed system that combines a suspicion assignment mechanism with a scheduler  . It is designed specifically for application layer attacks that evade normal defences by being non-intrusive and protocol-compliant. The paper explores the earlier concepts of attack probability and proportional defence in a more rigourous manner. In practice, each session is tagged with a continuous value of suspicion, and there are two scheduling policies that use suspicion as their control primitive.