doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> • Does the time-to-live (TTL) field in an IP packet agree with the value that can be inferred from the packet's apparent source address? <s> The paper studies two types of events that often overload Web sites to a point when their services are degraded or disrupted entirely - flash events (FEs) and denial of service attacks (DoS). The former are created by legitimate requests and the latter contain malicious requests whose goal is to subvert the normal operation of the site. We study the properties of both types of events with a special attention to characteristics that distinguish the two. Identifying these characteristics allows a formulation of a strategy for Web sites to quickly discard malicious requests. We also show that some content distribution networks (CDNs) may not provide the desired level of protection to Web sites against flash events. We therefore propose an enhancement to CDNs that offers better protection and use trace-driven simulations to study the effect of our enhancement on CDNs and Web sites. <s> BIB001 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> • Does the time-to-live (TTL) field in an IP packet agree with the value that can be inferred from the packet's apparent source address? <s> We present WebSOS, a novel overlay-based architecture that provides guaranteed access to a web server that is targeted by a denial of service (DoS) attack. Our approach exploits two key characteristics of the web environment: its design around a human-centric interface, and the extensibility inherent in many browsers through downloadable "applets." We guarantee access to a web server for a large number of previously unknown users, without requiring pre-existing trust relationships between users and the system.Our prototype requires no modifications to either servers or browsers, and makes use of graphical Turing tests, web proxies, and client authentication using the SSL/TLS protocol, all readily supported by modern browsers. We use the WebSOS prototype to conduct a performance evaluation over the Internet using PlanetLab, a testbed for experimentation with network overlays. We determine the end-to-end latency using both a Chord-based approach and our shortcut extension. Our evaluation shows the latency increase by a factor of 7 and 2 respectively, confirming our simulation results. <s> BIB002 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> • Does the time-to-live (TTL) field in an IP packet agree with the value that can be inferred from the packet's apparent source address? <s> In this paper we explore object recognition in clutter. We test our object recognition techniques on Gimpy and EZ-Gimpy, examples of visual CAPTCHAs. A CAPTCHA ("Completely Automated Public Turing test to Tell Computers and Humans Apart") is a program that can generate and grade tests that most humans can pass, yet current computer programs can't pass. EZ-Gimpy, currently used by Yahoo, and Gimpy are CAPTCHAs based on word recognition in the presence of clutter. These CAPTCHAs provide excellent test sets since the clutter they contain is adversarial; it is designed to confuse computer programs. We have developed efficient methods based on shape context matching that can identify the word in an EZ-Gimpy image with a success rate of 92%, and the requisite 3 words in a Gimpy image 33% of the time. The problem of identifying words in such severe clutter provides valuable insight into the more general problem of object recognition in scenes. The methods that we present are instances of a framework designed to tackle this general problem. <s> BIB003 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> • Does the time-to-live (TTL) field in an IP packet agree with the value that can be inferred from the packet's apparent source address? <s> We describe "NetBouncer", an approach and set of technologies for providing practical and high-performance defenses against distributed denial-of-service (DDoS) attacks. The central innovation in the NetBouncer approach to filtering and mitigating DDoS attacks is the ability to distinguish legitimate traffic from illegitimate ones so as to enable the discarding of only illegitimate traffic. In particular, this allows a NetBouncer-enabled network to distinguish DDoS congestion from flash crowd congestion situations. This provides a unique advantage over other DDoS mitigation techniques such as those based on filtering and congestion control where some loss of legitimate traffic is inevitable. The NetBouncer approach is characterized as an end-point-based solution to DDoS protection. It provides localized protection at potential choke points or bottlenecks that may exist in front of hosts and servers. NetBouncer attempts to block traffic as close to the victim as possible, while upstream of the nearest bottleneck. The immediate manifestation of NetBouncer technology is as a high-speed packet processing in-line appliance based on network processor technology. However, the long-term evolution, adoption and integration of NetBouncer technology may be in the back-plane/fast path of commercial high-speed routers. <s> BIB004 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> • Does the time-to-live (TTL) field in an IP packet agree with the value that can be inferred from the packet's apparent source address? <s> Although client puzzles represent a promising approach to defend against certain classes of denial-of-service attacks, several questions stand in the way of their deployment in practice: e.g., how to set the puzzle difficulty in the presence of an adversary with unknown computing power, and how to integrate the approach with existing mechanisms. In this paper, we attempt to address these questions with a new puzzle mechanism called the puzzle auction. Our mechanism enables each client to "bid" for resources by tuning the difficulty of the puzzles it solves, and to adapt its bidding strategy in response to apparent attacks. We analyze the effectiveness of our auction mechanism and further demonstrate it using an implementation within the TCP protocol stack of the Linux kernel. Our implementation has several appealing properties. It effectively defends against SYN flooding attacks, is fully compatible with TCP, and even provides a degree of interoperability with clients with unmodified kernels: Even without a puzzle-solving kernel, a client still can connect to a puzzle auction server under attack (albeit less effectively than those with puzzle-solving kernels, and at the cost of additional server expense). <s> BIB005 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> • Does the time-to-live (TTL) field in an IP packet agree with the value that can be inferred from the packet's apparent source address? <s> Defenses against flooding distributed denial-of-service (DDoS) commonly respond to the attack by dropping the excess traffic, thus reducing the overload at the victim. The major challenge is the differentiation of the legitimate from the attack traffic, so that the dropping policies can be selectively applied. We propose D-WARD, a source-end DDoS defense system that achieves autonomous attack detection and surgically accurate response, thanks to its novel traffic profiling techniques, the adaptive response and the source-end deployment. Moderate traffic volumes seen near the sources, even during the attacks, enable extensive statistics gathering and profiling, facilitating high response selectiveness. D-WARD inflicts an extremely low collateral damage to the legitimate traffic, while quickly detecting and severely rate-limiting outgoing attacks. D-WARD has been extensively evaluated in a controlled testbed environment and in real network operation. Results of selected tests are presented in the paper. <s> BIB006 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> • Does the time-to-live (TTL) field in an IP packet agree with the value that can be inferred from the packet's apparent source address? <s> Recent denial of service attacks are mounted by professionals using Botnets of tens of thousands of compromised machines. To circumvent detection, attackers are increasingly moving away from bandwidth floods to attacks that mimic the Web browsing behavior of a large number of clients, and target expensive higher-layer resources such as CPU, database and disk bandwidth. The resulting attacks are hard to defend against using standard techniques, as the malicious requests differ from the legitimate ones in intent but not in content. We present the design and implementation of Kill-Bots, a kernel extension to protect Web servers against DDoS attacks that masquerade as flash crowds. Kill-Bots provides authentication using graphical tests but is different from other systems that use graphical tests. First, Kill-Bots uses an intermediate stage to identify the IP addresses that ignore the test, and persistently bombard the server with requests despite repeated failures at solving the tests. These machines are bots because their intent is to congest the server. Once these machines are identified, Kill-Bots blocks their requests, turns the graphical tests off, and allows access to legitimate users who are unable or unwilling to solve graphical tests. Second, Kill-Bots sends a test and checks the client's answer without allowing unauthenticated clients access to sockets, TCBs, and worker processes. Thus, it protects the authentication mechanism from being DDoSed. Third, Kill-Bots combines authentication with admission control. As a result, it improves performance, regardless of whether the server overload is caused by DDoS or a true Flash Crowd. <s> BIB007 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> • Does the time-to-live (TTL) field in an IP packet agree with the value that can be inferred from the packet's apparent source address? <s> Distributed denial-of-service (DDoS) attacks are a critical threat to the Internet. This paper introduces a DDoS defense scheme that supports automated online attack characterizations and accurate attack packet discarding based on statistical processing. The key idea is to prioritize a packet based on a score which estimates its legitimacy given the attribute values it carries. Once the score of a packet is computed, this scheme performs score-based selective packet discarding where the dropping threshold is dynamically adjusted based on the score distribution of recent incoming packets and the current level of system overload. This paper describes the design and evaluation of automated attack characterizations, selective packet discarding, and an overload control process. Special considerations are made to ensure that the scheme is amenable to high-speed hardware implementation through scorebook generation and pipeline processing. A simulation study indicates that packetscore is very effective in blocking several different attack types under many different conditions <s> BIB008 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> • Does the time-to-live (TTL) field in an IP packet agree with the value that can be inferred from the packet's apparent source address? <s> In this article we address the issue of denial of service attacks targeting the hardware and software of voice over IP servers or by misusing specific signaling protocol features. As a signaling protocol we investigate here the session initiation protocol. In this context we mainly identify attacks based on exhaustion of the memory of VoIP servers, or attacks that incur high CPU load. We deliver an overview of different attack possibilities and explain some attacks in more detail, including attacks utilizing the DNS system and those targeting the parser. A major conclusion of the work is the knowledge that SIP provides a wide range of features that can be used to mount DoS attacks. Discovering these attacks is inherently difficult, as is the case with DoS attacks on other IP components. However, with adequate server design, efficient implementation, and appropriate hardware, the effects of a large portion of attacks can be reduced <s> BIB009 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> • Does the time-to-live (TTL) field in an IP packet agree with the value that can be inferred from the packet's apparent source address? <s> To defend against distributed denial of service (DDoS) attacks, one critical issue is to effectively isolate the attack traffic from the normal ones. A novel DDoS defense scheme based on TCP is hereby contrived because TCP is the dominant traffic for both the normal and lethal flows in the Internet. Unlike most of the previous DDoS defense schemes that are passive in nature, the proposal uses proactive tests to identify and isolate the malicious traffic. Simulation results validate the effectiveness of our proposed scheme <s> BIB010 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> • Does the time-to-live (TTL) field in an IP packet agree with the value that can be inferred from the packet's apparent source address? <s> Client puzzles have been advocated as a promising countermeasure to denial-of-service (DoS) attacks in recent years. However, how to operationalize this idea in network protocol stacks still has not been sufficiently studied. In this paper, we describe our research on a multi-layer puzzle-based DoS defense architecture, which embeds puzzle techniques into both end-to-end and IP-layer services. Specifically, our research results in two new puzzle techniques: puzzle auctions for end-to-end protection and congestion puzzles for IP-layer protection. We present the designs of these approaches and evaluations of their efficacy. We demonstrate that our techniques effectively mitigate DoS threats to IP, TCP and application protocols; maintain full interoperability with legacy systems; and support incremental deployment. We also provide a game theoretic analysis that sheds light on the potential to use client puzzles for incentive engineering: the costs of solving puzzles on an attackers’ behalf could motivate computer owners to more aggressively cleanse their computers of malware, in turn hindering the attacker from capturing a large number of computers with which it can launch DoS attacks. <s> BIB011 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> • Does the time-to-live (TTL) field in an IP packet agree with the value that can be inferred from the packet's apparent source address? <s> Denial-of-service (DoS) attacks remain a challenging problem in the Internet. By making resources unavailable to intended legitimate clients, DoS attacks have resulted in significant loss of time and money for many organizations, thus, many DoS defense mechanisms have been proposed. In this paper we propose live baiting, a novel approach for detecting the identities of DoS attackers. Live baiting leverages group-testing theory, which aims at discovering defective members in a population using the minimum number of dasiadasiatestspsilapsila. This leverage allows live baiting to detect attackers using low state overhead without requiring models of legitimate requests nor anomalous behavior. The amount of state needed by live baiting is in the order of number of attackers not number of clients. This saving allows live baiting to scale to large services with millions of clients. We analyzed the coverage, effectiveness (detection time, false positive and false negative probabilities), and efficiency (memory, message overhead, and computational complexity) of our approach. We validated our analysis using NS-2 simulations modeled after real Web traces. <s> BIB012
This test refers to Hop Count Filtering (HCF), an idea described in  which exploits the fact that although the attacker can forge any field in the IP header, he/she cannot falsify the number of hops a packet needs to reach its destination starting from its source address. A simple algorithm infers the number of hops traversed (from the packet's TTL field) and compares it to the value that can be inferred for the source, which is stored in a relevant table. If the two values are significantly different, this is a clear indication of IP spoofing and it is a good reason to treat this source's packets as illegitimate. These and other passive tests have the advantage of being relatively light-weight, but are not sufficient to achieve accurate classification on their own. More accuracy inevitably requires more specialisation. In BIB006 , a set of anomaly-based classification criteria for flows and connections are proposed. For instance, a TCP or an ICMP flow may be classified as an attack flow if its packet ratio exceeds a threshold. For the UDP protocol, a normal-flow model is proposed to be a set of thresholds based on the upper bound of allowed connections per destination, the lower bound of allowed packets per connection, and the maximum allowed sending rate per connection. Other recent work BIB008 uses the Bayesian concept of the conditional legitimate probability (CLP) as the basis for a packet filtering scheme. Traffic characteristics during an attack are compared with previously measured legitimate traffic characteristics, and the CLP provides an indication of the legitimacy of suspected packets. An extension to reduce complexity and enhance performance is presented in  . However, as with all profile-based, and particularly Bayesian profile-based DoS approaches, the greatest challenge is not the fine-tuning of the defence mechanism but acquiring dependable traffic profiles. Another option for validity tests is to use criteria based on the type of service. For example, a network which offers Voice-over-IP (VoIP) services should include specific classification criteria based additionally on the specifics of VoIP traffic behaviour. Then, it becomes a matter of having specialised knowledge, in this case of VoIP traffic behaviour, both for the defence system and the attacker who tries to emulate it BIB009 . The limits and thresholds used by these passive tests can be set by using the network administrator's experience, or with an automatic learning process using data collected from ongoing observation of the nodes. Active tests try to interact with suspected attack traffic sources to test their legitimacy. The first question that one has to answer when an attack is suspected is whether it is a real attack or just unusually high legitimate traffic. That is because sudden ramp-up behaviour of traffic also occurs during "flash crowds", where there is a sharp increase in the number of legitimate visitors of a website due to some significant event BIB001 . DoS attackers have recently started exploiting this fact by abandoning full-strength bandwidth floods in favour of attacks that evade detection by imitating the signature characteristics of flash crowds. In response to this, detection mechanisms may try to distinguish between flash crowds and attacks by exploiting their fundamental difference. Flash crowd flows are generated by human users, while DDoS flows are generated by compromised computers. Thus, one can potentially use Reverse Turing tests, such as CAPTCHAs to tell the difference BIB002 . A human can easily tell the sequence of letters that appear in a CAPTCHA's image, while computers usually cannot (Figure 3) . However, issuing a graphical Turing test and expecting an answer requires a connection to be established between the attacker and the web-server, thus rendering the authentication mechanism itself a potential DoS target. The authors of BIB007 address this issue and suggest minor modifications to the TCP protocol to overcome it. They also argue that it is not the actual answer to the test but the behaviour of the client that matters. A human would solve the puzzle either immediately or after reloading the page a few times. A computer would probably continue requesting the web page. However, as in all arms races, it is a matter of time for a countermeasure to appear. For example, dedicated applications built by Computer Vision researchers achieve up to 92% success in solving commonly used types of CAPTCHAs BIB003 . Advances in Artificial Intelligence along with simple craftiness limit their value, while they are also a major impediment to users whose vision impairment. Still, although CAPTCHAs cannot be the sole method of classification, we do agree with the principle that DoS attacks can be more readily detected if we can distinguish between human and computer generated traffic. Several methods have been proposed for actively challenging the clients' legitimacy, such as the work presented in BIB010 and the system called Netbouncer BIB004 , which is representative of this category. Netbouncer keeps a list of authorised users (beyond suspicion), while the rest undergo a series of tests, divided into packet-based, flow-based and application and sessionoriented, such as CAPTCHAs. Various QoS techniques are utilised to assure fair sharing of the resources by the traffic of the legitimate clients, while this legitimacy expires after a certain interval and needs to be challenged again. A similar concept is explored in puzzle-based defence solutions. In a connection-oriented test for DoS attacks, the clients are asked to solve a little cryptographic puzzle before their connection request is authorised. The puzzle may take a little time to solve, while the defending server can rapidly verify the result. This slows down the attacker, but does not guarantee that it will suffice, since overwhelming the puzzlegeneration process is still possible if the attacker's rate is sufficiently high. Examples of such approaches can be found in  ,  , BIB005 , and most recently in BIB011 , where a puzzle-based DoS defense architecture is proposed. It operates on multiple layers and includes puzzle auctions for end-to-end protection and congestion puzzles for IPlayer protection. Recently, Khattab et al. have proposed the live baiting approach BIB012 , which uses group-testing to discover the defective members in a population of users. Since the group-testing theory requires an a priori estimate of the number of defective members, the authors present a probing method for the initial estimate and an adaptive technique to correct the estimate in real-time. They also present a technique to detect users that manipulate their test results. Although it is too early to evaluate the effectiveness of this approach, especially with the limited NS-2 simulation results presented, the live baiting approach addresses some of the limitations of earlier work on classification, especially in terms of scalability. The active test solutions that we have presented in this section often achieve impressive levels of detection accuracy. However, they involve some form of communication with the attacker and additional processing, and as a result can become DoS vessels themselves.