# Analyzing Impact and Systemwide Effects of the SlowROS Attack in an Industrial Automation Scenario
## 4 Attack Context and Description
### slow DoS Attack Description and Analysys  
If we consider the ROS protocol as mentioned above, it is a TCP-based application layer protocol used to manage communication inside of an industrial IoT network, based on a publish-subscribe approach. In more detail, the ROS protocol makes use of HTTP REST-based APIs, including XML-formatted data. Considering such aspects, the slow DoS Attack examined in this paper is going to act in two stages: (i) At first, a specific amount of simultaneous connections with the server is established in order to seize all available connection slots that the (application) server is able to support. (ii) Then, each connection is kept alive as long as possible in order to prevent its closure by the server. Such typical behavior of slow DoS Attacks [6] leads to a denial of service on the server and attempts to keep it as long as possible. In detail, the number of connections that the attacker has to simultaneously establish and keep alive depends on the application server configuration. Although for specific daemon software, such as the Apache web service, such a value can be set up, it may not have an impact on the attack success, while, by increasing such a value, the attacker would require more resources to accomplish its goal. Instead, in order to keep the connection as long as possible, different approaches are possible: in our case, by implementing a so-called _Long Request DoS_, we split the transmission of the request payload in multiple cycles, sending a predefined payload to the server, split into multiple portions on each round. In particular, the considered payload transmitted by the attacker may vary and may exploit different functionalities/methods provided by the ROS server. In our case, we adopt a payload similar to the one reported in Figure 3.  
For the sake of readability, we indent content in the figure, whereas when sending data over the network, the content is not indented. Token and field separators--the r\
sequence between HTTP headers and any amount of white space between XML syntactic elements--are not shown, either. Moreover, although XML tags and ROS-specific fields are split into multiple lines in Figure 1, we do not consider such format  
Figure 3: Payload content sent by the attack to the ROS publisher. HTTP headers are shown in red, XML-RPC encapsulation elements in green, and ROS-specific fields in blue. represent the actual payload sent by the attacker. We also replace specific information (such as the value of the HTTP Host parameter) with generic tags to provide a more general payload applicable independently on the target. It should be noted that any payload compliant to the protocol is valid to perpetrate a successful attack. In addition, payloads not compliant to the ROS protocol may lead to a successful DoS as well [8]. As the payload sent by the attacker typically is a legitimate payload compliant to the ROS protocol, it is not trivial to detect an ongoing attack, by analyzing the data exchanged by the client and the server. In addition, although in this paper we consider, for simplicity, a single attacking host, whose detection of the malevolent aims at the network layer would be trivial, it is quite simple for a real attacker to distribute the threat to multiple malicious nodes, coordinated to perpetrate a common attack against a simple server. In such a case, the detection of an ongoing attack would be more difficult. Figure 4 summarizes the prospective attack sequence as a whole. The attacker is shown on the left and regular ROS nodes on the right. The ROS Master and parameter server are represented as two separate entities in the middle of the figure, although, as discussed in Section 3.2, they are implemented within the same process. The sequence consists of the following steps, whose number is also recalled in the figure for clarity:  
1. In the system initialization and setup phase, regular ROS nodes interact with the ROS Master to register themselves as publishers and/or subscribers. The attacker does not interfere with this phase. 2.