Mitigating Distributed Denial-of-Service Attacks: Application-Defense and Network-Defense Methods. (2011)

Distributed Denial of Service (DDoS) attacks can be so powerful that they\ncan easily deplete the computing resources or bandwidth of the potential targets.\nBased on the types of the targets, DDoS attacks can be addressed in two levels:\napplication-level and network-level.\nTaking the network-based applications into consideration, a weak point is\nthat they commonly open some known communication port(s), making themselves\ntargets for denial of service (DoS) attacks. Considering adversaries\nthat can eavesdrop and launch directed DoS attacks to the applications’ open\nports, solutions based on pseudo-random port-hopping have been suggested. As\nport-hopping needs the communicating parties to hop in a synchronized manner,\nthese solutions suggest acknowledgment-based protocols between a clientserver\npair or assume the presence of synchronized clocks. Acknowledgments,\nif lost, can cause a port to be open for longer time and thus be vulnerable to\nDoS attacks; Time servers for synchronizing clocks can become targets to DoS\nattack themselves.\nWe propose solutions for multiple parties which have clocks with rate drifts,\nwhich is common in networking. In particular, we propose an algorithm, BIGWHEEL,\nfor servers to communicate with multiple clients in a port-hopping\nmanner, without the server needing to keep state for each client individually,\nwhich enables support to multi-party applications as well. We also present an\nadaptive algorithm, HOPERAA, for hopping in the presence of clock-drifts,\nas well as the analysis and evaluation of the methods. The solutions are simple,\nbased on each client interacting with the server independently of the other\nclients, without the need of acknowledgments or time servers.\nMechanisms working in the application-level are not sufficient to deal with\nDDoS attacks that aim to congest the victim’s network. Victims may need the help from network-based solutions to solve the problem. Among the networkbased\nsolutions against DDoS attacks, network-capability mechanism is a novel\napproach. A capability is a ticket-like token, checkable by routers, that a server\ncan issue for legitimate traffic. Still, malicious hosts may swamp a server with\nrequests for capability establishment, essentially causing possible Denial-of-\nCapability (DoC). In this thesis an algorithm to mitigate DoC attacks is proposed.\nWith this algorithm, the legitimate hosts can get service with guaranteed\nprobability. The algorithm divides the server’s capacity for handling capability\nrequests into quotas. Quotas are allocated based on a sink tree architecture.\nRandomization and Bloom filters are used as tools against threats (attacking\nscenarios). Issues on fault-tolerance and the deployment of the approach proposed\nare also addressed.\nMitigating DDoS attacks are challenging not only for the targets of the attacks,\nbut also for the network, as large volume of illegitimate traffic share the\nsame network resources as legitimate traffic and can furthermore causes congestion\nphenomena and performance degradation. Considering malicious traffic,\nwe would like ideally to disallow it completely from consuming network\nresources. To achieve that, the malicious traffic should be controlled as close\nto the source(s) as possible. It is observed that there is a trade-off between the\nprotection level of the network and the efficiency/overhead of the protecting\nmethod. By building on earlier work and improving on distribution of control\naspects, a proactive method, which we call CluB, is proposed in this thesis to\nmitigate DDoS attacks. The method balances the effectiveness-overhead tradeoff\nby addressing the issue of granularity of control in the network. CluB can\ncollaborate with different routing policies in the network, including contemporary\ndatagram options. We estimate the effectiveness of the method and also\nstudy a set of factors for tuning the granularity of control.