A multi faceted approach to countering internet threats
Year: 2009

While the Internet has revolutionalized the communication landscape, it continues to be plagued by issues of robustness and security that threaten the network's operation. In this dissertation, we employ a multi faceted approach to tackle these issues. Specifically, measurement studies are performed to experimentally quantify the ground truth related to the robustness of the Internet infrastructure and security threats in the wild. This work is complemented by research on future Internet threats and mechanisms to contain them. The source of these threats are novel classes of malware which exploit the increasing attack surface, presented by rapidly evolving Internet technologies. As an instance of quantifying the emerging security threats in the wild, we performed a wide scale measurement study of the Storm botnet. This botnet, which represents the leading edge in botnet technology, uses a distributed peer to peer(P2P) architecture and aggressively defends itself. We developed a crawler which actively scourged the P2P botnet, to determine its size and other structural properties. This study shows how traditional P2P distributed hash tables (DHTs) differ from botnet DHTs, eventhough they use the same underlying P2P protocol mainly due to the diverse interests of participating entities within. In particular, we could precisely identify nodes which poison the DHT index, using simple heuristics. Such a capability is particularly alarming to the security community, considering that the storm botnet aggressively defends itself by carrying out DDoS attacks. The bigger implication of this study is that current botnet monitoring techniques easily lend themselves to miscreant counter intelligence techniques, thereby motivating the need for stealthier monitoring techniques. Since network defense is essentially an arms race, we not only address current threats, but also look ahead to threats that are likely to arise in the future. We show that, as mobile devices become pervasive and more powerful, malware can exploit their mobility patterns to trivially propagate around perimeter defenses such as firewalls. Using an analytical model, we estimate the speed with which such infections can propagate over a population of nomadic users. We validate our results using realistic mobility traces from a campus wide wireless network with hundreds of access points and thousands of mobile users. We show that, while the speed of propagation of mobile malware is slower when compared to traditional Internet worms, it is still fast enough to render manual countermeasures implausible. Furthermore, we develop a novel probabilistic technique which advocates using a modified version of random moonwalks to provide early detection of such mobile malware. The proposed technique can reliably detect and pinpoint the origin of a mobile infection in the early stages of its evolution itself. Given that worms pose a global scale threat to the Internet infrastructure, an evaluation of robustness, quantifying the ability of the Internet to withstand attacks, is essential. Specifically, we measured the performance of anycast on four top level domain name service (DNS) zones, which allowed us to quantify the reliability and resiliency of the DNS zones against large scale distributed denial of service (DDoS) We showed that outages in DNS service are indeed rare. However, when they do occur, outages can last upto multiple minutes, mainly due to slow Border Gateway Protocol(BGP) convergence. At the other end of the spectrum, Internet routers can also be the subjects of DDoS attacks. One such attack, known as the shrew attack, consists of small traffic bursts that can temporarily inundate a router's queue while at the same time, evade detection due to their low average transmission rate. Using simple mathematical analysis and simulation, we show that a relatively small buffer, combined with a fair queue management scheme, is sufficient to detect/thwartlow rate TCP attacks against routers.