Detect Slitheen by analyzing the browsing behaviors and forcing retransmission Abstract   Previous studies on decoy routing did not consider the impact of content delivery networks (CDN). The CDN are widely used by popular websites which should not be ignored. In this paper, we take the first step to study the problem of applying the decoy routing in the CDN. In detail, we take Slitheen, which is one of the most advanced decoy routing techniques as our research object, and design the detection attacks from the following aspects: replacing the CDN edge servers; analyzing retransmission latency; comparing ciphertexts; analyzing the page loading duration. If Slitheen exposes its users to the censor, they will be in great danger in some repressive regimes. In order to reinforce Slitheen, we propose attack plans from the perspective of the attacker. To the best knowledge of the authors, our work is the first research on decoy routing in the CDN. By simulations, we demonstrate the feasibility of our detection scheme. We show that using our attack methods, the packetsending frequency, the retransmission delay, and the page loading durations of Slitheen sessions are all obviously different from regular ones.

Practical Verifiable Innetwork Filtering for DDoS defense In light of everincreasing scale and sophistication of modern DDoS attacks, it is time to revisit innetwork filtering or the idea of empowering DDoS victims to install innetwork traffic filters in the upstream transit networks. Recent proposals show that filtering DDoS traffic at a handful of large transit networks can handle volumetric DDoS attacks effectively. However, the innetwork filtering primitive can also be misused. Transit networks can use the innetwork filtering service as an excuse for any arbitrary packet drops made for their own benefit. For example, transit networks may intentionally execute filtering services poorly or unfairly to discriminate their competing neighbor ASes while claiming that they drop packets for the sake of DDoS defense. We argue that it is due to the lack of verifiable filtering  i.e., no one can check if a transit network executes the filter rules correctly as requested by the DDoS victims. To make innetwork filtering a more robust defense primitive, in this paper, we propose a verifiable innetwork filtering, called VIF, that exploits emerging hardwarebased trusted execution environments (TEEs) and offers filtering verifiability to DDoS victims and neighbor ASes. Our proof of concept demonstrates that a VIF filter implementation on commodity servers with TEE support can handle traffic at line rate (e.g., 10 Gbs) and execute up to 3,000 filter rules. We show that VIF can easily scale to handle larger traffic volume (e.g., 500 Gbs) and more complex filtering operations (e.g., 150,000 filter rules) by parallelizing the TEEbased filters. As a practical deployment model, we suggest that Internet exchange points (IXPs) are the ideal candidates for the early adopters of our verifiable filters due to their central locations and flexible softwaredefined architecture.