ost of the Internet's infrastructure was designed to withstand physical failures-such as broken wires or computers-rather than attacks launched by legal network users. [1] [2] [3] The Internet's rapid growth, however, coupled with its cost-effective ability to move data across geographically dispersed heterogeneous information systems, has made it a virtual breeding ground for attackers. Furthermore, the improvisation and sophistication of hackers' attack strategies and methods have overshadowed progress in security systems development. A sustained attack on the Internet could cause a catastrophic infrastructure breakdown. According to a study on the Internet's structure, its reliance on a few key nodes makes it especially vulnerable to organized attacks by hackers and terrorists. 4 According to that report, if 1 percent of the key nodes were disabled, the Internet's average performance would be reduced by a factor of two; if 4 percent were shut down, the Internet's infrastructure would become fragmented and unusable. To make networked systems reliable and robust, we need vulnerability metrics that let us monitor, analyze, and quantify network and application behavior under a range of faults and attacks. Here, we present an agentbased framework for analyzing network vulnerability in real time. The framework lets us quantify how attacks and faults impact network performance and services, discover attack points, and examine how critical network components behave during an attack or system fault. In most network attacks, attackers overwhelm the target system with a continuous flood of traffic designed to consume all system resources (such as CPU cycles, memory, network bandwidth, and packet buffers). These attacks degrade service and can eventually lead to a complete shutdown. 5 There are two common types of attacks: • Server attacks. There are many types of server attacks, 6 including TCP SYN, Smurf IP, ICMP flood, and Ping of Death attacks. In some attacks, the attacker makes overwhelming connection requests to a victim server with spoofed source IP addresses. Due to TCP/IP protocol stack vulnerabilities, the victim server cannot complete the connection requests and wastes all of its system resources. As a result, the server cannot service legitimate traffic, which severely impacts network performance. • Routing attacks. Distributed denial-of-service (DDoS) attacks increasingly focus on routers. Once a router is compromised, it will forward traffic according to the attackers' intent. Similar to server attacks, the attackers aim to consume all router resources, forcing the router to drop all incoming packets, thus negatively affecting network performance and behavior. Analyzing vulnerability in networks and in Internet infrastructure still is in its infancy, and there's much room for improvement. Several existing tools, which are based on modeling network specifications, fault trees, graph models, and performance models, analyze vulnerability by checking logs of system software and monitoring performance metrics. 5, 7 In what follows, we briefly high-
Hariri et al. REF present an agent-based framework that quantifies how attacks and faults impact network performance and services, discovers attack points, and examines how critical network components behave during an attack.
Impact Analysis of Faults and Attacks in Large-Scale Networks
IEEE Secur. Priv.
IEEE Secur. Priv.
Computer Science