Low-Rate TCP-Targeted Denial of Service Attacks

Low-Rate TCP-Targeted Denial of Service Attacks

Presenter: Juncao Li

Authors: Aleksandar Kuzmanovic Edward W. Knightly

Computer Science, Portland State University 2 [email protected]

Contributions

• Present a denial of service attack – Shrew– throttle TCP flows to a small fraction

• Show the mechanism of Shrew attacks– Exploit TCP’s retransmission timeout

mechanism

• Develop several DoS traffic patterns for attacking


Agenda

• TCP Congestion Control and Shrew Attacks

• Creating DoS Outages• Aggregation and Heterogeneity• Internet Experiments• Counter-DoS Techniques and

Conclusions


Denial of Service

• From Wikipedia– an attempt to make a computer resource

unavailable to its intended users

• Damage– Network bandwidth– CPU cycles– Server interrupt processing capacity– Specific protocol data structures


TCP Congestion Control

• To avoid or reduce the congestion• Small Round Trip Time (RTT) 10ms –

100ms– Additive-Increase Multiplicative-Decrease

(AIMD) control

• Severe congestion– Retransmission Time Out (RTO)– RTO is doubly increased when failure

happens


TCP Congestion Control

• Smoothed Round-Trip Time (SRTT) • Round-Trip Time Variation (RTTVAR)


TCP Retransmission Timer

Multiplicative decrease

Exponentioal backoff

1. Reduce congestion window to one

2. Doubles RTO

Package Loss


Shrew Attacks

• Low-rate DoS attacks that exploit the slow-timescale dynamics of retransmission timers

• Provoke a TCP flow to repeatedly enter a retransmission timeout state– Sending high-rate, but short-duration bursts– The bursts must have RTT-scale– Repeating periodically at slower RTO timescales

• Outage: short durations of the attacker’s loss-inducing bursts


Square-Wave DoS Stream

Outage

• Burst duration is long enough to induce transmission loss

• Average DoS rate is still low


DoS Scenario and System Model

Bottleneck Rate


DoS Model

• Given condition

• DoS TCP Throughput Model


Flow Filtering

• Flow Filtering Behavior– Only TCP flow that satisfies the condition

could be influenced by the shrew attacks


DoS TCP Throughput: Model and Simulation

• Depending on how well the attack can induce transmission loss

• Model does not consider the slow-start

Zero throughput


Agenda



Conclusions


Instantaneous Bottleneck Queue Behavior

• Define B as the queue size and B0 as the queue size at the start of an attack

• Time to fill the queue:


Minimum Rate DoS Streams

• Double-Rate DoS Stream

Fill the queueKeep the queue full

• Use square-wave for DoS streams– Behaves the same– Simple, does not need knowledge of network params


Agenda



Conclusions


DoS and Aggregated TCP Flows

Five long-lived homogeneity TCP flows

• RTT homogeneity introduces a single vulnerable timescale

• DoS induces the synchronization of RTO


RTT-Based Filtering

• 20 long-lived TCP flows on a 10 MB/s link• Range of round-trip time is 20 to 460 ms

Most short RTT TCP flows are influenced


High Aggregation with Heterogeneous RTT

High-RTT flows are not influenced much


Impact of DoS Burst Length

As the burst length increases, more TCP flows with high RTT are influenced


Impact of DoS Peak Rate

Low peak rates are sufficient to filter the short-RTT flow

• 1 TCP Flow with RTT: 12ms to 134ms• 3 TCP Flow with RTT: 108ms to 230ms


Impact on HTTP Flows

Attacks have greater impact on

larger files


TCP Variants


TCP Variants (Cont.)

Burst length L has a great influence on the throughput


Agenda



Conclusions


DoS Attack Scenario

Intra-LAN ScenarioInter-LAN ScenarioWAN Scenario


Experiment Results

Shrew attacks can come from both remote sites or near by LANs


Agenda



Conclusions


Impact of RED and RED-PD routers

• For Router-Assisted Mechanisms: relatively long-timescale measurements are required to determine with confidence that a flow is transmitting at excessively high rate and should be dropped.

RED: Random Early DetectionRED-PD: RED with Preferential Dropping


Detecting DoS Streams


DoS under Randomized RTO

• Randomized minRTO shifts and smoothes TCP’s null frequencies

• It will influence the TCP performance• Helps but not very much to defend the attack


Conclusions

• Low-rate DoS attacks are successful against both short- and long-lived TCP aggregates

• In a heterogeneous-RTT environment, the success of the attack is weighted towards shorter-RTT flows

• All low-rate periodic open-loop streams could be harmful

• Shrew attacks can only be mitigated, but not eliminated, it is a tradeoff between performance


Questions ?

Low-Rate TCP-Targeted Denial of Service Attacks

Documents

Transcript of Low-Rate TCP-Targeted Denial of Service Attacks