Transforming the Responsibility for Trusted Denial-of-Service Mitigation in the Internet

Research Question

1. How to transform the cost of mitigation of Denial-of-Service (DoS) attacks in the Internet from a burden on the potential victim to a burden on attackers

Why Is This Research Important?

The contributions of this project are both technical and economic. In particular: 

1. Putting the burden both computationally and economically on the attackers rather than the victims and their agents will significantly change the dynamics, reducing or eliminating these types of attacks when the cost becomes too great. 

2. Because it is well understood that attackers will move to less burdensome forms of attacks, understanding and eliminating whole classes of attacks and the protocols used to launch them with respect to other widely utilized protocols or protocols critical to the infrastructure, such as NTP, will significantly reduce the opportunities for successful attacks. 

3. More broadly, by bringing together both technical and economic analysis, the research has a significant impact on the commercial side of networking. As an example, if Internet providers are able to evaluate their options both technically and economically in helping to reduce unwanted and malicious traffic with either minimal negative impact on their customers or perhaps even with a positive economic and experiential effect on their customers, the benefit of this approach is that it improves the trust that society places in the Internet. The final result is an opportunity to improve overall trust in the Internet, specifically with respect to resistance to, and lowered costs of handling volumetric denial-of-service attacks. 

Methodology

This research has an experimental methodological approach.  

In order to run the experiments and collect the data, the “Merge testbed Platform” is used (an emulation facility designed specifically for security experimentation). Because very large amounts of intentionally malicious traffic are sent, such experiments cannot be performed on a live, operational network without significant negative impact. Merge is designed not only for isolation of security experiments but also to create suites of experiments controlling for a wide variety of configurations such as topology, computation and memory sizes of the nodes, characterization of links (e.g. bandwidth, packet loss, jitter, etc.), operating systems, and so forth. 

For each of the four scenarios (TCP/HTTP, TLS/HTTPS, UDP and possibly NTP), four sets of experiments will be performed, measuring both user-level transaction completion as well as bandwidth, CPU utilization, and memory utilization, from the perspectives of the intended victims, the attackers and routers internal to the network: (1) No attacks and no mitigation, as a baseline; (2) Attacks and no mitigation, as the worst case scenario; (3) No attacks, but mitigation present, as the normal case when prepared for an attack, as the cost of mitigation; and (4) Attacks and mitigation, as the benefit of mitigation.  

With the resulting data from the experiments, the analysis involves aggregation, cross-correlation, and development of economic models.  

Media and Publications

• Redistributing the Costs of Volumetric Denial-of-Service Mitigation Presents a protocol-agnostic approach to DoS mitigation that moves overhead away from service bottlenecks, towards the network edge and onto attackers themselves.
• Economic Rebalancing of the Costs and Benefits of Volumetric Ddos Mitigation in the Internet: A Case Study of Tcp Proposes a novel mitigation strategy for a popular mode of attack: volumetric “Distributed Denial of Service” or DDoS attacks
• The Economics of DDoS Mitigation and Changing Internet Protocols The focus of this paper is on an economics-based analysis and redesign of mitigation of volumetric Denial-of-Service (DDos) attacks utilizing the initial packets in connection-oriented protocols. 
• SYN Proof-of- Work: Improving Volumetric DoS Resilience in TCP This paper presents and evaluates SYN PoW, a novel approach to mitigating TCP SYN flooding attacks using minia-ture proofs-of-work. 
• Proof-of-Work Mitigation Strategy for DNS-Based Amplification Attacks Proposes a new Proof-of-Work mitigation strategy that provides a defense against DNS Amplification attacks and shifts the burden of mitigation to the attackers.