1,720,996 research outputs found
Pi: A Path Identification Mechanism to Defend Against DDoS Attacks
No full textDistributed Denial of Service (DDoS) attacks continue to plague the Internet. Defense against these attacks is complicated by spoofed source IP addresses,which make it difficult to determine a packet's true origin.We propose Pi (short for Path Identifier), a new packet marking approach in which a path fingerprint is embedded in each packet, enabling a victim to identify packets traversing the same paths through the Internet on a per packet basis, regardless of source IP address spoofing.
Pi features many unique properties. It is a per-packet deterministic mechanism: each packet traveling along the same path carries the same identifier. This allows the victim to take a proactive role in defending against a DDoS attack by using the Pi mark to filter out packets matching the attackers' identifiers on a per packet basis. The Pi scheme performs well under large-scale DDoSattacks consisting of thousands of attackers, and is effective even when only half the routers in the Internet participate in packet marking. Pi marking and filtering are both extremely light-weight and require negligible state.
We use traceroute maps of real Internet topologies (e.g. CAIDA's Skitter [5] and Burch and Cheswick's InternetMap [3, 14]) to simulate DDoS attacks and validate our design
Secure Hierarchical In-Network Aggregation in Sensor Networks
No full textIn-network aggregation is an essential primitive for performing
queries on sensor network data. However, most aggregation algorithms assume that all intermediate nodes are trusted. In contrast,
the standard threat model in sensor network security assumes that
an attacker may control a fraction of the nodes, which may misbehave in an arbitrary (Byzantine) manner.
We present the first algorithm for provably secure hierarchical
in-network data aggregation. Our algorithm is guaranteed to detect
any manipulation of the aggregate by the adversary beyond what is
achievable through direct injection of data values at compromised
nodes. In other words, the adversary can never gain any advantage from misrepresenting intermediate aggregation computations.
Our algorithm incurs only O(∆ log2 n) node congestion, supports
arbitrary tree-based aggregator topologies and retains its resistance
against aggregation manipulation in the presence of arbitrary numbers of malicious nodes. The main algorithm is based on performing the S UM aggregation securely by first forcing the adversary to
commit to its choice of intermediate aggregation results, and then
having the sensor nodes independently verify that their contributions to the aggregate are correctly incorporated. We show how to
reduce secure MEDIAN, COUNT, and AVERAGE to this primitive
SIFF: A Stateless Internet Flow Filter to Mitigate DDoS Flooding Attacks
No full textOne of the fundamental limitations of the Internet is the
inability of a packet flow recipient to halt disruptive flows
before they consume the recipient’s network link resources.
Critical infrastructures and businesses alike are vulnerable
to DoS attacks or flash-crowds that can incapacitate their
networks with traffic floods. Unfortunately, current mechanisms
require per-flow state at routers, ISP collaboration,
or the deployment of an overlay infrastructure to defend
against these events.
In this paper, we present SIFF, a Stateless Internet Flow
Filter, which allows an end-host to selectively stop individual
flows from reaching its network, without any of the
common assumptions listed above. We divide all network
traffic into two classes, privileged (prioritized packets subject
to recipient control) and unprivileged (legacy traffic).
Privileged channels are established through a capability exchange
handshake. Capabilities are dynamic and verified
statelessly by the routers in the network, and can be revoked
by quenching update messages to an offending host. SIFF is
transparent to legacy clients and servers, but only updated
hosts will enjoy the benefits of it
Going Beyond Counting First Authors in Author Co-citation Analysis
Get PDFThe present study examines one of the fundamental aspects of author co-citation analysis (ACA) - the way co-citation
counts are defined. Co-citation counting provides the data on which all subsequent statistical analyses and mappings
are based, and we compare ACA results based on two different types of co-citation counting - the traditional type that
only counts the first one among a cited work's authors on the one hand and a non-traditional type that takes into
account the first 5 authors of a cited work on the other hand. Results indicate that the picture produced through this non-traditional author co-citation counting contains more coherent author groups and is therefore considerably clearer. However, this picture represents fewer specialties in the research field being studied than that produced through the traditional first-author co-citation counting when the same number of top-ranked authors is selected and analyzed. Reasons for these effects are discussed
StackPi : a new defense mechanism against IP spoofing and DDoS attacks
No full textAbstract: "Today's Internet hosts are threatened by IP spoofing attacks and large scale Distributed Denial-of-Service (DDoS) attacks. We propose a new defense mechanism, StackPi, which unlike previous approaches, allows the host being attacked, or its upstream ISP, to filter out attack packets and to detect spoofed source IP addresses, on a per-packet basis. In StackPi, a packet is marked deterministically by routers along its path towards the destination. Packets traveling along the same path will have the same marking so that an attack victim need only identify the StackPi marks of attack packets to filter out all further attack packets with the same marking. In addition, the victim can associate StackPi marks with source IP addresses to detect source IP address spoofing by changes in the corresponding StackPi mark. StackPi filtering can thus defend against not only DDoS attacks, but also many IP spoofing attacks -- such as TCP hijacking, and multicast source spoofing attacks. Because each complete mark fits within a single packet, the StackPi defense responds quickly to attacks and can be effective after the first attack packet in a IP spoofing attack, or after a small number of attack packets in the case of a DDoS attack. StackPi also supports incremental deployment, such that significant benefits are realized even if only one third of Internet routers implement StackPi marking. We show these results through analysis and simulations based on several real Internet topologies.
Help Me Help You: Using Trustworthy Host-Based Information in the Network (CMU-CyLab-09-016)
No full textAs hardware support for improved endhost security
becomes ubiquitous, it is important to consider how
network security and performance can benefit from these
improvements. If endhosts (or at least portions of each endhost)
can be trusted, then network infrastructure no longer needs
to arduously and imprecisely reconstruct data already known
by the endhosts. Through the design of a general-purpose
architecture we call Assayer, we explore the issues in providing
trusted host-based data, including the balance between useful
information and user privacy, and the tradeoffs between
security and efficiency. We also evaluate the usefulness of such
information in three case studies.
To gain insight into the performance we could expect from
such a system, we implement and evaluate a basic Assayer
prototype. Our prototype requires fewer than 1,000 lines of
code on the endhost. Endhosts can annotate their outbound
traffic in a few microseconds, and these annotations can be
checked efficiently; even packet-level annotations on a gigabit
link can be checked with a loss in throughput of only 3.7-18.3%
Don’t Talk to Zombies: Mitigating DDoS Attacks via Attestation (CMU-CyLab-09-009)
No full textDistributed Denial-of-Service (DDoS) attacks typically originate from exploited endhosts controlled by a remote attacker. Current network-based DDoS defenses can only filter out malicious traffic based on the traffic’s inherent properties; they cannot filter based on properties of the endhost that generated the traffic. We observe that the identity of the code that has generated a packet offers powerful predicates for filtering, and we develop a secure, general architecture, Assayer, for in-network filtering based on endhost properties. Our proposed Assayer architecture leverages hardwarebased attestation mechanisms to enable legitimate endhosts to embed secure proofs of code identity in packets. Receivers can specify traffic policies, which are enforced by on-path prioritizers. We design Assayer to achieve scalability, efficiency, and incremental deployability. We implement and evaluate a basic Assayer prototype and find that the perceived application overhead, felt only during periods of significant network congestion, is less than 12%. Our simulations indicate that our architecture, even when deployed only at the victim’s ISP, provides excellent protection against a botnet of 100,000 attacking hosts
Perspectives: Improving SSH-style Host Authentication with Multi-Path Probing
No full textThe popularity of “Trust-on-first-use” (Tofu) authentication,
used by SSH and HTTPS with self-signed certificates,
demonstrates significant demand for host authentication
that is low-cost and simple to deploy. While Tofu-based
applications are a clear improvement over completely insecure
protocols, they can leave users vulnerable to even
simple network attacks. Our system, PERSPECTIVES,
thwarts many of these attacks by using a collection of “notary”
hosts that observes a server’s public key via multiple
network vantage points (detecting localized attacks) and
keeps a record of the server’s key over time (recognizing
short-lived attacks). Clients can download these records
on-demand and compare them against an unauthenticated
key, detecting many common attacks. PERSPECTIVES explores
a promising part of the host authentication design
space: Trust-on-first-use applications gain significant attack
robustness without sacrificing their ease-of-use. We
also analyze the security provided by PERSPECTIVES and
describe our experience building and deploying a publicly
available implementation
Efficient constructions for one-way hash chains
No full textAbstract: "One-way chains are an important cryptographic primitive in many security applications. Lamport first proposed to use one-way chains for one-time password authentication [19]. Subsequently, researchers proposed one-way chains as a basic building block for digital cash, for extending the lifetime of digital certificates, for constructing one-time signatures, for packet authentication, etc. As one-way chains are very efficient to verify, they recently became increasingly popular for designing security protocols for resource-constrained mobile devices and sensor networks, as their low-powered processors can compute a one-way function within milliseconds, but would require tens of seconds or up to minutes to generate or verify a traditional digital signature [6]. Recent sensor network security protocols thus extensively use one-way chains to design protocols that scale down to resource-constrained sensors [20,28]. Recently, researchers also proposed a variety of improvements to one-way hash chains to make storage and access more efficient [9,17,32], or to make setup and verification more efficient [16,20]. In this paper we present two new constructions for one-way hash chains, which significantly improve the efficiency of one-way chains. Our first construction, the Sandwich-chain, provides a smaller bandwidth overhead for one-way chain values, and enables efficient verification of one-way chain values if the trusted one-way chain value is far away. Our second construction, Comb Skipchain, features a new lower bound for one-way chains in terms of storage and traversal overhead. In fact previously, researchers [9] cite a lower bound of log┬▓(n) for the product of per-value traversal overload and memory requirements for one-dimensional chains. We show that one can achieve a lower bound by considering multi-dimensional chains. In particular, our two-dimensional construction requires O(log (n)) memory and O(1) traversal overhead, thereby improving on the one-dimensional bound. In addition, the setup cost for the one-way chain is in contrast only O(n/log(n)). Other benefits for both constructions include a faster verification step than the traditional hash chains provide; a verifier can 'catch up' efficiently, after having missed some number of previously released hash values (for the Sandwich-chain); and resistance against DoS attacks on authentication values. Moreover, we describe fractal traversal schemes for our proposed structures, bringing down the traversal costs for our structure to the same as those of the simpler 'traditional ' hash chain. Our new construction is orthogonal to most previously proposed techniques, and can be used in conjunction with techniques for efficient setup or verification of one-way chains.
- …
