On the Robustness of Router-based Denial-of-Service (DoS) Defense Systems

Simple item page
dc.contributor.authorXu, Ying
dc.contributor.authorGuérin, Roch A
dc.date2023-05-16T22:32:55.000
dc.date.accessioned2023-05-22T19:06:00Z
dc.date.available2023-05-22T19:06:00Z
dc.date.issued2005-07-01
dc.date.submitted2005-07-18T11:00:58-07:00
dc.description.abstractThis paper focuses on "router-based" defense mechanisms, and whether they can provide effective solutions to network Denial-of-Service (DoS) attacks. Router-based defenses operate either on traffic aggregates or on individual flows, and have been shown, either alone or in combination with other schemes, e.g., traceback, to be reasonably effective against certain types of basic attacks. Those attacks are, however, relatively brute-force, and usually accompanied by either significant increases in congestion, and/or traffic patterns that are easily identified. It is, therefore, unclear if router-based solutions are viable in the presence of more diverse or sophisticated attacks. As a result, even if incorporating defense mechanisms in the routers themselves has obvious advantages, such schemes have not seen wide deployments. Our ultimate goal is to determine whether it is possible to build router-based defense mechanisms that are effective against a wide range of attacks. This paper describes a first phase of this effort aimed at identifying weaknesses in existing systems. In particular, the paper demonstrates that aggregate defense systems can be readily circumvented, even by a single attacker, through minor modifications of its flooding patterns. Flow-based defenses fare slightly better, but can still be easily fooled by a small number of attackers generating transient flooding patterns. The findings of the paper provide insight into possible approaches for designing better and more robust router-based defense systems.
dc.description.commentsPostprint version. Copyright ACM, 2005. This is the author's version of the work. It is posted here by permission of ACM for your personal use. Not for redistribution. The definitive version was published in ACM SIGCOMM Computer Communication Review, Volume 35, Issue 3, July 2005, pages 47-60. Publisher URL: http://doi.acm.org/10.1145/1070873.1070878
dc.description.commentsPostprint version. Copyright ACM, 2005. This is the author's version of the work. It is posted here by permission of ACM for your personal use. Not for redistribution. The definitive version was published in ACM SIGCOMM Computer Communication Review, Volume 35, Issue 3, July 2005, pages 47-60. Publisher URL: http://doi.acm.org/10.1145/1070873.1070878
dc.identifier.urihttps://repository.upenn.edu/handle/20.500.14332/33282
dc.legacy.articleid1135
dc.legacy.fulltexturlhttps://repository.upenn.edu/cgi/viewcontent.cgi?article=1135&context=ese_papers&unstamped=1
dc.source.issue104
dc.source.journalDepartmental Papers (ESE)
dc.source.peerreviewedtrue
dc.source.statuspublished
dc.subject.otherSecurity
dc.subject.otherDenial-of-Service
dc.subject.otherRouter
dc.titleOn the Robustness of Router-based Denial-of-Service (DoS) Defense Systems
dc.typeArticle
digcom.contributor.authorXu, Ying
digcom.contributor.authorisAuthorOfPublication|email:guerin@acm.org|institution:University of Pennsylvania|Guérin, Roch A
digcom.identifierese_papers/104
digcom.identifier.contextkey83663
digcom.identifier.submissionpathese_papers/104
digcom.typearticle
dspace.entity.typePublication
relation.isAuthorOfPublication1e470865-a59e-4fd9-9b4b-fd6e24ed0db3
relation.isAuthorOfPublication.latestForDiscovery1e470865-a59e-4fd9-9b4b-fd6e24ed0db3
upenn.schoolDepartmentCenterDepartmental Papers (ESE)
Files
Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
CCR_402_Xu.pdf
Size:
399.47 KB
Format:
Adobe Portable Document Format
Download
Collection
Articles