Low-Rate TCP-Targeted Denial of Service Attacks

Presenter: Juncao Li

Authors: Aleksandar Kuzmanovic Edward W. Knightly

Computer Science, Portland State University 2 juncao@cs.pdx.edu

Contributions

• Present a denial of service attack – Shrew– throttle TCP flows to a small fraction

• Show the mechanism of Shrew attacks– Exploit TCP’s retransmission timeout

mechanism

• Develop several DoS traffic patterns for attacking

Agenda

• TCP Congestion Control and Shrew Attacks

• Creating DoS Outages• Aggregation and Heterogeneity• Internet Experiments• Counter-DoS Techniques and

Conclusions

Denial of Service

• From Wikipedia– an attempt to make a computer resource

unavailable to its intended users

• Damage– Network bandwidth– CPU cycles– Server interrupt processing capacity– Specific protocol data structures

TCP Congestion Control

• To avoid or reduce the congestion• Small Round Trip Time (RTT) 10ms –

100ms– Additive-Increase Multiplicative-Decrease

(AIMD) control

• Severe congestion– Retransmission Time Out (RTO)– RTO is doubly increased when failure

happens

TCP Congestion Control

• Smoothed Round-Trip Time (SRTT) • Round-Trip Time Variation (RTTVAR)

TCP Retransmission Timer

Multiplicative decrease

Exponentioal backoff

1. Reduce congestion window to one

2. Doubles RTO

Package Loss

Shrew Attacks

• Low-rate DoS attacks that exploit the slow-timescale dynamics of retransmission timers

• Provoke a TCP flow to repeatedly enter a retransmission timeout state– Sending high-rate, but short-duration bursts– The bursts must have RTT-scale– Repeating periodically at slower RTO timescales

• Outage: short durations of the attacker’s loss-inducing bursts

Square-Wave DoS Stream

Outage

• Burst duration is long enough to induce transmission loss

• Average DoS rate is still low

DoS Scenario and System Model

Bottleneck Rate

DoS Model

• Given condition

• DoS TCP Throughput Model

Flow Filtering

• Flow Filtering Behavior– Only TCP flow that satisfies the condition

could be influenced by the shrew attacks

DoS TCP Throughput: Model and Simulation

• Depending on how well the attack can induce transmission loss

• Model does not consider the slow-start

Zero throughput

Agenda

Conclusions

Instantaneous Bottleneck Queue Behavior

• Define B as the queue size and B0 as the queue size at the start of an attack

• Time to fill the queue:

Minimum Rate DoS Streams

• Double-Rate DoS Stream

Fill the queueKeep the queue full

• Use square-wave for DoS streams– Behaves the same– Simple, does not need knowledge of network params

Agenda

Conclusions

DoS and Aggregated TCP Flows

Five long-lived homogeneity TCP flows

• RTT homogeneity introduces a single vulnerable timescale

• DoS induces the synchronization of RTO

RTT-Based Filtering

• 20 long-lived TCP flows on a 10 MB/s link• Range of round-trip time is 20 to 460 ms

Most short RTT TCP flows are influenced

High Aggregation with Heterogeneous RTT

High-RTT flows are not influenced much

Impact of DoS Burst Length

As the burst length increases, more TCP flows with high RTT are influenced

Impact of DoS Peak Rate

Low peak rates are sufficient to filter the short-RTT flow

• 1 TCP Flow with RTT: 12ms to 134ms• 3 TCP Flow with RTT: 108ms to 230ms

Impact on HTTP Flows

Attacks have greater impact on

larger files

TCP Variants

TCP Variants (Cont.)

Burst length L has a great influence on the throughput

Agenda

Conclusions

DoS Attack Scenario

Intra-LAN ScenarioInter-LAN ScenarioWAN Scenario

Experiment Results

Shrew attacks can come from both remote sites or near by LANs

Agenda

Conclusions

Impact of RED and RED-PD routers

• For Router-Assisted Mechanisms: relatively long-timescale measurements are required to determine with confidence that a flow is transmitting at excessively high rate and should be dropped.

RED: Random Early DetectionRED-PD: RED with Preferential Dropping

Detecting DoS Streams

DoS under Randomized RTO

• Randomized minRTO shifts and smoothes TCP’s null frequencies

• It will influence the TCP performance• Helps but not very much to defend the attack

Conclusions

• Low-rate DoS attacks are successful against both short- and long-lived TCP aggregates

• In a heterogeneous-RTT environment, the success of the attack is weighted towards shorter-RTT flows

• All low-rate periodic open-loop streams could be harmful

• Shrew attacks can only be mitigated, but not eliminated, it is a tradeoff between performance

Questions ?

Low-Rate TCP-Targeted Denial of Service Attacks

Documents

Distributed Denial of Service (DDoS) Attacks

Denial-of-Service (DoS) & Web Attacks

Detection of Denial of Service Attacks on Application ...epubs.surrey.ac.uk/807702/2/Detection of Denial Of Service Attacks... · Detection of Denial of Service Attacks on Application

Flash Crowds & Denial of Service Attacks

Denial of Service Attacks (DoS/DDoS)

Top 10 Cyber Attacks - Digital Point Technologies Inc · Top 10 Cyber Attacks 1. Denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks A denial-of-service attack

Attacks on TCP

CSE508 2017 - Denial of Service Attacks

Top 10 Cyber Attacks · 2019. 12. 19. · Top 10 Cyber Attacks 1. Denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks A denial-of-service attack overwhelms a

Low-Rate TCP-Targeted Denial of Service Attacks Presenter: Juncao Li Authors: Aleksandar Kuzmanovic Edward W. Knightly

System Vulnerabilities and Denial of Service Attacks€¦ · System Vulnerabilities and Denial of Service Attacks Introduction and Threat Overview Denial of Service Threats DoS Attacks:

Preventing Denial of Service Attacks

Attacks on TCP/IP, BGP, DNS Denial of Serviceojensen/courses/cs361s/... · slide 1 Vitaly Shmatikov CS 361S Attacks on TCP/IP, BGP, DNS Denial of Service . slide 2 Reading Assignment

Detecting Distributed Denial of Service Attacks: Methods ...jkalita/papers/2013/BhuyanMonowarComputerJourn… · Detecting Distributed Denial of Service Attacks: Methods, ... statistical,

Attacks on TCP/IP, BGP, DNS Denial of Serviceshmat/courses/cs378/netattacks.pdf · IP and TCP Headers Version Header Length Type of Service Total Length Identification Flags Time

Denial of Service Attacks

Denial of Service Attacks

Denial of Service Attacks. Understanding to Denial of Services

Slide 1 Vitaly Shmatikov CS 361S Attacks on TCP/IP, BGP, DNS Denial of Service

Attacks on TCP/IP