Presentation of "On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internets" by Jammy for Next-Generation Internet Class

1. On the Effectiveness of
Route-Based Packet Filtering for
Distributed DoS Attack Prevention
in Power-Law Internets
WANG Jiamian
kfc315@gmail.com
May 17, 2013

2. About the paper
On the Effectiveness of
Route-Based Packet Filtering for
Distributed DoS Attack Prevention
in Power-Law Internets
metric and
evaluation
approach
problem solved
1
2
3

3. • SIGCOMM ’01, typical SIGCOMM-style
• The formalizing steps are, to some degree,
subtle and hard to fully understand
• So, patience and deeper thinking are
preferred
First of all...

4. On the Effectiveness of
Route-Based Packet Filtering for
Distributed DoS Attack Prevention
in Power-Law Internetsproblem solved
1

5. • DoS is a pressing problem on the Internet
• When the attack is distributed, the impact can be
proportionally severe
• Susceptibility to DoS is an intrinsic problem of any
service provisioning system
Background
DoS attack

6. • Preventing DoS
• identification of the attackers / traffic
• if compromised, track back the attackers’ ids
• Proactive prevention of spoofed IP packets from reaching
their destination
• Reactive source identification of spoofed IP flows
Background
Two complementary problems

7. On the Effectiveness of
Route-Based Packet Filtering for
Distributed DoS Attack Prevention
in Power-Law Internets
approach 2

8. • Uses routing information to determine if a packet
arriving at a router is valid with respect to its inscribed
source/destination addresses
• If a single router...
• If all AS’s perform filtering...
• Like setting up road blocks to apprehend bank robbers
Route-based detection and
discarding of spoofed IP packet
Simple idea

9. • Host of attempting a DoS attack targeted at a server
residing in
• by using a forged source IP belonging to
Route-based detection and
discarding of spoofed IP packet
Simple idea illustrated

10. • If knows the route topology, then it will recognize
that a packet from to would not enter through
link ( , )
• So the source address must be spoofed
• Spoofed packets are discarded at , protect
Route-based detection and
discarding of spoofed IP packet
Simple idea illustrated

11. • only need to inspect the source IP address to
determine no packet “from ” can arrive link ( , )
• The model is somehow imprecise:
• There are multiple edges between ASes
• Different paths
• Ignoring in-domain routing
Route-based detection and
discarding of spoofed IP packet
Advantages and imprecisions

12. • However, if host of attempting a DoS attack targeted
at a server residing in
• by using a forged source IP belonging to
• Then can do nothing
Route-based detection and
discarding of spoofed IP packet
Single deployment achieves little

13. i) Maximize proactive filtering of spoofed IP packets
ii) If some bogus packets do get through, minimize the number of
sites that could have sent the packets (for IP trackback)
iii) Achieve i) and ii) while minimizing # of sites at which route-based
filtering is carried out
iv) in tandem with iii), find the optimum sites where filtering is to be
performed
Route-based detection and
discarding of spoofed IP packet
Objectives

14. Maximal and semi-maximal filters
Formalization
• Undirected graph : Internet AS topology
• : all loop-free paths from to
• : computed routes,
• : an IP packet
• If : multiple paths
G = (V, E)
L(u, v)
R(u, v) L(u, v)R(u, v)
u v
M(u, v) s t
|R(s, t)| > 1

15. Maximal and semi-maximal filters
Formalization
• , map function, for linkFe : V 2
{0, 1} e = (u, v) E
Fe(s, t) = 0
Fe(s, t) = 1
• Call a route-based packet filter with respect to if
• here denotes that link is on some path
belonging to
Fe R
Fe(s, t) = 0, e R(s, t)
e R(s, t) e
R(s, t)

16. Maximal and semi-maximal filters
Maximal filters
• A route-based filter is maximal,
• if it satisfies
• if and only if
• Thus a maximal route-based filter can filter all spoofed IP
traffic, without affecting routing of non-spoofed IP
packets determined by
Fe(s, t) = 0
f R(s, t), e f
R

17. Maximal and semi-maximal filters
Maximal filters
• But computing a maximal route-based filter requires in
general space, which is unacceptableO(n2
), n = |V |

18. Maximal and semi-maximal filters
Semi-maximal filters
• A semi-maximal filter is a maximal filter which uses only
the source IP address to perform filtering
• i.e. and is a projection of :Fe : V 2
{0, 1} Fe Fe
• A semi-maximal filter requires linear space
Fe(s, t) =
0, if e R(s, v) for some v V
1, otherwise

19. Performance Measures for DPF
Notations
• Notations:
• : nodes where filtering is performed
• : coverage ratio
• Two key performance metrics
• proactive: the fraction of AS’s from which no spoofed IP
packet can reach its target wherever it may be, denoted
by
• reactive: the fraction of AS’s which upon receiving a
spoofed IP packet can localize its true source within
T V
= |T|/|V |

20. Performance Measures for DPF
Two key performance metrics
• proactive
• the fraction of AS’s from which no spoofed IP packet
can reach its target wherever it may be
• denoted by
• reactive
• the fraction of AS’s which upon receiving a spoofed IP
packet can localize its true source within sites
• denoted by 1( )
2(1)

21. • : the set of nodes that an attacker at AS can use as
spoofed source IP addresses to reach without being
discarded by filters in
• i.e. defined from the attacker’s perspective
• : the set of nodes that could have sent an packet
with spoofed source IP address and destination address
which didn’t get filtered on its way
• i.e. defined from the victim’s perspective
Sa,t
T
a
t
Cs,t M(s, t)
s t
Performance Measures for DPF
Two more high-level performance measures

22. Performance Measures for DPF
Illustration
• Without route-based filtering, an attacker residing can
disguise himself with IP addresses belonging to ~
• i.e. S1,9 = {0, 1, · · · , 8}

23. Performance Measures for DPF
Illustration
• With route-based filtering at , are no
more spoofable
• i.e. S1,9 = {0, 1, · · · , 5}
F

24. Performance Measures for DPF
Illustration
• With route-based filtering at ,
are no more spoofable
• i.e. S1,9 = {1, 2}
F F

25. •
• then measures the fraction of attack sites from
which sending spoofed IP packets targeted at other AS’s
is futile
Performance Measures for DPF
Proactive filtering measures
2( ) =
|{a : t V, |Sa,t| }|
n
2(1)
1( ) =
|{t : a V, |Sa,t }|
n

26. •
• e.g. represents the fraction of AS’s which when
attacked with an arbitrary spoofed IP packet, can resolve
the attack location to within 5 possible attack sites
Performance Measures for DPF
Reactive filtering measure
1( ) =
|{t : s V, |Cs,t| }|
n
1(5)

27. metric and
evaluation 3On the Effectiveness of
Route-Based Packet Filtering for
Distributed DoS Attack Prevention
in Power-Law Internets

28. • Formally, a route-based (semi)maximal distributed filter
is a triple
• is the AS graph
• where the route-based filter is performed
• is the routing algorithm
• Evaluating the effectiveness of with respect to the
proactive and reactive performance measures
• i.e. the dependence on
Performance evaluation
Overview
F
F = < G, T, R >
G = (V, E)
T V
R
F
G, T, R

29. • Tools set
• Dataset
• 1997–1999 Internet AS topologies taken from NLANR
• i.e. power-law network topology
• Artificial Internet topologies
Performance evaluation
Set-up

30. • How to choose nodes?
• How about sample from uniformly randomly until the
target coverage size is reached?
• Power-law graphs have “centers”, so, finding vertex cover
(VC) may achieve a small coverage ratio
Performance evaluation
Set-up
|T|
V

31. • Finding a minimalVC in a graph is an NP-C problem
• Use two approximation algorithms to find smallVCs, and
the minimumVC found by the two algorithms is
Performance evaluation
determining
T
T

32. • measures the fraction of attack sites from which
sending spoofed IP packets targeted at other AS’s is futile
• Thus it is an upper bound on the distributedness of
DDoS attacks
Proactive filtering and DDoS
2(1)

33. • represents the fraction of AS’s which when
attacked with an arbitrary spoofed IP packet, can resolve
the attack location to within possible attack sites
Reactive filtering effect
1( )

34. Maximal vs. semi-maximal filters
1( ) 2(1)

35. • This paper: Park, K., & Lee, H. (2001). On the effectiveness of route-based
packet filtering for distributed DoS attack prevention in power-law internets.
Presented at the SIGCOMM '01: Proceedings of the 2001 conference on
Applications, technologies, architectures, and protocols for computer
communications, ACM Request Permissions. doi:
10.1145/383059.383061
• Wikipedia,“vertex cover”, http://en.wikipedia.org/wiki/Vertex_cover
References

36. Thank you.
谢谢。)