Distributed Denial of Service (DDoS) Defending against Flooding-Based DDoS Attacks: A Tutorial Rocky K. C. Chang DDoS Defense by Offense Michael Walfish, Mythili Vutukuru, Hari Balakrishnan, David Karger, and Scott Shenker Presented by Adwait Belsare ( [email_address] ) Suvesh Pratapa ( [email_address] )
If a victim has resources to admit N half open connections, its capacity of processing incoming SYN packets can be modeled as a G/D/INFINITY/N queue where :
G = General arrival process for the SYN packets.
D = Deterministic lifetime of each half-open connection if not receiving the third handshaking message.
Minimal rates of SYN packets to stall TCP servers in SYN flooding attacks WIN system offers better protection against SYN flooding based on maximum lifetimes of half-open connections. 1Mb/s connection is sufficient to stall all three servers with N<= 10,000.
Speak-up aims to protect a server , defined as any network-accessible service with scarce computational resources, from an attacker, defined as an entity that is trying to deplete those resources with legitimate looking requests. Such an assault is called application-level attack.
Application-level attacks are challenging to thwart as the Internet has no robust notion of host identity .
Speak Up offers advantages if following also hold:
No pre-defined clientele.
No human clientele.
Unequal requests or spoofing or smart bots.
Example : Web server.
Design of Speak Up The key idea is to exploit the difference of bandwidth usage between good clients and bad clients. Good clients will receive g/(g+B) of server’s resources. Assuming B>>g, attackers get the advantage.
Theory : In a system with regular service intervals, any client that continuously transmits an ‘E’ fraction of the average bandwidth received by the thinner gets at least an E/2 fraction of service, regardless of how the bad clients time or divide up their bandwidth.
Assumes that requests are served with perfect regularity.
Assumes that good client pays bytes at a constant rate. However, implementation runs on TCP.
Makes no assumptions at all about adversarial behavior. (Strength).