SIBRA: Scalable Internet Bandwidth Reservation Architecture

Băsescu, Cristina; Reischuk, Raphael M.; Szałachowski, Paweł; Perrig, Adrian; Zhang, Yao; Hsiao, Hsu-Chun; Kubota, Ayumu; Urakawa, Jumpei

doi:10.14722/ndss.2016.23132

Cited by 34 publications

(29 citation statements)

References 49 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Moreover, by design, the temporal pattern of the CICADAS attack is observable only at the target link, thereby rendering the redirection-based cloud traffic scrubbing service unusable. To mitigate such a stealthy DDoS attack, there needs to be support for DDoS-resilient Internet architectures [5] and efficient flow monitoring algorithms running at each router. However, none of these is easy to do with respect to design and deployment.…”

Section: Discussionmentioning

confidence: 99%

Cicadas

Chen

Hsiao

et al. 2016

Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security

Self Cite

View full text Add to dashboard Cite

This study stems from the premise that we need to break away from the "reactive" cycle of developing defenses against new DDoS attacks (e.g., amplification) by proactively investigating the potential for new types of DDoS attacks. Our specific focus is on pulsating attacks, a particularly debilitating type that has been hypothesized in the literature. In a pulsating attack, bots coordinate to generate intermittent pulses at target links to significantly reduce the throughput of TCP connections traversing the target. With pulsating attacks, attackers can cause significantly greater damage to legitimate users than traditional link flooding attacks. To date, however, pulsating attacks have been either deemed ineffective or easily defendable for two reasons: (1) they require a central coordinator and can thus be tracked; and (2) they require tight synchronization of pulses, which is difficult even in normal non-congestion scenarios.This paper argues that, in fact, the perceived drawbacks of pulsating attacks are in fact not fundamental. We develop a practical pulsating attack called CICADAS using two key ideas: using both (1) congestion as an implicit signal for decentralized implementation, and (2) a Kalman-filter-based approach to achieve tight synchronization. We validate CI-CADAS using simulations and wide-area experiments. We also discuss possible countermeasures against this attack.

show abstract

Section: Discussionmentioning

confidence: 99%

Cicadas

Chen

Hsiao

et al. 2016

Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security

Self Cite

View full text Add to dashboard Cite

show abstract

“…Defcom nodes share attack information, such the DDoS source IP address, and perform rate limiting. SIBRA [34] provides a bandwidth reservation protocol for the Internet that guarantees resource allocation based on contracts between autonomous systems; thus, minimum bandwidth allocation can be ensured.…”

Section: Novel Ddos Mitigation Techniquesmentioning

confidence: 99%

Pay the Piper: DDoS Mitigation Technique to Deter Financially-Motivated Attackers

Sasaki

Gañán

Yoshioka

et al. 2020

IEICE Trans. Commun.

View full text Add to dashboard Cite

Distributed Denial of Service attacks against the application layer (L7 DDoS) are among the most difficult attacks to defend against because they mimic normal user behavior. Some mitigation techniques against L7 DDoS, e.g., IP blacklisting and load balancing using a content delivery network, have been proposed; unfortunately, these are symptomatic treatments rather than fundamental solutions. In this paper, we propose a novel technique to disincentivize attackers from launching a DDoS attack by increasing attack costs. Assuming financially motivated attackers seeking to gain profit via DDoS attacks, their primary goal is to maximize revenue. On the basis of this assumption, we also propose a mitigation solution that requires mining cryptocurrencies to access servers. To perform a DDoS attack, attackers must mine cryptocurrency as a proof-of-work (PoW), and the victims then obtain a solution to the PoW. Thus, relative to attackers, the attack cost increases, and, in terms of victims, the economic damage is compensated by the value of the mined coins. On the basis of this model, we evaluate attacker strategies in a game theory manner and demonstrate that the proposed solution provides only negative economic benefits to attackers. Moreover, we implement a prototype to evaluate performance, and we show that this prototype demonstrates practical performance.

show abstract

“…Many previously proposed capability-based systems are likewise designed to work with a single scheduling policy. For instance, CRAFT [28] enforces per-flow fairness, Portcullis [41] and Mirage [37] enforce per-compute fairness, NetFence [34] enforces per-sender fairness, SIBRA [12] enforces per-steady-bandwidth fairness, and SpeakUp [48] enforces per-outbound-bandwidth fairness. If any of these mechanisms is ever deployed, a single policy will be enforced, forcing the victim to accept the choice made by the defense approach.…”

Section: Middlepolice's Desirable Propertiesmentioning

confidence: 99%

“…PerASFairshare is similar to PerSenderFairshare except that the mbox fairly allocates N total size on a per-AS basis. This policy mimics SIBRA [12], preventing bot-infested ASes from taking bandwidth away from legitimate ASes.…”

Section: Bandwidth Allocation Policiesmentioning

confidence: 99%

See 1 more Smart Citation

MiddlePolice

Liu

Jiang

et al. 2016

Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

Volumetric attacks, which overwhelm the bandwidth of a destination, are amongst the most common DDoS attacks today. One practical approach to addressing these attacks is to redirect all destination traffic (e.g., via DNS or BGP) to a third-party, DDoS-protection-as-a-service provider (e.g., CloudFlare) that is well provisioned and equipped with filtering mechanisms to remove attack traffic before passing the remaining benign traffic to the destination. An alternative approach is based on the concept of network capabilities, whereby source sending rates are determined by receiver consent, in the form of capabilities enforced by the network. While both third-party scrubbing services and network capabilities can be effective at reducing unwanted traffic at an overwhelmed destination, DDoS-protection-as-a-service solutions outsource all of the scheduling decisions (e.g., fairness, priority and attack identification) to the provider, while capability-based solutions require extensive modifications to existing infrastructure to operate. In this paper we introduce MiddlePolice, which seeks to marry the deployability of DDoS-protection-as-a-service solutions with the destinationbased control of network capability systems. We show that by allowing feedback from the destination to the provider, MiddlePolice can effectively enforce destination-chosen policies, while requiring no deployment from unrelated parties.

show abstract

SIBRA: Scalable Internet Bandwidth Reservation Architecture

Cited by 34 publications

References 49 publications

Cicadas

Cicadas

Pay the Piper: DDoS Mitigation Technique to Deter Financially-Motivated Attackers

MiddlePolice

Contact Info

Product

Resources

About