WebSOS: an overlay-based system for protecting web servers from denial of service attacks

Abstract

We present WebSOS, a novel overlay-based architecture that provides guaranteed access to a web server that is targeted by a denial of service (DoS) attack. Our approach exploits two key characteristics of the web environment: its design around a human-centric interface, and the extensibility inherent in many browsers through downloadable "applets." We guarantee access to a web server for a large number of previously unknown users, without requiring pre-existing trust relationships between users and the system, by using Reverse Graphic Turing Tests. Furthermore, our system makes it easy for service providers to charge users, providing incentives to a commercial offering of the service. Users can dynamically decide whether to use the WebSOS overlay, based on the prevailing network conditions. Our prototype requires no modifications to either servers or browsers, and makes use of graphical Turing tests, web proxies, and client authentication using the SSL/TLS protocol, all readily supported by modern browsers. We then extend this system with a credentialbased micropayment scheme that combines access control and payment authorization in one operation. Turing Tests ensure that malicious code, such as a worm, cannot abuse a user's micropayment wallet. We use the WebSOS prototype to conduct a performance evaluation over the Internet using PlanetLab, a testbed for experimentation with network overlays. We determine the end-to-end latency using both a Chord-based approach and our shortcut extension. Our evaluation shows the latency increase by a factor of 7 and 2 respectively, confirming our simulation results.

WDA: A Web farm Distributed Denial Of Service attack attenuator

“…The last class uses overlay networks [18], [35] to defend against DDoS attacks. Only predefined and authorized users are able to enter and use the overlay network.…”

A Denial-of-Service Resistant DHT

“…Secure Overlay Services (SOS) [8], for example, uses a proxy approach based on the Chord network to protect applications against flooding DoS attacks. WebSOS [21] is an implementation of SOS for web servers that makes use of graphical Turing tests, web proxies and client authentication. Mayday [1] generalizes the SOS architecture and analyzes the implications of choosing different filtering techniques and overlay routing mechanisms.…”

Quantifying Resistance to the Sybil Attack

“…We do not investigate how to ensure fees are paid, though many others have done so [7,8,41,42]). We do note that doing so is an easier task than requiring a trusted authority that can certify that each identity is an independent entity; the latter is difficult even with access to real-world documents [1].…”

“…Micropayments [7,8,41,42] can be used to purchase certificates valid for a certain number of minutes or rounds in one or more applications. The seller of such certificates has a much easier task than a certification authority: she does not have to verify the identity of the purchasers, prevent customers from purchasing multiple certificates, or prevent certificates from being transfered.…”

“…For many applications, managing recurring payment of fees is a more reasonable solution. Several distributed, Internet-based micro-payment schemes can manage fees [7,8,41,42]. For applications whose users may be unwilling to make monetary payments, fees can also be imposed less robustly, though perhaps more readily, through the use of non-monetary mechanisms such as CAPTCHAs [43] and SMS messages.…”