WebSOS: protecting web servers from DDoS attacks

Abstract

We present the WebSOS architecture, a mechanism for countering denial of service (DoS) attacks against web servers. WebSOS uses a combination of overlay networking, contentbased routing, and aggressive packet filtering to guarantee access to a service that is targeted by a DoS attack. Our approach requires no modifications to servers or browsers, and makes use of the web proxy feature and TLS client authentication supported by modern browsers.We use a WebSOS prototype to conduct a preliminary performance evaluation both on the local area network and over the Internet using PlanetLab, a testbed for experimentation with network overlays. We determine the end-to-end latency imposed by the architecture to increase by a factor of 5 on average. We conclude that this overhead is reasonable in the context of a determined DoS attack.

A holistic approach to service survivability

“…An example is a database that maintains timely or confidential information such as building structure reports, intelligence, assignment updates, or strategic information. SOS assumes that there is a pre-determined subset of clients scattered throughout the wide-area network who require (and should have) access to this information, although more recent work [24] somewhat relaxes this requirement.…”

“…Attacks against the SOS infrastructure itself only cause a temporary disruption of communication, on the order of 10 seconds; furthermore, they must persist --otherwise the overlay will recover from component failures and re-integrate them seamlessly. More details can be found in [40,24,41]. …”

Provider-based deterministic packet marking against distributed DoS attacks

“…The approach in Cook et al (2003) and Keromytis et al (2002) uses an overlay network to forward packets from nodes that have proven their legitimacy, whereas traffic from all other nodes are filtered.…”

AID: A global anti-DoS service

“…Using the web proxy feature and TLS, it requires no modification to web browsers and web servers. However, the first version [19] continued assuming a group of trusted clients, each having a public key certificate from the WebSOS administrator. The second version [20] attempted to solve this problem by using Graphic Turing Tests to separate human users from automated attackers.…”