Accurate One-Way Delay Estimation: Limitations and Improvements

Vakili, Ahmad; Grégoire, Jean-Charles

doi:10.1109/tim.2012.2190551

Cited by 19 publications

(8 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In real networks, in order to configure the appropriate parameters of Shrew attack, the attacker needs to estimate some network parameters in advance. Fortunately, a number of existing techniques can be used to estimate the bottleneck link capacity [25], [32]- [35], the buffer size [36]- [38], the RTT [39]- [44], and etc.…”

Section: T5''mentioning

confidence: 99%

Low-High Burst: A Double Potency Varying-RTT Based Full-Buffer Shrew Attack Model

Wang

2021

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

The full-buffer Shrew (FB-Shrew) denial of service (DoS) attack is a variant of the classic Shrew attack that exploits the congestion control mechanism of transmission control protocol (TCP). Here, an attacker sends a high-rate burst of attack packets only after the router buffer is filled with TCP packets, causing the router to drop legitimate packets, and forcing the retransmission of TCP packets. As such, an FB-Shrew attack can cause maximum damage with minimum resources. In this paper, we challenge an assumption of constant round trip time adopted in the original FB-Shrew model. As a result, this model fails to achieve its expected attack effect. In response, we analyze the TCP congestion window and queue behaviors to develop two low-high burst models for maximizing the potency of the FB-Shrew attack. Model 1 is designed to achieve the attack effect expected of the original model. Then, the attack potency of Model 1 is enhanced by simply adjusting the starting time of the attack burst to form Model 2. Mode 1 only exploits the retransmission timeout (RTO) mechanism. Model 2 takes advantage of both the RTO mechanism and the fast retransmission mechanism. In this way, Model 2 further slows down the growth of the congestion window and extends the attack period. A combination of theoretical analyses and simulations are adopted to first validate the proper functioning and effectiveness of the two models for a standard network configuration, and then we assess their attack performances with variations in different network parameters. Our performance assessment demonstrates that one attack unit of Model 2 damages almost twice the number of TCP units as one attack unit of Model 1, which represents an increase in attack potency of nearly 200%. The present study provides an expanded basis to explore FB-Shrew attack patterns that may be utilized by attackers. Moreover, the damage that could be inflicted by such attack and the extent to which defense strategies are capable of mitigating the attack's impact could be assessed more precisely by defenders.

show abstract

Section: T5''mentioning

confidence: 99%

Low-High Burst: A Double Potency Varying-RTT Based Full-Buffer Shrew Attack Model

Wang

2021

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

show abstract

“…CONCLUSION Errors due to imperfect clock synchronization among the verifiers can be mitigated as shown in the literature [3], and are thus not considered by the mp's PMF derived herein.…”

Section: Review Of the Minimum Pairs Algorithmmentioning

confidence: 84%

“…Because round-trip times (RTTs) are easier to estimate than OWDs, they are often used instead [3]. Half the RTT is sometimes taken as a OWD estimate; we call this the average (av) algorithm.…”

Section: Introductionmentioning

confidence: 99%

Accurate One-Way Delay Estimation With Reduced Client Trustworthiness

2015

View full text Add to dashboard Cite

Abstract-The requirement for accurate one-way delay (OWD) estimation lead to the recent introduction of an algorithm enabling a server to estimate OWDs between itself and a client by cooperating with two other servers, requiring neither clientclock synchronization nor client trustworthiness in reporting one-way delays. We evaluate the algorithm by deriving the probability distribution of its absolute error, and compare its accuracy with the well-known round-trip halving algorithm. While neither algorithm requires client-trustworthiness nor client clock synchronization, the analysis shows that the new algorithm is more accurate in many situations.

show abstract

“…In lines 20 through 23, the verifiers also use the average (av) protocol, to obtain D av , which is used in Algorithm 1 ( §4) as a fallback if the estimates in D mp result in TIVs [25]. The av protocol simply calculates half the RTTs [44] (lines 21 and 22).…”

Section: The Minimum Pairs Protocol (Mp)mentioning

confidence: 99%

CPV: Delay-Based Location Verification for the Internet

Abdou

Matrawy

Oorschot

2017

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

Abstract-The number of location-aware services over the Internet continues growing. Some of these require the client's geographic location for security-sensitive applications. Examples include location-aware authentication, location-aware access policies, fraud prevention, complying with media licensing, and regulating online gambling/voting. An adversary can evade existing geolocation techniques, e.g., by faking GPS coordinates or employing a non-local IP address through proxy and virtual private networks. We devise Client Presence Verification (CPV), a delay-based verification technique designed to verify an assertion about a device's presence inside a prescribed geographic region. CPV does not identify devices by their IP addresses. Rather, the device's location is corroborated in a novel way by leveraging geometric properties of triangles, which prevents an adversary from manipulating measured delays. To achieve high accuracy, CPV mitigates Internet path asymmetry using a novel method to deduce one-way application-layer delays to/from the client's participating device, and mines these delays for evidence supporting/refuting the asserted location. We evaluate CPV through detailed experiments on PlanetLab, exploring various factors that affect its efficacy, including the granularity of the verified location, and the verification time. Results highlight the potential of CPV for practical adoption.

show abstract

Accurate One-Way Delay Estimation: Limitations and Improvements

Cited by 19 publications

References 24 publications

Low-High Burst: A Double Potency Varying-RTT Based Full-Buffer Shrew Attack Model

Low-High Burst: A Double Potency Varying-RTT Based Full-Buffer Shrew Attack Model

Accurate One-Way Delay Estimation With Reduced Client Trustworthiness

CPV: Delay-Based Location Verification for the Internet

Contact Info

Product

Resources

About