Denial of Service Elusion (DoSE): Keeping Clients Connected for Less

Wood, Paul; Gutierrez, Christopher; Bagchi, Saurabh

doi:10.1109/srds.2015.31

Cited by 20 publications

(9 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Previously, the concept about moving target defense is used to protect some targets against remote attacks, for example, moving server's location in cloud applications [8][9][10], moving virtual machine [11] and moving IP address [12]. By moving target in use frequently, the attacker cannot track its target in time and hence cannot initiate remote attacks for the targets.…”

Section: B Moving Target Defensementioning

confidence: 99%

A Novel Moving Target Defense Scheme With Physical Unclonable Functions-Based Authentication

Liu

2022

IEEE Access

View full text Add to dashboard Cite

Recent studies have discovered possible security issues on Supervisory Control and Data Acquisition systems (SCADA) in the critical architecture and focus on developing protection mechanisms on this system. Moving Target Mobile IPv6 Defense II is one of these schemes, in which the node in SCADA system employs the moving target's mobile IPv6 mechanism to solve the possible security problem the attacker targeting the specific node and launching attacks. However, the node in this novel scheme still should need to send update binding message with its new IP address to other nodes, which still possibly causes IP leakage security problem. Hence, in our study, we propose a moving target defense scheme with Physical Unclonable Functions (PUF) based authentication in SCADA system. In our scheme, PUF based authentication scheme ensures the security of the whole IP updating process. Once the nodes finish authentication process, they can perform IP generation mechanism based on unique parameter resulting from PUF outputs. Hence, our proposed scheme can ensure the unique characteristic of our generated IP address and no packet loss in the duration of IP rotation. Compared with other MTD-based schemes, our performance evaluation also shows that our proposed scheme can achieve good security performance in SCADA systems.INDEX TERMS Moving target defense, Physical Unclonable Functions, SCADA.

show abstract

Section: B Moving Target Defensementioning

confidence: 99%

A Novel Moving Target Defense Scheme With Physical Unclonable Functions-Based Authentication

Liu

2022

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Also, proof-of-work puzzles slow down all clients, including the benign ones. e alternative approach (for example, DoSE [8]) is to mitigate the heavy traffic of prospective clients by installing the initial point in a content distribution network (CDN) and expanding the capacity of the network's initial point. Individual nodes in a CDN also require clients to solve puzzles to handle potentially overwhelming requests by clients.…”

Section: Existing Approachesmentioning

confidence: 99%

“…Content distribution networks promise to use a network of low-cost content distribution networks (CDN) as proxies to application servers, relying on the effectiveness of these networks [30]. e model reduces large-scale attacks on target applications [8,31]. Although CDN proxies are a step forward for deploying moving target defenses for small and medium enterprises, they can potentially be a subject of residual resolution attacks.…”

Section: Client Bootstrappingmentioning

confidence: 99%

A Client Bootstrapping Protocol for DoS Attack Mitigation on Entry Point Services in the Cloud

Almohri

Al-Mutawa

Alawadh

et al. 2020

Security and Communication Networks

View full text Add to dashboard Cite

This paper presents a client bootstrapping protocol for proxy-based moving target defense system for the cloud. The protocol establishes the identity of prospective clients who intend to connect to web services behind obscure proxy servers in a cloud-based network. In client bootstrapping, a set of initial line of defense services receive new client requests, execute an algorithm to assign them to a proxy server, and reply back with the address of the chosen proxy server. The bootstrapping protocol only reveals one proxy address to each client, maintaining the obscurity of the addresses for other proxy servers. Hiding the addresses of proxy servers aims to lower the likelihood that a proxy server becomes the victim of a denial-of-service (DoS) attack. Existing works address this problem by requiring the solution of computationally intensive puzzles from prospective clients. This solution slows the progression of attacks as well as new clients. This paper presents an alternative idea by observing that limited capacity of handling initial network requests is the primary cause of denial-of-service attacks. Thus, the suggested alternative is to utilize cost-effective high-capacity networks to handle client bootstrapping, thus thwarting attacks on the initial line of defense. The prototype implementation of the protocol using Google’s firebase demonstrates the proof of concept for web services that receive network requests from clients on mobile devices.

show abstract

“…Another approach uses overlay-based reactive proxies to hide the end-host or application server during end-to-end communication. [23][24][25] This architecture forwards each of the incoming connections of authenticated/ authorized users to one of the secret active proxies to serve the user's requests. When the system is under attack, the affected clients are moved to newly created proxies to avoid any further degradation due to the DDoS attack.…”

Section: Related Workmentioning

confidence: 99%

Proactive routing mutation against stealthy Distributed Denial of Service attacks: metrics, modeling, and analysis

Duan

Al-Shaer

Chatterjee

et al. 2017

Journal of Defense Modeling & Simulation

View full text Add to dashboard Cite

Infrastructure Distributed Denial of Service (IDDoS) attacks continue to be one of the most devastating challenges facing cyber systems. The new generation of IDDoS attacks exploits the inherent weakness of cyber infrastructure, including the deterministic nature of routing, skewed distribution of flows, and Internet ossification to discover the network critical links and launch highly stealthy flooding attacks that are not observable at the victim's end. In this paper, first, we propose a new metric to quantitatively measure the potential susceptibility of any arbitrary target server or domain to stealthy IDDoS attacks, and estimate the impact of such susceptibility on enterprises. Second, we develop proactive route mutation techniques to minimize the susceptibility to these attacks by dynamically changing the flow paths periodically to invalidate the adversary knowledge about the network and avoid targeted critical links. Our proposed approach actively changes these network paths while satisfying security and Quality of Service requirements. We implemented the proactive path mutation technique on a Software Defined Network using the OpenDaylight controller to demonstrate a feasible deployment of this approach. Our evaluation validates the correctness, effectiveness, and scalability of the proposed approaches.

show abstract

Denial of Service Elusion (DoSE): Keeping Clients Connected for Less

Cited by 20 publications

References 12 publications

A Novel Moving Target Defense Scheme With Physical Unclonable Functions-Based Authentication

A Novel Moving Target Defense Scheme With Physical Unclonable Functions-Based Authentication

A Client Bootstrapping Protocol for DoS Attack Mitigation on Entry Point Services in the Cloud

Proactive routing mutation against stealthy Distributed Denial of Service attacks: metrics, modeling, and analysis

Contact Info

Product

Resources

About