High-Potency Models of LDoS Attack Against CUBIC + RED

Abstract

A TCP-targeted low-rate denial of service (LDoS) attack exploits the vulnerabilities of TCP congestion control mechanism. The most widely used TCP congestion control algorithm, CUBIC, increases the resilience to LDoS. This paper explores high-potency patterns of LDoS attacks against CUBIC TCP under the RED queue management scenario, and develops two attack models, the D-and Smodels to maximize attack potency (i.e., the damage-to-cost ratio). Theoretical analyses and extensive experiments are conducted to validate the proper function of the models and evaluate their performance. Test results show that the models can effectively throttle CUBIC TCP throughput. Under standard-configured network parameters, one attack unit can damage up to about 21 and 26 TCP units for the D-and S-models, respectively, which represents an increase in attack potency about 20%. The attack potencies of our proposed models are at least 250% greater than that of the traditional attack model. In addition, with variations in different network parameters, these two models are still efficient and alternatively maximize the attack potency. Finally, attack countermeasures are outlined. The present study offers a basis to explore new attack manners which may be exploited by attackers and inspires researchers to develop new measurements against such attack.

CCS: A Cross-Plane Collaboration Strategy to Defend Against LDoS Attacks in SDN

“…Yue et al [26] have developed two LDoS attack models that effectively limit TCP throughput and improve attack potency, urging the defenders to develop corresponding methods from the perspective of attack and defense game. Cao et al [20] used LDoS attack pulse flow to destroy the shared link in the control path and data path, causing the delay of the control flow and > REPLACE THIS LINE WITH YOUR MANUSCRIPT ID NUMBER (DOUBLE-CLICK HERE TO EDIT) < indirectly affecting the core services of SDN.…”

“…12. The influence factor of control flow transmission capability SDN architecture with in-band deployment [26] has attracted an increasing number of attention due to its positive flexibility and economic deployment. However, in the SDN with in-band control [51] [52], the control flow and data flow share a physical link for forwarding.…”