Low-rate TCP-targeted denial of service attacks

Abstract

Denial of Service attacks are presenting an increasing threat to the global inter-networking infrastructure. While TCP's congestion control algorithm is highly robust to diverse network conditions, its implicit assumption of end-system cooperation results in a well-known vulnerability to attack by high-rate non-responsive flows. In this paper, we investigate a class of low-rate denial of service attacks which, unlike high-rate attacks, are difficult for routers and counter-DoS mechanisms to detect. Using a combination of analytical modeling, simulations, and Internet experiments, we show that maliciously chosen low-rate DoS traffic patterns that exploit TCP's retransmission time-out mechanism can throttle TCP flows to a small fraction of their ideal rate while eluding detection. Moreover , as such attacks exploit protocol homogeneity, we study fundamental limits of the ability of a class of randomized time-out mechanisms to thwart such low-rate DoS attacks. A shrew is a small but aggressive mammal that ferociously attacks and kills much larger animals with a venomous bite.

AK-PPM: An Authenticated Packet Attribution Scheme for Mobile Ad Hoc Networks

“…Attack Packet Rate In MANETs, the attack packet rate required to launch DoS or DDoS attacks may be much lower [24]. Firstly, the targeted mobile node is more resource restricted, requiring lower attack packet rate to exhaust its resources (e.g., bandwidth consumption attack).…”

“…In summary, to maximize the usage of allocated space while avoiding insufficient marking, it is recommended that p and K be set according to equation K = p * d est , where d est denotes the estimated path length in a specific MANET. Low Packet Rate γ: the packet rate γ will be small in cases, such as low rate DoS attacks [24], In Figure 6(e) and (f), we show the impact of the attack packet rate on traceability when K = 4 and p = 0.5. For comparison, we also show the simulation result of PPM scheme on the same traces.…”

Adversarial exploits of end-systems adaptation dynamics

“…More importantly, in this paper, we have focused on the harder-to-detect, low-intensity attacks, i.e., with modest aggressiveness compared to the aggressiveness required for DoS attacks. On the other hand, the "shrew" attack proposed in [28] is an example of a low-intensity, harder to detect attack which targets a set of flows to cause them to timeout. Clearly, the scope of shrew attacks is limited to targeting TCP flows which employ the timeout mechanism.…”

HAWK: Halting Anomalies with Weighted Choking to Rescue Well-Behaved TCP Sessions from Shrew DDoS Attacks

“…Unfortunately, while finding effective solutions to combat DoS attacks has baffled researchers for years, an even more detrimental type of network-based attack has recently been identified [3]. This special class of attack is referred to as low-rate TCP-targeted DoS attack or shrew attack [3] that denies bandwidth resources to legitimate TCP flows in a stealthy manner.…”

“…This special class of attack is referred to as low-rate TCP-targeted DoS attack or shrew attack [3] that denies bandwidth resources to legitimate TCP flows in a stealthy manner. Indeed, unlike traditional DoS attacks, which are easy to detect by observing that the victim site is totally unable to respond, a shrew attack is very difficult to detect [3] because the adverse effects on well-behaved network connections are not easily observable.…”