Stable Availability under Denial of Service Attacks through Formal Patterns

Abstract

Abstract. Availability is an important security property for Internet services and a key ingredient of most service level agreements. It can be compromised by distributed Denial of Service (DoS) attacks. In this work we propose a formal pattern-based approach to study defense mechanisms against DoS attacks. We enhance pattern descriptions with formal models that allow the designer to give guarantees on the behavior of the proposed solution. The underlying executable specification formalism we use is the rewriting logic language Maude and its real-time and probabilistic extensions. We introduce the notion of stable availability, which means that with very high probability service quality remains very close to a threshold, regardless of how bad the DoS attack can get. Then we present two formal patterns which can serve as defenses against DoS attacks: the Adaptive Selective Verification (ASV) pattern, which enhances a communication protocol with a defense mechanism, and the Server Replicator (SR) pattern, which provisions additional resources on demand. However, ASV achieves availability without stability, and SR cannot achieve stable availability at a reasonable cost. As a main result we show, by statistical model checking with the PVeStA tool, that the composition of both patterns yields a new improved pattern which guarantees stable availability at a reasonable cost.

Quantitative Analysis of Consistency in NoSQL Key-Value Stores

“…There is other recent work on rewriting logic-based analysis of cloud computing systems, including, e.g., [25], which formalizes RAMP transactions and their extensions and optimizations in rewriting logic and performs model checking verification of key properties using the Maude tool; [21,22], which uses Maude and Real-Time Maude to define a formal model of Google's widely-replicated data store Megastore (a hybrid between a NoSQL store and a relational database) and to develop an extension of Megastore. These models were simulated for QoS estimation and model checked for functional correctness; [36], which formally models and analyzes availability properties of a ZooKeeper-based group key management service; [18], which proposes and analyzes DoS resilience mechanisms for cloud-based systems; [42], which gives formal semantics to the KLAIM language and uses it to specify and analyze cloud-based architectures;…”

Statistical Model Checking of e-Motions Domain-Specific Modeling Languages

“…VeStA and PVeStA have been used for the analysis of systems and algorithms by different authors (see, e.g., [1,16,8]). …”

“…With this schedulerbased scheme, having a single message in the initial configuration, rules with one object and a message in its left-hand sides, and no two rules for the same message, are a sufficient condition to meet the requirement. Eckhardt et al relaxed the requirements on systems in [16] by allowing nested configurations of objects. The basic idea is however the same one, if every rule is going to be fired by a message, this message determines the rule match, and there is only one message out of the scheduler at a time, there is only one rule that may be fired and in one possible way.…”

The SCEL Language: Design, Implementation, Verification

“…As usual (especially in the Maude context, e.g. [6,11,2,25]), in order to perform statistical analysis it is necessary to obtain probabilistic behaviours out of non-deterministic ones by resolving non-determinism in probabilistic choices. For this reason, we defined a Java wrapper for MISSCEL together with a set of external schedulers which permit to obtain probabilistic simulations of SCEL specifications, which can then be exploited by MultiVeStA to perform statistical model checking.…”

“…Moreover, we do not consider other sophisticated features of SCEL such as higher-order communication and dynamic creation of new names and components. We present below the key points of the translation from SCEL to Promela by resorting to the robotics scenario 25 . The translation is defined by a family of functions · , whose formal definitions are given in [23].…”