DoS defense evaluation methods influence how well test results predict performance in real deployment. This paper surveys existing approaches and criticizes their simplicity and the lack of realism. We summarize our work on improving DoS evaluation via development of standardized benchmarks and performance metrics. We end with guidelines on efficiently improving DoS evaluation, in the short and in the long term.

/pdf/how-to-test-dos-defenses-d5gefdxw3u.pdf

How to Test DoS Defenses

Cette these presente une nouvelle approche pour l'evaluation quantitative de la securite des systemes informatiques. L'objectif de ces travaux est de definir et d'evaluer plusieurs mesures quantitatives. Ces mesures sont des mesures probabilistes visant a quantifier les influences de l'environnement sur un systeme informatique en presence de vulnerabilites. Dans un premier temps, nous avons identifie les trois facteurs ayant une influence importante sur l'etat du systeme : 1) le cycle de vie de la vulnerabilite, 2) le comportement de la population des attaquants et 3) le comportement de l'administrateur du systeme. Nous avons etudie ces trois facteurs et leurs interdependances et distingue ainsi deux scenarios principaux, bases sur la nature de la decouverte de la vulnerabilite, malveillante ou non. Cette etape nous a permis d'identifier les etats possibles du systeme en considerant le processus d'exploitation de la vulnerabilite et de definir quatre mesures relatives a l'etat du systeme qui peut etre vulnerable, expose, compromis, corrige ou sur. Afin d'evaluer ces mesures, nous avons modelise ce processus de compromission. Par la suite, nous avons caracterise de maniere quantitative les evenements du cycle de vie de la vulnerabilite a partir de donnees reelles issues d'une base de donnees de vulnerabilites pour parametrer nos modeles de maniere realiste. La simulation de ces modeles a permis d'obtenir les valeurs des mesures definies. Enfin, nous avons etudie la maniere d'etendre le modele a plusieurs vulnerabilites. Ainsi, cette approche a permis l'evaluation de mesures quantifiant les influences de differents facteurs sur la securite du systeme.

https://tel.archives-ouvertes.fr/tel-00462530/document

Evaluation quantitative de la sécurité informatique : approche par les vulnérabilités

Quality of service (QoS) is critical for delivering real-time media services (RTMSs). The authors identify a new class of denial-of-service attacks against RTMSs - indirect contention-in-hosts (ICiH). Here, attackers attempt to indirectly degrade RTMS QoS by directing packets at other concurrent services, thereby inducing resource contention between RTMS packets and attack packets in the protocol stack. To analyze such attacks, the authors' operation-trace analysis method formalizes the notion of contention among concurrent services and develops several metrics to quantify ICiH's effects.

DoS Attacks on Real-Time Media through Indirect Contention-in-Hosts

: The main goal of our work was to develop the benchmark suite for evaluation of defenses against distributed denial-of-service (DDoS) attacks. The desired features of the benchmark suite were the following: 1. Realistic topologies, legitimate and attack traffic are represented in the suite 2. A wide variety of attack variants is present in the suite 3. Benchmarks can be used by novice experiments easily 4. There is a common, intuitive and scientifically accurate measure of an attack s impact on network services in any given scenario. This measure is easily obtained by experimenters and can be used to compare effectiveness of diverse defenses.

Benchmarks for Evaluation of Distributed Denial of Service (DDOS)

Denial-of-service (DoS) research community lacks accurate metrics to evaluate an attack's impact on network services, its severity and the effectiveness of a potential defense. We propose several DoS impact metrics that measure the quality of service experienced by end users during an attack, and compare these measurements to application-specific thresholds. Our metrics are ideal for testbed experimentation, since necessary traffic parameters are extracted from packet traces gathered during an experiment.

/pdf/when-is-service-really-denied-a-user-centric-dos-metric-2volxxemy4.pdf

Brett Willson

Papers

When is service really denied?: a user-centric dos metric