In distributed reflective denial-of-service (DRDoS) attacks, adversaries send requests to public servers (e.g., open recursive DNS resolvers) and spoof the IP address of a victim. These servers, in turn, flood the victim with valid responses and – unknowingly – exhaust its bandwidth. Recently, attackers launched DRDoS attacks with hundreds of Gb/s bandwidth of this kind. While the attack technique is well-known for a few protocols such as DNS, it is unclear if further protocols are vulnerable to similar or worse attacks. In this paper, we revisit popular UDP-based protocols of network services, online games, P2P filesharing networks and P2P botnets to assess their security against DRDoS abuse. We find that 14 protocols are susceptible to bandwidth amplification and multiply the traffic up to a factor 4670. In the worst case, attackers thus need only 0.02% of the bandwidth that they want their victim(s) to receive, enabling far more dangerous attacks than what is known today. Worse, we identify millions of public hosts that can be abused as amplifiers. We then analyze more than 130 real-world DRDoS attacks. For this, we announce bait services to monitor their abuse and analyze darknet as well as network traffic from large ISPs. We use traffic analysis to detect both, victims and amplifiers, showing that attackers already started to abuse vulnerable protocols other than DNS. Lastly, we evaluate countermeasures against DRDoS attacks, such as preventing spoofing or hardening protocols and service configurations. We shows that carefully-crafted DRDoS attacks may evade poorly-designed rate limiting solutions. In addition, we show that some attacks evade packet-based filtering techniques, such as port-, contentor length-based filters.

Amplification Hell: Revisiting Network Protocols for DDoS Abuse

This paper presents the design, implementation, analysis, and experimental evaluation of speak-up, a defense against application-level distributed denial-of-service (DDoS), in which attackers cripple a server by sending legitimate-looking requests that consume computational resources (e.g., CPU cycles, disk). With speak-up, a victimized server encourages all clients, resources permitting, to automatically send higher volumes of traffic. We suppose that attackers are already using most of their upload bandwidth so cannot react to the encouragement. Good clients, however, have spare upload bandwidth and will react to the encouragement with drastically higher volumes of traffic. The intended outcome of this traffic inflation is that the good clients crowd out the bad ones, thereby capturing a much larger fraction of the server's resources than before. We experiment under various conditions and find that speak-up causes the server to spend resources on a group of clients in rough proportion to their aggregate upload bandwidth. This result makes the defense viable and effective for a class of real attacks.

/pdf/ddos-defense-by-offense-3t0ws63n7x.pdf

DDoS defense by offense

Certain exemplary embodiments comprise a method, which can comprise providing a preferred route for a predetermined block of traffic to a router The predetermined block of traffic can be destined for a predetermined destination The predetermined destination can be coupled to a network via a plurality of routers The preferred route can be adapted to override an initial route

Systems, devices and methods for network routing

Distributed Denial of Service (DDoS) attacks based on Network Time Protocol (NTP) amplification, which became prominent in December 2013, have received significant global attention. We chronicle how this attack rapidly rose from obscurity to become the dominant large DDoS vector. Via the lens of five distinct datasets, we characterize the advent and evolution of these attacks. Through a dataset that measures a large fraction of global Internet traffic, we show a three order of magnitude rise in NTP. Using a large darknet, we observe a similar rise in global scanning activity, both malicious and research. We then dissect an active probing dataset, which reveals that the pool of amplifiers totaled 2.2M unique IPs and includes a small number of "mega amplifiers," servers that replied to a single tiny probe packet with gigabytes of data. This dataset also allows us, for the first time, to analyze global DDoS attack victims (including ports attacked) and incidents, where we show 437K unique IPs targeted with at least 3 trillion packets, totaling more than a petabyte. Finally, ISP datasets shed light on the local impact of these attacks. In aggregate, we show the magnitude of this major Internet threat, the community's response, and the effect of that response.

/pdf/taming-the-800-pound-gorilla-the-rise-and-decline-of-ntp-jiqw5ixssl.pdf

Taming the 800 Pound Gorilla: The Rise and Decline of NTP DDoS Attacks

Many Denial of Service attacks use brute-force bandwidth flooding of intended victims. Such volume-based attacks aggregate at a target's access router, suggesting that (i) detection and mitigation are best done by providers in their networks; and (ii) attacks are most readily detectable at access routers, where their impact is strongest. In-network detection presents a tension between scalability and accuracy. Specifically, accuracy of detection dictates fine grained traffic monitoring, but performing such monitoring for the tens or hundreds of thousands of access interfaces in a large provider network presents serious scalability issues. We investigate the design space for in-network DDoS detection and propose a triggered, multi-stage approach that addresses both scalability and accuracy. Our contribution is the design and implementation of LADS (Large-scale Automated DDoS detection System). The attractiveness of this system lies in the fact that it makes use of data that is readily available to an ISP, namely, SNMP and Netflow feeds from routers, without dependence on proprietary hardware solutions. We report our experiences using LADS to detect DDoS attacks in a tier-1 ISP.

/pdf/lads-large-scale-automated-ddos-detection-system-3yr0x1hq93.pdf

LADS: large-scale automated DDOS detection system

We present a measurement study analyzing DDoS attacks from multiple data sources, relying on both direct measurements of flow-level information, and more traditional indirect measurements using backscatter analysis Understanding the nature of DDoS attacks is critically important to the development of effective counter measures to this pressing problem While much of the community's current understanding of DDoS attacks result from indirect measurements, our analysis suggests that such studies do not give a comprehensive view of DDoS attacks witnessed in today's Internet Specifically, our results suggest little use of address spoofing by attackers, which imply that such attacks will be invisible to indirect backscatter measurement techniques Further, at the detailed packet-level characterization (eg, attack destination ports), there are significant differences between direct and indirect measurements Thus, there is tremendous value in moving towards direct observations to better understand DDoS attacks Direct measurements additionally provide information inaccessible to indirect measurements, enabling us to better understand how to defend against attacks We find that for 70% of the attacks fewer than 50 source ASes are involved and a relatively small number of ASes produce nearly 72% of the total attack volume This suggests that network providers can reduce a substantial volume of malicious traffic with targeted deployment of DDoS defenses

/pdf/analyzing-large-ddos-attacks-using-multiple-data-sources-4xnou0b82b.pdf

Analyzing large DDoS attacks using multiple data sources

In this paper, we present a novel encryption-less algorithm to enhance security in transmission of data packets across mobile ad hoc networks. The paper hinges on the paradigm of multipath routing and exploits the properties of polynomials. The first step in the algorithm is to transform the data such that it is impossible to obtain any information without possessing the entire transformed data. The algorithm then uses an intuitively simple idea of a jigsaw puzzle to break the transformed data into multiple packets where these packets form the pieces of the puzzle. Then these packets are sent along disjoint paths to reach the receiver. A secure and efficient mechanism is provided to convey the information that is necessary for obtaining the original data at the receiver-end from its fragments in the packets, that is, for solving the jigsaw puzzle. The algorithm is designed to be secure so that no intermediate or unintended node can obtain the entire data. An authentication code is also used to ensure authenticity of every packet.

A Novel Multipath Approach to Security in Mobile Ad Hoc Networks (MANETs)

There is a growing number of DDoS attacks on the Internet, resulting in significant impact on users. Network operators today have little access to scientific means to effectively deal with these attacks in real time. The need of the hour is a tool to accurately assess the impact of attacks and more importantly identify feasible mitigation responses enabling real-time decision making. We designed and implemented Reval, a tool that reports DDoS attack impact in real time, scaling to large networks. This is achieved by modeling resource constraints of network elements and incorporating routing information. We demonstrate the usefulness of the tool on two real network topologies using empirical traffic data and examining real attack scenarios. Using data from a tier-1 ISP network (core, access and customer router network) of size in excess of 60000 nodes, Reval models network conditions with close to 0.4 million traffic flows in about 11 seconds, and evaluates a given mitigation deployment chosen from a sample set in about 35 seconds. Besides real-time decision support, we show how the simulator can also be used in longer term network planning to identify where and how to upgrade the network to improve network resilience. The tool is applicable for networks of any size and can be used to analyze other network anomalies like flash crowds.

/pdf/reval-a-tool-for-real-time-evaluation-of-ddos-mitigation-44biqbsyma.pdf

Reval: a tool for real-time evaluation of DDoS mitigation strategies

Several methods and a system for analyzing ordered data using pattern matching over an indefinitely long ordered sequence of rows in a relational database are disclosed. In one embodiment, a method of a server includes receiving an ordered data in a relational database. The method further includes matching a pattern specified in a query on ordered data in a relational database in a single pass in constant space for overlapping mode of results. The method also includes creating an output data in the single pass in constant space for overlapping mode of results based on the matching of the ordered data with the pattern in the relational database query.

Method and system for analyzing ordered data using pattern matching in a relational database

This paper presents a novel encryption-less algorithm to enhance security in transmission of data in networks. The algorithm uses an intuitively simple idea of a 'jigsaw puzzle' to break the transformed data into multiple parts where these parts form the pieces of the puzzle. Then these parts are packaged into packets and sent to the receiver. A secure and efficient mechanism is provided to convey the information that is necessary for obtaining the original data at the receiver-end from its parts in the packets, that is, for solving the 'jigsaw puzzle'. The algorithm is designed to provide information-theoretic (that is, unconditional) security by the use of a one-time pad like scheme so that no intermediate or unintended node can obtain the entire data. A parallelizable design has been adopted for the implementation. An authentication code is also used to ensure authenticity of every packet.

/pdf/a-novel-scheme-for-secured-data-transfer-over-computer-2dlrcr8lom.pdf

Rangarajan Vasudevan

Papers

Analyzing large DDoS attacks using multiple data sources

A Novel Multipath Approach to Security in Mobile Ad Hoc Networks (MANETs)

Reval: a tool for real-time evaluation of DDoS mitigation strategies

Method and system for analyzing ordered data using pattern matching in a relational database

A Novel Scheme for Secured Data Transfer Over Computer Networks