Visible to the public On a Mathematical Model for Low-Rate Shrew DDoS

TitleOn a Mathematical Model for Low-Rate Shrew DDoS
Publication TypeJournal Article
Year of Publication2014
AuthorsJingtang Luo, Xiaolong Yang, Jin Wang, Jie Xu, Jian Sun, Keping Long
JournalInformation Forensics and Security, IEEE Transactions on
Volume9
Pagination1069-1083
Date PublishedJuly
ISSN1556-6013
KeywordsAdaptation models, Attack effect, attack effect estimation, attack pattern, Bandwidth, bottleneck bandwidth, Computer crime, computer network security, delays, Internet, low-rate distributed denial of service (DDoS) attack, low-rate shrew DDoS, Mathematical model, network environments, Packet loss, shrew attack, shrew distributed denial-of-service, TCP congestion window, TCP flows, Throughput, transport control protocol, transport protocols
Abstract

The shrew distributed denial of service (DDoS) attack is very detrimental for many applications, since it can throttle TCP flows to a small fraction of their ideal rate at very low attack cost. Earlier works mainly focused on empirical studies of defending against the shrew DDoS, and very few of them provided analytic results about the attack itself. In this paper, we propose a mathematical model for estimating attack effect of this stealthy type of DDoS. By originally capturing the adjustment behaviors of victim TCPs congestion window, our model can comprehensively evaluate the combined impact of attack pattern (i.e., how the attack is configured) and network environment on attack effect (the existing models failed to consider the impact of network environment). Henceforth, our model has higher accuracy over a wider range of network environments. The relative error of our model remains around 10% for most attack patterns and network environments, whereas the relative error of the benchmark model in previous works has a mean value of 69.57%, and it could be more than 180% in some cases. More importantly, our model reveals some novel properties of the shrew attack from the interaction between attack pattern and network environment, such as the minimum cost formula to launch a successful attack, and the maximum effect formula of a shrew attack. With them, we are able to find out how to adaptively tune the attack parameters (e.g., the DoS burst length) to improve its attack effect in a given network environment, and how to reconfigure the network resource (e.g., the bottleneck buffer size) to mitigate the shrew DDoS with a given attack pattern. Finally, based on our theoretical results, we put forward a simple strategy to defend the shrew attack. The simulation results indicate that this strategy can remarkably increase TCP throughput by nearly half of the bottleneck bandwidth (and can be higher) for general attack patterns.

DOI10.1109/TIFS.2014.2321034
Citation Key6807757