Broadly, denial of service defense mechanisms can be categorized into four strategies [268,25]: detection, prevention, response, and tolerance. Following, a brief review of these strategies.
4.3.1 Protection Techniques
Protection mechanisms attempt to prevent adversaries to perform DoS attacks. In other words, DoS protection mechanisms aim to stop attacks before they actually cause damage. Protection mechanisms include, but not limited to, Packet ltering and proof of work.
Packet Filtering
In order to hide their original IP addresses, DoS attacker rely on spoofed IP ad-dresses. Filtering mechanisms aim to prevent DoS attacks with spoofed source addresses, by verifying the source addresses before providing the service and drop-ping the packets with false source addresses. For example, the CAPTCHA [345] is a
Tool name Employed attacks Trinoo (or Trin00) [154] distributed SYN DoS The Tribe Flood Network
(TFN) [156]
DDoS attack tool, possible attacks: ICMP ood, SYN ood, UDP ood, and Smurf attacks.
Stacheldraht [155] DDoS tool, possible attacks: ICMP ood, SYN ood, UDP ood, and Smurf attacks.
Trinity Flooding attacks like; UDP, fragment, SYN,
RST, ACK, etc.
Shaft [152] packet ooding attack.
Tribe Flood Network 2K (TFN2K) [52]
Complex variant of TFN, possible attacks in-clude ooding as in TFN, and malformed attacks such as in the Teardrop and Land attacks.
MStream [157,105] DDoS tool, it uses spoofed TCP packets.
Agobot and Phatbot possible attacks SYN ood, UDP ood and ICMP ood.
Knight [104]
IRC-based DDoS attack tool, provides SYN at-tacks, UDP ood and an urgent pointer ooder [8].
Table 4.2: DoS/DDoS Tools
technique proposed to combat IP spoong attacks. However, this technique is priate for communications between human user and computer, but it is not appro-priate for communications between computer to computer. Several packet ltering approaches have been developed such as; ingress/egress ltering [170], Route-based ltering [283], source address validity enforcement (SAVE) protocol [239], passport [242], etc.
Proof of Work
This mechanism is proposed to counterbalance resource usage between a client and a server. One important example is the client puzzles technique [216]. Client puzzles counterbalance computational usage between client and server by forcing the client to solve a computational puzzle before attending to request. An attacker attempts to ood the server with a large number of bogus request will suer from solving a huge number of puzzles, causing him to spend a lot of his computational resources.
Similar to the packet ltering technique, the proof of work approach helps for defeating IP spoong attacks. Even though the attacker attempts to send a large number of requests or to ood a large number of bogus solutions to cause the server to waste resources by generating a large number of puzzles or by verifying bogus solutions, this attack is less eective because generation of puzzles and verication of solution are cheap operations. However, proof of work technique is good to defend
against computational (memory and CPU) attacks, but the major weakness of this approach is in defending of bandwidth depletion attacks.
4.3.2 Detection Techniques
It might be not enough to implement only prevention mechanisms to defend DoS attacks, due to the complex nature of DoS attacks. As an important procedure to direct any further actions, is deploying some detection mechanisms. The goal of detection mechanisms is to detect attacks when they occur. Response mechanisms depend on the attack information discovered by detection mechanisms for countering the attack. Some mitigation mechanisms depend on the fact that the attack is ongoing, in order to initiate the mitigation process. Since the attack trac, in most cases, looks very similar to legitimate trac, there is a high risk that the detection mechanism mistakes legitimate trac as attack trac. This is called a false positive which is a very serious concern of DoS attack detection mechanism.
Generally, there are two broad classes of detection techniques for identifying malicious actions. the rst class is called signature-based detection, which is based on some features of attacks. The second class is called anomaly-based detection, which models the behavior of normal trac, and then reports any anomalies.
Signature-based Detection
These mechanisms study the known DoS attacks to identify their unique charac-teristics that dierentiate these attacks from normal user activities, and build a database of known attack characteristics (which are called attack signatures). The signature-based detection mechanism monitors the activity in the network for the presence of these signatures, if there is a match the suspicious activity will be re-moved. In order to maintain a low rate of false-positive alerts, the signatures need to very precise. The major drawback of this approach is that only the known at-tacks can be detected, while new atat-tacks or some variations of old attack will not be detected.
Several signature-based detection approaches have been proposed such as: (1) Bro [288] network IDS, which is a real-time IDS passively monitors the network; (2) Snort [306], the open-source light-weight network IDS and prevention tool; (3) some approaches used spectral analysis of attack ows in order to identify DoS attacks [111, 207, 208]; and (4) in [224] a signature-based detection method was described using Kolmogorov complexity.
Anomaly-based Detection
Rather than proling the signature of known attacks (as signature-based meth-ods do), anomaly-based attack detection mechanisms analyze the normal behavior of legitimate users of the system and aim to detect attacks by identifying signi-cant deviation from the normal behavior. The advantage of this approach over the signature-based detection approach is that anomaly-based mechanisms can discover
previously unseen attacks. However, the change of protocol specication and the variety of user applications make a challenge for the anomaly-based detection. The use of a tight threshold for legitimate behavior may wrongly detect normal behavior as malicious (false positive), while a loose threshold may lead to many attacks go undetected (false negative).
As an examples of anomaly-based detection mechanisms are: MULTOPS [184], D-WARD [269,271] and SIM [289]
4.3.3 Response Mechanisms
The aim of the attack detection mechanisms mentioned above is to isolate the at-tack trac. This should be done in a timely manner, in order to initiate the further actions to counteract the attack. After detecting the attack, usually response mech-anisms are initiated to remove or reduce the attack impact. Response mechmech-anisms include the following techniques:
Filtering and Rate-limiting
This technique uses the characteristics of the suspicious trac provided by detection mechanism to lter or rate-limit attack trac. This technique is considered most practical response since it requires less eorts for implementation. However, the challenge for designing an eective techniques is how to decide the suspicious trac and to nd a good balance between letting some attack trac through and harming some legitimate trac. An examples of these approaches such as: the aggregate-based congestion control (ACC) [253] for controlling high bandwidth aggregates in the network. Another approach is StopIt [243] which is a lter-based DoS defense framework aims to stop the undesired trac intended to a receiver without inicting damage on legitimate hosts sending trac to that receiver.
Attack Source Traceback
When an attack has been detected, an ideal action would be to block the attack trac at its source. Tracing IP packets to its source is not an easy task due to two reasons: (1) IP addresses can be spoofed, and (2) stateless nature of IP rout-ing, where routers usually know only the next hop. The goal of this scheme is to traceback the suspicious trac to the source of attack and then apply the law en-forcement. In order to support the attack source identication, several approaches were proposed. Savage et al. [315] itroduced a probabilistic packet marking (PPM) scheme for tracing back the IP source. Another approach is SPIE (Source Path Isolation Engine) which is proposed by Snoeren et al. [325] to trace individual packets.
Capability
This scheme emerges from the fundamental problem of the Internet with regard to DoS attacks, which is the server has no control over who can send how much to it.
There are several ow control and congestion control mechanisms that have been al-ready implemented. However, the malicious clients can simply ignore the congestion and ow control signals and send trac at the maximum possible rate. Capabil-ity schemes aim to provide mechanisms enable the server to stop such malicious hosts. An example is a Stateless Internet Flow Filter (SIFF) [352] which aims to selectively block undesired ows to reach the server. Trac Validation Architecture (TVA) [353] is another example, which aims to limit the impact of ooding DoS attacks.
4.3.4 Tolerance Mechanisms
Tolerance mechanisms do not rely on the detection techniques and focus on mini-mizing the impact of DoS attacks to provide a better quality of service during the attack. These mechanisms can be categorized into several categories: congestion and policing, fault tolerance and client puzzles.
Congestion and Policing
The congestion mechanisms able to eliminate the eect of bandwidth DoS attacks.
Several proposals were proposed in order to reduce the impact of bandwidth ooding attacks such as the Re-feedback techniques [87] and the NetFence [244].
Fault Tolerance
Fault tolerance mechanisms aim to achieve high availability of the system. As a DoS mitigation mechanism, fault tolerance mechanisms can be implemented by replica-tion of service or multiplicareplica-tion of the resource used by the service. Fault tolerance mechanisms are very eective against DoS attacks, however they are costly to im-plement and there may also be a wasted resources during the non-attack period. As an example for fault tolerance schemes is [262] which proposed a capacity overprovi-sioning mechanism to maintain sucient QoS of the network link during overloading attacks.
Client Puzzles
Client puzzles are usually cryptographic puzzles aim to provide resilience to the servers by counterbalancing resource using between clients and servers. The client is asked to solve a puzzle generated by the server before gaining access to a service.
The concept of client puzzles are rst introduced by Dwork and Naor [164]. Then several proposals [216,163,51,178] have been followed to address the requirements of defense against DoS attacks. In the next section, a brief description of client puzzle mechanisms will be presented.
As this part is limited to the analysis of DoS attack defenses in key establishment protocols. In particular, we focus on ooding attacks that consume the server's computational resources (CPU and memory). Additionally, we limit ourself to those cryptographic protocols that implement cryptographic puzzles as a DoS-resistance mechanism to counterbalance the resource usage between clients and the server, as well as to penalize attackers attempting to ood the server by bogus requests.
As mentioned above, there are several DOS defense mechanisms based on various cryptographic techniques that aim to protect and assist the server from DoS attacks such as resource exhaustion attacks. The following section 4.4 briey introduces cryptographic based DoS defense mechanisms.