ITR: Modeling Distributed Denial of Service Attacks and Defenses

ITR：分布式拒绝服务攻击和防御建模

• 批准号: 0218466
• 负责人: Kathleen Carley
• 金额: $ 22.3万
• 依托单位: Carnegie-Mellon University
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2002
• 资助国家: 美国
• 起止时间: 2002-10-01 至 2007-09-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0218466&HistoricalAwards=false
• 关键词: ITR; Modeling; Distributed; Denial; Service

Distributed denial of service (DDOS) attacks have emerged as a prevalent way to take down web sites and have imposed financial losses to companies. The CSI/FBI survey (CSI 2001) shows that 36% of respondents in the last 12-months period have detected denial of service, which imposed more than $4.2 million financial losses. The effectiveness of DDOS defenses depends on many factors such that the nature of the network's topology, the specific attack scenario, and various characteristics of the network routers. However, little research has focused on the tradeoffs inherent in this complex system. The researchers are developing a computational testbed to study security policies and the associated technologies that provide defenses against DDOS attacks. The researchers are using this framework to evaluate various policies and technologies. Out model and the ensuing analyses are informed by research in the areas of computer science, information science, organizational theory and social networks.There have been a number of proposals on how to control the on-going DDOS attack traffic. None have been widely deployed. The effectiveness of DDOS defenses depends on many factors, such as the type of network topology, the type of attacks and whether all ISPs are compliant in establishing defenses. However, little is known about the interactions among these factors. Knowing what tradeoffs will occur as these factors vary will enable stakeholders to make more informed security policy decisions in which they adjust for the chance that others may not make the same decisions. Our research illuminates these tradeoffs. Moreover, the computational model the researchers are building enables the user to examine the tradeoffs associated with various DDOS defenses and attack scenarios at the router level.The researchers focus on two basic research questions. First, how do ISPs provide DDOS defenses at the lowest cost while their subscribers remain satisfied with the availability of network connections during attacks? A cost-performance analysis of the effectiveness of DDOS defenses is being conducted using results from the computational model. This cost-performance analysis will aid ISPs and local network administrators in their evaluation of DDOS defenses. Second, the researchers ask where are the critical points in a network to deploy defenses? The researchers examine the impact of network topology on the deployment location of defenses. Graph level indices and models from social network studies will be used to categorize network topologies and to select deployment locations for defenses. This analysis will provide guidance to decision makers.Benefits of this work research include: The policy framework the researchers are developing will help ISPs and subscribers to consider the benefits of providing DDOS defenses and to realize the tradeoffs in DDOS defenses. Results from this study will enable decision makers to make more informed security policy decisions for computer networks. It is costly and unethical to conduct real world experiments of DDOS attacks on large networks. This research will provide a cost effective and ethical means for evaluating various attack scenarios and defenses. Further, topological measures developed in this research should be useful for studies of other large-scale topologies. As such, this work extends social network measures typically used on small person-to-person networks to large-scale computer networks. Finally, this research provides a theoretical basis for evaluating DDOS defenses building on interdisciplinary studies from the fields of computer science, information science, organizational theory and social network analysis.

分布式拒绝服务（DDOS）攻击已经成为一种流行的方式来关闭网站，并给公司带来经济损失。CSI/FBI调查（CSI 2001）显示，在过去12个月内，36%的受访者发现了拒绝服务，造成了420多万美元的经济损失。DDOS防御的有效性取决于许多因素，例如网络拓扑的性质，特定的攻击场景以及网络路由器的各种特性。然而，很少有研究集中在这个复杂的系统中固有的权衡。研究人员正在开发一个计算测试平台，以研究安全策略和相关技术，为DDOS攻击提供防御。 研究人员正在使用这个框架来评估各种政策和技术。我们的模型和随后的分析受到计算机科学、信息科学、组织理论和社交网络领域研究的影响。关于如何控制正在进行的DDOS攻击流量，已经提出了许多建议。没有一个被广泛部署。DDOS防御的有效性取决于许多因素，例如网络拓扑的类型，攻击的类型以及是否所有ISP都符合建立防御的要求。然而，人们对这些因素之间的相互作用知之甚少。了解随着这些因素的变化会发生什么样的权衡，将使利益相关者能够做出更明智的安全策略决策，在这些决策中，他们会根据其他人可能不会做出相同决策的机会进行调整。我们的研究阐明了这些权衡。此外，研究人员正在构建的计算模型使用户能够在路由器级别检查与各种DDOS防御和攻击场景相关的权衡。研究人员专注于两个基本研究问题。首先，ISP如何以最低的成本提供DDOS防御，而他们的用户在攻击期间仍然对网络连接的可用性感到满意？DDOS防御的有效性的成本性能分析正在进行使用计算模型的结果。这种成本性能分析将帮助ISP和本地网络管理员评估DDOS防御。其次，研究人员问，网络中部署防御的关键点在哪里？ 研究人员研究了网络拓扑对防御部署位置的影响。社交网络研究的图级索引和模型将用于对网络拓扑进行分类，并选择防御部署位置。这项研究的好处包括：研究人员正在开发的政策框架将帮助ISP和用户考虑提供DDOS防御的好处，并实现DDOS防御的权衡。这项研究的结果将使决策者能够为计算机网络做出更明智的安全策略决策。在大型网络上进行DDOS攻击的真实的世界实验是昂贵且不道德的。这项研究将为评估各种攻击场景和防御提供一种具有成本效益和道德的方法。此外，在这项研究中开发的拓扑措施应该是有用的其他大规模拓扑结构的研究。因此，这项工作将通常用于小型人际网络的社交网络措施扩展到大型计算机网络。最后，本研究从计算机科学、信息科学、组织理论和社会网络分析等多个领域，为评估DDOS防御提供了理论基础。