CT-ISG: Pollution Resilience for Internet Caches

CT-ISG：互联网缓存的污染恢复能力

• 批准号: 0627715
• 负责人: Aleksandar Kuzmanovic
• 金额: $ 35万
• 依托单位: Northwestern University
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2006
• 资助国家: 美国
• 起止时间: 2006-09-01 至 2009-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0627715&HistoricalAwards=false
• 关键词: CT; ISG; Pollution; Resilience; Internet

Aleksandar KuzmanovicPollution Resilience for Internet CachesNorthwestern University0627715AbstractThe majority of requests for the Domain Name System (DNS) entries, web, or even peer-to-peer (p2p) content in today's Internet are not served by origin servers, but rather by intermediate caches. As such, they pose an attractive target for malicious attackers. This project will address the problem of cache-targeted DoS attacks on a broad front: (i) by developing and studying a new generation of large-scale cache-targeted pollution attacks, (ii) by designing fundamental knowledge in creating deployable anti-pollution mechanisms, and (iii) by designing and implementing counter-DoS solutions for three imminent threats: web, p2p, and local DNS cache-targeted pollution attacks.The proposed pollution attacks pose a challenging problem for the entire Internet community: (i) they are capable of degrading overall network performance without flooding network resources; (ii) they possess a dangerous level of indirection; (iii) they pollute the cache with unpopular, rather than bogus files; (iv) they may operate at much longer time-scales than classical DoS attacks operate and are thus invisible for state-of-the-art counter-DoS schemes. By leveraging data streaming computation techniques, our goal is to attain a scalable solution by significantly reducing the amount of state needed to maintain, and to make the detection system itself resilient to DoS attacks. The involvement of industrial partners in this project will accelerate the transfer of the research results into operation. In particular, we will collaborate closely with the UltraDNS Corporation which provides DNS services for over 20\% of the world domains, including top-level domains as well as numerous private organizations.

在今天的互联网中，大多数对域名系统（DNS）条目、web甚至点对点（p2p）内容的请求都不是由原始服务器提供的，而是由中间缓存提供的。因此，它们对恶意攻击者来说是一个有吸引力的目标。该项目将在广泛的前沿解决以缓存为目标的DoS攻击问题：(i)通过开发和研究新一代大规模以缓存为目标的污染攻击，（ii）通过设计创建可部署的反污染机制的基础知识，以及（iii）通过设计和实施针对三种迫在眉睫的威胁的反DoS解决方案：web， p2p和本地DNS缓存为目标的污染攻击。提出的污染攻击对整个互联网社区提出了一个具有挑战性的问题：(i)它们能够降低整体网络性能而不会淹没网络资源；（ii）具有危险的间接程度；（iii）使用不受欢迎的文件而非伪造文件污染缓存；（iv）它们的运行时间可能比经典的DoS攻击运行时间长得多，因此对于最先进的反DoS方案来说是不可见的。通过利用数据流计算技术，我们的目标是通过显著减少需要维护的状态量来获得可扩展的解决方案，并使检测系统本身对DoS攻击具有弹性。工业伙伴参与这个项目将加速研究成果的转化。特别是，我们将与UltraDNS公司密切合作，该公司为全球20%以上的域名提供DNS服务，包括顶级域名以及众多私人组织。