EAGER: Subtle and Harmful: Millisecond-scale Viral Denial of Service (VDoS) Attacks

病毒性拒绝服务（Viral Denial of Service，VDoS）攻击是一类新型攻击，会影响面向Web的使命关键型服务的服务质量（Quality of Service，QoS）要求。这些攻击利用毫瓶颈，毫瓶颈是非常短的持续时间的资源饱和条件，其导致在这些服务所使用的n层应用程序中的相互依赖的组件之间的资源的累积延迟。攻击者可以通过增加作业请求的提交速率（从服务提供商的角度来看的到达速率）或通过降低作业处理速率（通过提交资源密集型作业）来发起此攻击。由于VDoS攻击的持续时间非常短（几毫秒的量级），它们可以保持在传统拒绝服务攻击的典型监视工具的检测阈值以下，因此是微妙和隐蔽的。尽管如此，它们仍有可能造成重大损害。例如，亚马逊报告说，页面加载时间每增加100毫秒，销售额就会减少1%;谷歌要求99%的查询在500毫秒内完成。该项目将调查VDoS攻击的性质和模式，并开发缓解工具来帮助打击它们。 研究生和本科生都将参与这项研究。VDoS实验数据集以及与进行VDoS相关实验相关的工具集将被公开发布。该项目将沿着两项任务。首先，将进行大规模的实验，以评估各种控制参数之间的相互作用的VDOS攻击。这部分研究将确定VDOS攻击如何发生，其外部表现是什么，以及如何对其进行数学建模，以便充分探索攻击粒度和破坏潜力之间的权衡。 其次，基于通过第一项任务获得的知识，将开发检测方法和工具，以在测试平台上再现和/或评估已知的毫秒级VDOS攻击，并发现新的攻击。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Viral Denial of Service (VDoS) attacks are a new class of attacks that affect the quality of service (QoS) requirements of mission critical web-facing services. These attacks exploit milli-bottlenecks, which are resource saturation conditions of very short duration that result in accumulated queueing delay for resources among inter-dependent components in the n-tier applications used by such services. The attacker can launch this attack by either increasing the rate of submission of job requests (rate of arrival from the service provider's perspective) or by decreasing the rate of job processing (by submitting jobs that are resource intensive). Owing to the very short duration of VDoS attacks (of the order of several milliseconds), they can remain below the detection threshold of typical monitoring tools for traditional denial of service attacks and are, consequently, subtle and stealthy. Nonetheless, they have the potential to cause significant damage. For example, Amazon reported that every 100ms increase in a page load time is correlated to a decrease in sales by 1%; Google requires 99% of its queries to finish within 500ms. This project will investigate the nature and modalities of VDoS attacks and develop mitigation tools to help combat them. Students at both graduate as well as undergraduate levels will be involved in the research. VDoS experimental data sets as well as tool-sets related to conducting VDoS related experiments will be publicly released.The project will proceed along two tasks. First, large-scale experiments will be conducted to evaluate the interactions among the various control parameters of VDoS attacks. This part of the study will identify how VDoS attacks occur, what their external manifestations are and how they can be mathematically modeled such that the tradeoffs between the granularity of attack and damage potential can be fully explored. Second, based on the knowledge acquired through the first task, detection methods and tools will be developed to reproduce and/or evaluate known millisecond-scale VDoS attacks on a testbed and find new ones. This will then lead to mitigation tools for combating VDoS attacks.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.