QueryFlood DoS Attacks In Gnutella培训教程文件.pptVIP

Query-Flood DoS Attacks In Gnutella Neil Daswani and Hector Garcia-Molina Stanford University Department of Computer Science Problem Approach Problem Gnutella: multiplicative query broadcast Application-layer denial-of-service Approach Load balancing / provide fairness How does Gnutella Work? Super-nodes Messages Ping / Pong Query / QueryHit Push Already Seen Time To Live File X-fer: HTTP Questions Which queries to drop? Traffic management policies? Effect of topology? How is “damage” distributed?= Need Traffic Model Metrics Gnutella Traffic Model Discrete-event Only super-nodes explicitly modeled Only queries are modeled q=(origin,ttl) Max capacity: C = 6 queries / time unit Gnutella Traffic Model Local Work ={q1,q2,q3} Gnutella Traffic Model Local Work ={q1,q2,q3} Remote Work = {q4,…,q9} ? {q10,q11} Gnutella Traffic Model Local vs. Remote Work: Reservation Ratio (?) Remote Work: How many? (IAS) Which ones? (DS) Gnutella Traffic Model Local Work ={q1,q2,q3} Remote Work = {q4,…,q9} ? {q10,q11} Local Work Accepted = {q1} Remote Work Accepted = IB,A(1)={q4,q5} IC,A(1)={q10,q11} Gnutella Traffic Model Local Work ={q1,q2,q3} Remote Work = {q4,…,q9} ? {q10,q11} Local Work Accepted = {q1} Remote Work Accepted = IB,A(1)={q4,q5} IC,A(1)={q10,q11} Work Broadcasted ={q1,q4,q5,q10,q11} Reservation Ratio (?) Only used in high load situations. Max ?C queries from local peers. Max (1-?)C queries from remote peers. If ?=1/3 and C=6, ?C=(1/3)(6)=2 Local Incoming Alloc. Strategy (1-?)C=(4/6)(6)=4 Remote IAS Possibilities: Fractional:2 from B2 from C Weighted:3 from B1 from C Drop Strategy Drop Strategy Drop Strategy Drop Strategy Drop Strategy Drop Strategy Good Malicious Nodes Good nodes: ? = ?   ? = 1/3  In general, for symmetric networks: ? = 1 / (D(?) + 1) Malicious nodes: ?m = 1 Damage  Service Guarantee: Sj(t), Sj(t) Damage for node j (at time t): Dj(t) = (Sj(t) – Sj(t)) / Sj(t) Cumulative Network Damage:D(t) = “bad” queri