Preventing Internet DenialofService with Capabilities防止网络拒绝服务的能力.pptVIP

Anupam Chanda, Khaled Elmeleegy. Comp 629 Preventing Internet Denial-of-Service with Capabilities Tom Anderson, David Wetherall Univ. of Washington Timothy Roscoe Intel Research at Berkeley Paper Summary An approach to prevent DoS attacks Nodes obtain “permission to send” from destination Capabilities Verification points enforce capabilities Suitable for incremental deployment Overview Motivation Related work Proposed solution Conclusion Motivation DoS – flooding limited resource CPU/Memory on hosts, routers, firewalls Anomaly detection Automated response – often shutdown New applications likely to be anomalous “Normal” traffic could be an attack CodeRed virus Related Work Source Address Filtering At network ingress and egress points Prevents spoofing attacks However… Addresses with same n/w prefix can be spoofed Attacks often consist of legitimate packets – hosts under a virus attack IP Traceback Traces the source of the attack Detection rather than prevention Can do post-mortem traceback Marking of IP packets IP Traceback (contd.) Pushback Pushback daemon Monitors traffic pattern Rules to indicate DoS attack Communicates with upstream routers (pushback) Upstream routers drop packets Anomaly Detection Rule-based or statistical techniques Classify traffic as friendly/malicious Malicious traffic detection Install network filters Emails to network administrators Legitimate applications may trigger alerts Application level end-to-end decision making is required Overlay Filtering Traffic rerouted through special nodes Sophisticated analysis and filtering Traffic passed through overlay Adds a secret to the packets Downstream routers check for the secret Similar to capability-based filtering which adds nonce tokens in the capabilities Proposed Solution System’s components Request To Send (RTS) server Used by sources to get tokens to send (capabilities) Verification Points (VP) Perform access control by verifying the existence of a token in the packet VPs are coupled with