Home

A Multilayer Overlay Network Architecture for Enhancing IP Services Availability against DoS

Dimitris Geneiatakis; Georgios Portokalidis; Angelos D. Keromytis

Title:
A Multilayer Overlay Network Architecture for Enhancing IP Services Availability against DoS
Author(s):
Geneiatakis, Dimitris
Portokalidis, Georgios
Keromytis, Angelos D.
Date:
Type:
Articles
Department:
Computer Science
Permanent URL:
Part Number:
7093
Book/Journal Title:
Information Systems Security: 7th International Conference, ICISS 2011, Kolkata, India, December 15-19, 2011: Procedings
Book Author:
Jajodia, Sushil
Publisher:
Springer
Publisher Location:
New York
Abstract:
Protection against Denial of Service (DoS) attacks is a challenging and ongoing problem. Current overlay-based solutions can transparently filter unauthorized traffic based on user authentication. Such solutions require either pre-established trust or explicit user interaction to operate, which can be circumvented by determined attackers and is not always feasible (e.g., when user interaction is impossible or undesirable). We propose a Multi-layer Overlay Network (MON) architecture that does not depend on user authentication, but instead utilizes two mechanisms to provide DoS resistant to any IP-based service, and operates on top of the existing network infrastructure. First, MON implements a threshold-based intrusion detection mechanism in a distributed fashion to mitigate DoS close to the attack source. Second, it randomly distributes user packets amongst different paths to probabilistically increase service availability during an attack. We evaluate MON using the Apache web server as a protected service. Results demonstrate MON nodes introduce very small overhead, while users' service access time increases by a factor of 1.1 to 1.7, depending on the configuration. Under an attack scenario MON can decrease the attack traffic forwarded to the service by up to 85%. We believe our work makes the use of overlays for DoS protection more practical relative to prior work.
Subject(s):
Computer science
Publisher DOI:
http://dx.doi.org/10.1007/978-3-642-25560-1_22
Item views:
75
Metadata:
text | xml

In Partnership with the Center for Digital Research and Scholarship at Columbia University Libraries/Information Services | Terms of Use