Proactive routing mutation against stealthy Distributed Denial of Service attacks: metrics, modeling, and analysis

Journal Article · Wed Aug 17 04:00:00 EDT 2016 · Journal of Defense Modeling and Simulation

DOI:https://doi.org/10.1177/1548512917731002· OSTI ID:1433769

Duan, Qi ^[1]; Al-Shaer, Ehab ^[1]; Chatterjee, Samrat ^[2]; Halappanavar, Mahantesh ^[2]; Oehmen, Christopher ^[2]

---

1. Cyber Defense and Network Assurability Center, College of Computing and Informatics, University of North Carolina Charlotte, USA
2. Pacific Northwest National Laboratory, USA

The Infrastructure Distributed Denial of Service (IDDoS) attacks continue to be one of the most devastating challenges facing cyber systems. The new generation of IDDoS attacks exploit the inherent weakness of cyber infrastructure including deterministic nature of routes, skew distribution of flows, and Internet ossification to discover the network critical links and launch highly stealthy flooding attacks that are not observable at the victim end. In this paper, first, we propose a new metric to quantitatively measure the potential susceptibility of any arbitrary target server or domain to stealthy IDDoS attacks, and es- timate the impact of such susceptibility on enterprises. Second, we develop a proactive route mutation technique to minimize the susceptibility to these attacks by dynamically changing the flow paths periodically to invalidate the adversary knowledge about the network and avoid targeted critical links. Our proposed approach actively changes these network paths while satisfying security and qualify of service requirements. We present an integrated approach of proactive route mutation that combines both infrastructure-based mutation that is based on reconfiguration of switches and routers, and middle-box approach that uses an overlay of end-point proxies to construct a virtual network path free of critical links to reach a destination. We implemented the proactive path mutation technique on a Software Defined Network using the OpendDaylight controller to demonstrate a feasible deployment of this approach. Our evaluation validates the correctness, effectiveness, and scalability of the proposed approaches.

• Research Organization: Pacific Northwest National Laboratory (PNNL), Richland, WA (US)
• Sponsoring Organization: USDOE
• DOE Contract Number: AC05-76RL01830
• OSTI ID: 1433769
• Report Number(s): PNNL-SA-128859
• Journal Information: Journal of Defense Modeling and Simulation, Journal Name: Journal of Defense Modeling and Simulation Journal Issue: 2 Vol. 15; ISSN 1548-5129
• Publisher: Society for Modeling and Simulation International
• Country of Publication: United States
• Language: English

Related Subjects

ARC