AccFlow: Defending against the Low-Rate TCP DoS Attack in Drones
Source abstract
Abstract
As drones are widely employed in various industries and daily life, concerns regarding their safety have been gradually emerging. Denial of service (DoS) attacks have become one of the most significant threats to the stability of resource-constrained sensor nodes. Traditional brute-force and high-rate distributed denial of service (DDoS) attacks are easily detectable and mitigated. However, low-rate TCP DoS attacks can considerably impair TCP throughput and evade DoS prevention systems by inconspicuously consuming a small portion of network capacity, and whereas the literature offers effective defense mechanisms against DDoS attacks, there is a gap in defending against Low-Rate TCP DoS attacks. In this paper, we introduce AccFlow, an incrementally deployable Software-Defined Networking (SDN)-based protocol designed to counter low-rate TCP DoS attacks. The main idea of AccFlow is to make the attacking flows accountable for the congestion by dropping their packets according to their loss rates. AccFlow drops their packets more aggressively as the loss rates increase. Through extensive simulations, we illustrate that AccFlow can effectively safeguard against low-rate TCP DoS attacks, even when attackers employ varying strategies involving different scales and data rates. Furthermore, whereas AccFlow primarily addresses low-rate TCP DoS attacks, our research reveals its effectiveness in defending against general DoS attacks. These general attacks do not rely on the TCP retransmission timeout mechanism but rather deplete network resources, ultimately resulting in a denial of service for legitimate users. Additionally, we delve into the scalability of AccFlow and its viability for practical deployment in real-world networks. Finally, we demonstrate the effectiveness of AccFlow in safeguarding network resources.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Software-Defined Networks and 5G · Network Security and Intrusion Detection · Internet Traffic Analysis and Secure E-voting
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
The College of Information Science and Engineering, Hohai University, Changzhou 213022, China
The College of Electronic Science and Technology, Shenzhen University, Shenzhen 518060, China
The College of Information Engineering, Shenzhen University, Shenzhen 518060, China
School of Microelectronics, South China University of Technology, Guangzhou 511442, China
Funding
National Natural Science Foundation of China · Guangdong Basic and Applied Basic Research Foundation · the Open Fund of Advanced Cryptography and System Security Key Laboratory of Sichuan Province · Key Research and Development Program of Jiangsu Province · Postdoctoral Science Foundation of Jiangsu Province
References (37)
Show source-provided references
1. Pärlin, K., Alam, M.M., and Moullec, Y.L. (2018, January 22–23). Jamming of uav remote control systems using software defined radio. Proceedings of the 2018 International Conference on Military Communications and Information Systems (ICMCIS), Warsaw, Poland.10.1109/ICMCIS.2018.8398711 ↗
2. Drones and possibilities of their using
3. Javaid, A.Y., Sun, W., Devabhaktuni, V.K., and Alam, M. (2012, January 13–15). Cyber security threat analysis and modeling of an unmanned aerial vehicle system. Proceedings of the 2012 IEEE Conference on Technologies for Homeland Security (HST), Waltham, MA, USA.10.1109/THS.2012.6459914 ↗
4. Low-rate tcp-targeted denial of service attacks and counter strategies10.1109/TNET.2006.880180 ↗
5. Stockhammer, T. (2011, January 23–25). Dynamic adaptive streaming over http–: Standards and design principles. Proceedings of the Second Annual ACM Conference on Multimedia Systems, ACM, San Jose, CA, USA.10.1145/1943552.1943572 ↗
6. Sun, H., Lui, J.C.S., and Yau, D.K.Y. (2004, January 8). Defending against low-rate tcp attacks: Dynamic detection and protection. Proceedings of the 12th IEEE International Conference on Network Protocols, Berlin, Germany.
7. Chang, C.-W., Lee, S., Lin, B., and Wang, J. (2009, January 22–26). The taming of the shrew: Mitigating low-rate tcp-targeted attack. Proceedings of the 2009 29th IEEE International Conference on Distributed Computing Systems, Montreal, QC, Canada.10.1109/ICDCS.2009.9 ↗
8. Source-based defense against ddos attacks in sdn based on sflow and som10.1109/ACCESS.2021.3139511 ↗
9. Bhuyan, M., Kalwar, A., Goswami, A., Bhattacharyya, D., and Kalita, J. (2015, January 4–6). Low-rate and high-rate distributed dos attack detection using partial rank correlation. Proceedings of the 2015 Fifth International Conference on Communication Systems and Network Technologies, Gwalior, India.10.1109/CSNT.2015.24 ↗
10. Vishwakarma, R., and Jain, A.K. (2019, January 23–25). A honeypot with machine learning based detection framework for defending iot based botnet ddos attacks. Proceedings of the 2019 3rd International Conference on Trends in Electronics and Informatics (ICOEI), Tirunelveli, India.10.1109/ICOEI.2019.8862720 ↗
11. Başer, M., Güven, E.Y., and Aydın, M.A. (2021, January 15–17). Ssh and telnet protocols attack analysis using honeypot technique: Analysis of ssh and telnet honeypot. Proceedings of the 2021 6th International Conference on Computer Science and Engineering (UBMK), Ankara, Turkey.10.1109/UBMK52708.2021.9558948 ↗
12. A new detection method for ldos attacks based on data mining10.1016/j.future.2021.09.039 ↗
13. Openflow: Enabling innovation in campus networks10.1145/1355734.1355746 ↗
14. B4: Experience with a globally-deployed software defined wan10.1145/2534169.2486019 ↗
15. Hong, C.-Y., Kandula, S., Mahajan, R., Zhang, M., Gill, V., Nanduri, M., and Wattenhofer, R. (2013, January 12–16). Achieving high utilization with software-driven wan. Proceedings of the SIGCOMM ’13: ACM SIGCOMM 2013 Conference on SIGCOMM, Hong Kong, China.10.1145/2486001.2486012 ↗
16. Shin, S., Porras, P., Yegneswaran, V., Fong, M., Gu, G., and Tyson, M. (2013, January 25–27). Fresco: Modular composable security services for software-defined networks. Proceedings of the Network and Distributed Security Symposium, San Diego, CA, USA.
17. Liu, Z. (2015). FlowPolice: Enforcing Congestion Accountability to Defend against DDoS Attacks. [Ph.D. Dissertation, University of Illinois at Urbana-Champaign].
18. (2021, June 01). Ns-3: A Discrete-Event Network Simulator. Available online: https://www.nsnam.org.
19. Aleksandar, K., and Edward, W.K. (2003, January 25–29). Low-rate TCP-targeted denial of service attacks: The shrew vs. the mice and elephants. Proceedings of the SIGCOMM ’03: 2003 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications, Karlsruhe, Germany.
20. Ferguson, P., and Senie, D. (2000). Network Ingress Filtering: Defeating Denial of Service Attacks Which Employ IP Source Address Spoofing, RFC Editor.10.17487/rfc2827 ↗
21. Liu, X., Li, A., Yang, X., and Wetherall, D. (2008, January 16–18). Passport: Secure and adoptable source authentication. Proceedings of the 5th USENIX Symposium on Networked Systems Design & Implementation, NSDI 2008, San Francisco, CA, USA.
22. Liu, Z., Jin, H., Hu, Y.-C., and Bailey, M. (2016, January 24–28). MiddlePolice: Toward Enforcing Destination-Defined Policies in the Middle of the Internet. Proceedings of the CCS ’16: 2016 ACM SIGSAC Conference on Computer and Communications Security, Vienna, Austria.10.1145/2976749.2978306 ↗
23. Liu, Z., Jin, H., Hu, Y.-C., and Bailey, M. (2017). MiddlePolice: Fine-Grained Endpoint-Driven In-Network Traffic Control for Proactive DDoS Attack Mitigation. arXiv.
24. Mittal, P., Kim, D., Hu, Y.-C., and Caesar, M. (2011). Mirage: Towards deployable ddos defense for web applications. arXiv.
25. Dixon, C., Anderson, T., and Krishnamurthy, A. (2008, January 16–18). Phalanx: Withstanding multimillion-node botnets. Proceedings of the NSDI 08: 5th USENIX Symposium on Networked Systems Design USENIX Association and Implementation, San Francisco, CA, USA.
26. Controlling high bandwidth aggregates in the network10.1145/571697.571724 ↗
27. A dos-limiting network architecture10.1145/1090191.1080120 ↗
28. Chandra, T., Griesemer, R., and Redstone, J. (2007, January 12–15). Paxos made live-an engineering perspective (2006 invited talk). Proceedings of the 26th ACM Symposium on Principles of Distributed Computing-PODC, Portland, OR, USA.10.1145/1281100.1281103 ↗
29. Secure border gateway protocol (s-bgp)
30. Awduche, D.O., Malcolm, J., Agogbua, J., O’Dell, M.D., and McManus (1999). Requirements for Traffic Engineering over MPLS. RFC 2702, 1–29.10.17487/rfc2702 ↗
31. Round-robin scheduling for max-min fairness in data networks10.1109/49.103550 ↗
32. Stackpi: New packet marking and filtering mechanisms for ddos and ip spoofing defense10.1109/JSAC.2006.877138 ↗
33. Controlling ip spoofing through interdomain packet filters10.1109/TDSC.2007.70224 ↗
34. Analysis and modelling of youtube traffic10.1002/ett.2546 ↗
35. SDN-Assisted Slow HTTP DDoS Attack Defense Method10.1109/LCOMM.2017.2766636 ↗
36. Wisam, H.A.M. (2023, January 21–23). A hybrid scheme for detecting and preventing single packet Low-rate DDoS and flooding DDoS attacks in SDN. Proceedings of the 2023 IEEE 3rd International Maghreb Meeting of the Conference on Sciences and Techniques of Automatic Control and Computer Engineering (MI-STA), Benghazi, Libya.
37. Heena, K., Moin, M.M., Pooja, S., and Narayan, D.G. (2021, January 27–29). DDoS Attack Detection System using Apache Spark. Proceedings of the 2021 International Conference on Computer Communication and Informatics (ICCCI), Coimbatore, India.