NDLI: LOT: A Defense Against IP Spoofing and Flooding Attacks

Please wait, while we are loading the content...

ACM Transactions on Information and System Security (TISSEC) : Volume 18

ACM Transactions on Information and System Security (TISSEC) : Volume 17

ACM Transactions on Information and System Security (TISSEC) : Volume 16

ACM Transactions on Information and System Security (TISSEC) : Volume 15

Issue 4, April 2013

Issue 3, November 2012

Issue 2, July 2012

LOT: A Defense Against IP Spoofing and Flooding Attacks

Towards Practical Identification of HF RFID Devices

On Protection by Layout Randomization

BAF and FI-BAF: Efficient and Publicly Verifiable Cryptographic Schemes for Secure Logging in Resource-Constrained Systems

Corrective Enforcement: A New Paradigm of Security Policy Enforcement by Monitors

Issue 1(Special Issue on Computer and Communications Security), March 2012

ACM Transactions on Information and System Security (TISSEC) : Volume 14

ACM Transactions on Information and System Security (TISSEC) : Volume 13

ACM Transactions on Information and System Security (TISSEC) : Volume 12

ACM Transactions on Information and System Security (TISSEC) : Volume 11

ACM Transactions on Information and System Security (TISSEC) : Volume 10

ACM Transactions on Information and System Security (TISSEC) : Volume 9

ACM Transactions on Information and System Security (TISSEC) : Volume 8

ACM Transactions on Information and System Security (TISSEC) : Volume 7

ACM Transactions on Information and System Security (TISSEC) : Volume 6

ACM Transactions on Information and System Security (TISSEC) : Volume 5

ACM Transactions on Information and System Security (TISSEC) : Volume 4

ACM Transactions on Information and System Security (TISSEC) : Volume 3

ACM Transactions on Information and System Security (TISSEC) : Volume 2

ACM Transactions on Information and System Security (TISSEC) : Volume 1

LOT: A Defense Against IP Spoofing and Flooding Attacks

Content Provider	ACM Digital Library
Author	Herzberg, Amir Gilad, Yossi
Copyright Year	2012
Abstract	We present LOT, a lightweight plug and play secure tunneling protocol deployed at network gateways. Two communicating gateways, A and B, running LOT would automatically detect each other and establish an efficient tunnel, securing communication between them. LOT tunnels allow A to discard spoofed packets that specify source addresses in B’s network and vice versa. This helps to mitigate many attacks, including DNS poisoning, network scans, and most notably (Distributed) Denial of Service (DoS). LOT tunnels provide several additional defenses against DoS attacks. Specifically, since packets received from LOT-protected networks cannot be spoofed, LOT gateways implement quotas, identifying and blocking packet floods from specific networks. Furthermore, a receiving LOT gateway (e.g., B) can send the quota assigned to each tunnel to the peer gateway (A), which can then enforce near-source quotas, reducing waste and congestion by filtering excessive traffic before it leaves the source network. Similarly, LOT tunnels facilitate near-source filtering, where the sending gateway discards packets based on filtering rules defined by the destination gateway. LOT gateways also implement an intergateway congestion detection mechanism, allowing sending gateways to detect when their packets get dropped before reaching the destination gateway and to perform appropriate near-source filtering to block the congesting traffic; this helps against DoS attacks on the backbone connecting the two gateways. LOT is practical: it is easy to manage (plug and play, requires no coordination between gateways), deployed incrementally at edge gateways (not at hosts and core routers), and has negligible overhead in terms of bandwidth and processing, as we validate experimentally. LOT storage requirements are also modest.
Starting Page	1
Ending Page	30
Page Count	30
File Format	PDF
ISSN	10949224
e-ISSN	15577406
DOI	10.1145/2240276.2240277
Volume Number	15
Issue Number	2
Journal	ACM Transactions on Information and System Security (TISSEC)
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2012-07-01
Publisher Place	New York
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	IP spoofing Denial of service
Content Type	Text
Resource Type	Article
Subject	Computer Science Safety, Risk, Reliability and Quality

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Fragmentation Considered Vulnerable

Effectiveness and detection of denial-of-service attacks in tor

Just fast keying: Key agreement in a hostile internet

A Survey of Defense Mechanisms Against Distributed Denial of Service (DDoS) Flooding Attacks

Toward Incentivizing Anti-Spoofing Deployment

Examining a Large Keystroke Biometrics Dataset for Statistical-Attack Openings

Scalable network-layer defense against internet bandwidth-flooding attacks

On the state of IP spoofing defense

Bandwidth Distributed Denial of Service: Attacks and Defenses

LOT: A Defense Against IP Spoofing and Flooding Attacks

Similar Documents

Fragmentation Considered Vulnerable

Effectiveness and detection of denial-of-service attacks in tor

Just fast keying: Key agreement in a hostile internet

A Survey of Defense Mechanisms Against Distributed Denial of Service (DDoS) Flooding Attacks

Toward Incentivizing Anti-Spoofing Deployment

Examining a Large Keystroke Biometrics Dataset for Statistical-Attack Openings

Scalable network-layer defense against internet bandwidth-flooding attacks

On the state of IP spoofing defense

Bandwidth Distributed Denial of Service: Attacks and Defenses

LOT: A Defense Against IP Spoofing and Flooding Attacks