NDLI: A Client-Transparent Approach to Defend Against Denial of Service Attacks

Content Provider	IEEE Xplore Digital Library
Author	Srivatsa, M. Iyengar, A. Jian Yin Ling Liu
Copyright Year	2006
Description	Author affiliation: Coll. of Comput., Georgia Inst. of Technol., Atlanta, GA (Srivatsa, M.)
Abstract	Denial of service (DoS) attacks attempt to consume a server's resources (network bandwidth, computing power, main memory, disk bandwidth etc.) to near exhaustion so that there are no resources left to handle requests from legitimate clients. An effective solution to defend against DoS attacks is to filter DoS attack requests at the earliest point (say, the Web site's firewall), before they consume much of the server's resources. Most defenses against DoS attacks attempt to filter requests from inauthentic clients before they consume much of the server's resources. Client authentication using techniques like IPSec or SSL may often require changes to the client-side software and may additionally require superuser privileges at the client for deployment. Further, using digital signatures (as in SSL) makes verification very expensive, thereby making the verification process itself a viable DoS target for the adversary. In this paper, we propose a light-weight client transparent technique to defend against DoS attacks with two unique features: (i) Our technique can be implemented entirely using JavaScript support provided by a standard client-side browser like Mozilla FireFox or Microsoft Internet Explorer. Client transparency follows from the fact that: (i) no changes to client-side software are required, (ii) no client-side superuser privileges are required, and (iii) clients (human beings or automated clients) can browse a DoS protected Web site in the same manner that they browse other Web sites, (ii) Although we operate using the client-side browser (HTTP layer), our technique enables fast IP level packet filtering at the server's firewall and requires no changes to the application(s) hosted by the Web server. In this paper we present a detailed design of our technique along with a detailed security analysis. We also describe a concrete implementation of our proposal on the Linux kernel and present an evaluation using two applications: bandwidth intensive Apache HTTPD and database intensive TPCW. Our experiments show that our approach incurs a low performance overhead and is resilient to DoS attacks
Starting Page	61
Ending Page	70
File Size	267181
Page Count	10
File Format	PDF
ISBN	0769526772
ISSN	10609857
DOI	10.1109/SRDS.2006.6
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2006-10-02
Publisher Place	UK
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Computer crime Bandwidth Information filtering Information filters Computer networks Authentication Digital signatures Java Internet Humans Web Servers Availability Client Transparency Denial of Service (DoS) attacks
Content Type	Text
Resource Type	Article
Subject	Theoretical Computer Science Computer Networks and Communications Software Hardware and Architecture

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Steps to defend against DoS attacks

Mitigating application-level denial of service attacks on Web servers: A client-transparent approach

Analysis of denial-of-service attacks on denial-of-service defensive measures

Defending Web Services against Denial of Service Attacks Using Client Puzzles

A Cooperative Mechanism to Defense against Distributed Denial of Service Attacks

Bandwidth Distributed Denial of Service: Attacks and Defenses

Denial of service attacks targeting a SIP VoIP infrastructure: attack scenarios and prevention mechanisms

CPU-based DoS attacks against SIP servers

Packet filtering to defend flooding-based DDoS attacks [Internet denial-of-service attacks]

A Client-Transparent Approach to Defend Against Denial of Service Attacks

Similar Documents

Steps to defend against DoS attacks

Mitigating application-level denial of service attacks on Web servers: A client-transparent approach

Analysis of denial-of-service attacks on denial-of-service defensive measures

Defending Web Services against Denial of Service Attacks Using Client Puzzles

A Cooperative Mechanism to Defense against Distributed Denial of Service Attacks

Bandwidth Distributed Denial of Service: Attacks and Defenses

Denial of service attacks targeting a SIP VoIP infrastructure: attack scenarios and prevention mechanisms

CPU-based DoS attacks against SIP servers

Packet filtering to defend flooding-based DDoS attacks [Internet denial-of-service attacks]

A Client-Transparent Approach to Defend Against Denial of Service Attacks