The Community for Technology Leaders
Reliable Distributed Systems, IEEE Symposium on (2006)
Leeds, United Kingdom
Oct. 2, 2006 to Oct. 4, 2006
ISSN: 1060-9857
ISBN: 0-7695-2677-2
pp: 61-70
Mudhakar Srivatsa , College of Computing, Georgia Institute of Technology, Atlanta, GA 30332, USA
Arun Iyengar , IBM T. J. Watson Research Center, Yorktown Heights, NY 10598, USA
Jian Yin , IBM T. J. Watson Research Center, Yorktown Heights, NY 10598, USA
Ling Liu , College of Computing, Georgia Institute of Technology, Atlanta, GA 30332, USA
ABSTRACT
Denial of Service (DoS) attacks attempt to consume a server's resources (network bandwidth, computing power, main memory, disk bandwidth etc) to near exhaustion so that there are no resources left to handle requests from legitimate clients. An effective solution to defend against DoS attacks is to filter DoS attack requests at the earliest point (say, the web site's firewall), before they consume much of the server's resources. Most defenses against DoS attacks attempt to filter requests from inauthentic clients before they consume much of the server's resources. Client authentication using techniques like IPSec or SSL may often require changes to the client-side software and may additionally require superuser privileges at the client for deployment. Further, using digital signatures (as in SSL) makes verification very expensive, thereby making the verifi- cation process itself a viable DoS target for the adversary. In this paper, we propose a light-weight client transparent technique to defend against DoS attacks with two unique features: (i) Our technique can be implemented entirely using JavaScript support provided by a standard client-side browser like Mozilla FireFox or Microsoft Internet Explorer. Client transparency follows from the fact that: (i) no changes to client-side software are required, (ii) no client-side superuser privileges are required, and (iii) clients (human beings or automated clients) can browse a DoS protected website in the same manner that they browse other websites. (ii) Although we operate using the client-side browser (HTTP layer), our technique enables fast IP level packet filtering at the server's firewall and requires no changes to the application(s) hosted by the web server. In this paper we present a detailed design of our technique along with a detailed security analysis. We also describe a concrete implementation of our proposal on the Linux kernel and present an evaluation using two applications: bandwidth intensive Apache HTTPD and database intensive TPCW. Our experiments show that our approach incurs a low performance overhead and is resilient to DoS attacks.
INDEX TERMS
Authentication, Availability, Client Transparency, Denial of Service (DoS) attacks, Web Servers
CITATION
Mudhakar Srivatsa, Arun Iyengar, Jian Yin, Ling Liu, "A Client-Transparent Approach to Defend Against Denial of Service Attacks", Reliable Distributed Systems, IEEE Symposium on, vol. 00, no. , pp. 61-70, 2006, doi:10.1109/SRDS.2006.6
160 ms
(Ver )