A multilayer overlay network architecture for enhancing IP services availability against DoS

Dimitris Geneiatakis, Georgios Portokalidis, Angelos D. Keromytis

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

10 Scopus citations

Abstract

Protection against Denial of Service (DoS) attacks is a challenging and ongoing problem. Current overlay-based solutions can transparently filter unauthorized traffic based on user authentication. Such solutions require either pre-established trust or explicit user interaction to operate, which can be circumvented by determined attackers and is not always feasible (e.g., when user interaction is impossible or undesirable). We propose a Multi-layer Overlay Network (MON) architecture that does not depend on user authentication, but instead utilizes two mechanisms to provide DoS resistant to any IP-based service, and operates on top of the existing network infrastructure. First, MON implements a threshold-based intrusion detection mechanism in a distributed fashion to mitigate DoS close to the attack source. Second, it randomly distributes user packets amongst different paths to probabilistically increase service availability during an attack. We evaluate MON using the Apache web server as a protected service. Results demonstrate MON nodes introduce very small overhead, while users' service access time increases by a factor of 1.1 to 1.7, depending on the configuration. Under an attack scenario MON can decrease the attack traffic forwarded to the service by up to 85%. We believe our work makes the use of overlays for DoS protection more practical relative to prior work.

Original languageEnglish
Title of host publicationInformation Systems Security - 7th International Conference, ICISS 2011, Proceedings
Pages322-336
Number of pages15
DOIs
StatePublished - 2011
Event7th International Conference on Information Systems Security, ICISS 2011 - Kolkata, India
Duration: 15 Dec 201119 Dec 2011

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume7093 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Conference

Conference7th International Conference on Information Systems Security, ICISS 2011
Country/TerritoryIndia
CityKolkata
Period15/12/1119/12/11

Fingerprint

Dive into the research topics of 'A multilayer overlay network architecture for enhancing IP services availability against DoS'. Together they form a unique fingerprint.

Cite this