global view of the network [20–22]. The global view can
help the network perform load balance or other tasks bet-
ter than when they are performed by each router with a lo-
cal view. IP spoofing identification requires a lot of
resource on routers; however, if this task is performed by
a separate server, the resource on routers can be saved. Be-
sides, the server can perform better filtering because it has
the global view of the network.
Another feature to reduce data plane cost is the protec-
tion perimeter. For a network with a certain scale, the
number of interfaces managed by the VASE server can be
enormous. In order to make the solution scalable, a perim-
eter concept is introduced. The routers chosen to filter
spoofing traffic can form one or more perimeters separat-
ing the inside routers from the other part of the network,
as illustrated in Fig. 1. Inside the perimeters, sampling
and filtering are only performed at the interfaces where
the perimeter connects with the other part of the network
and the interface attached by the stub network. There is no
need to check packet on the interfaces connected to other
routers inside the perimeter, because the incoming traffic
has either been validated whenever it intersects the perim-
eter, or leaves the stub network. The perimeter concept is
essential: however large the VASE coverage is, the number
of interfaces to manage is only the sum of the amount of
stub networks in the perimeter and the amount of links
intersecting the perimeter. It is worth noting that when-
ever all the routers are contained in VASE, filtering will
be only performed on interfaces attached by the stub
network.
Hereafter, the perimeters are named by VASE perimeter
and the routers inside the perimeters are named by VASE
router. Interfaces on which sampling and filtering are per-
formed are denoted by VASE interface, specially, the inter-
faces on links that intersect VASE perimeter are denoted by
VASE border interface.
2.2. Traffic sampling and sample collecting
Whenever routers to perform filtering are determined,
sampling is configured on the VASE interfaces. Traffics
arriving at VASE interfaces are sampled to the VASE server
by sampling mechanism on routers, discussed in Section
5.2.
The sampling rate must be set with the considering of
the tradeoff between the recall ratio of spoofing flow and
load on routers. To capture an attack, at least one spoofing
packet must be sampled in the attacking period. Three
parameters are essential for designing an appropriate sam-
pling rate: (1) the duration of attacks; (2) the ratio of
spoofing packets to all the packets; (3) the rate of packet
on the link.
Inspired by the shape of pdf (probability density
function) diagram of duration in [7], we use log-normal
distribution Log N(
l
,
r
2
) to model the spoofing flow
duration, as illustrated in Fig. 2. Levenberg–Marquardt
algorithm [23] is used to get the nonlinear least squares fit-
ting result based on samples from the statistic result of [7],
the estimated parameters based on these given values are
l
= 3.0541,
r
2
= 1.0804. Based on the model of attack dura-
tion, more than 99.9% spoofing flows last more than
0.85 min. Note that attacks with less duration than 1 min
are eliminated from the statistic result; thus the result is
biased. However, an attack of very short duration is not
of great damage. Thus, the bias is not vital.
To launch an successful (D)DoS attack, attackers will try
their best to utilize the available bandwidth to send attack-
ing traffic. Denote the ratio of spoofing packet by r.If
attacks are required to be captured with probability no less
than P, the required sampling times c is:
c P
lnð1 PÞ
lnð1 rÞ
The corresponding sampling rate is determined by the
packet per second (PPS) on interface. Denote the PPS of link
by pps. If requiring capturing attacks with duration no less
than m seconds, the required sampling rate is:
rate P
c
pps m
P
lnð1 P Þ
pps m lnð1 rÞ
Take 1% link occupation as a serious attack and 90% as
the required capture rate. It requires 1:10
6
sampling rate
on a 10 GE interface when average packet size is 1500 -
bytes, and the link is of 10% load, or 1:2.2 10
7
in the case
that link is of 100% load and average packet size is
64 bytes.
10
0
10
1
10
2
10
3
0
0.005
0.01
0.015
0.02
0.025
0.03
0.035
Duration(min)
pdf
Log-Normal Fitting Model
Sampled Value
Fig. 2. The fitting model of duration distribution of spoofing attacks.
Fig. 1. The Virtual Anti-Spoofing Edge architecture.
G. Yao et al. / Computer Networks 57 (2013) 243–257
245
剩余14页未读，继续阅读
weixin_38657139
- 粉丝: 9
- 资源: 955
我的内容管理
展开
最新资源
- 中国微型数字传声器：技术革新与市场前景
- 智能安防：基于Hi3515的嵌入式云台控制系统设计
- 手机电量低时辐射真增千倍？解析手机使用谣言
- 56F803型DSP驱动的高精度大功率超声波电源控制策略研究
- ARM与GPRS结合的远程监测系统设计
- GPS与RFID技术结合的智能巡检系统设计
- CPLD驱动的低功耗爆炸场温度测试系统设计
- 基于FPGA的智能驱动控制系统：可扩展设计与工业网络协议
- 基于ATmega128和CH374的嵌入式USB接口设计
- 基于AT89C52的温度补偿超声波测距仪：高精度设计与应用
- MSP430F448单片机在交流数字电压表中的应用
- 提升变频器应用效率的12项实用技巧
- STM32F103在数字电镀电源并联均流系统中的应用
- PSpice仿真下的升压开关电源设计：拓扑分析与CCM稳定性提升
- 轻巧高效：MSP430主导的低成本无线传感器网络节点设计
- FPGA在EDA/PLD中实现LVDS接口的应用解析
资源上传下载、课程学习等过程中有任何疑问或建议，欢迎提出宝贵意见哦~我们会及时处理！
点击此处反馈
