Defeating DDoS attacks by fixing the incentive chain

Reviewer: Myles F. McNally

Want to disable an Internet content provider (ICP) like Yahoo! or Amazon__?__ Or perhaps you are interested in attacking the Department of Defense Web site or other government sites. Then a denial of service (DoS) attack is for you. Simply overwhelm the target site with Internet traffic. Even if its gateway routers prevent the attack from reaching its content servers, the site itself is compromised. To massively flood such a site, recruit (that is, attack and takeover) a legion of "zombie" computers across the Internet and then launch the attack simultaneously from each of them (a distributed denial of service attack (DDoS)). To get a sense of the potential size of such an attack, consider the case of so-called "Botmaster" Jeanson James Ancheta, who in 2005 pled guilty to charges of conspiracy, damaging computers used by the US government, and fraud. He and others recruited over 400,000 zombie computers, including machines in a weapons division of a US Naval Air Warfare Center, and were leasing subnets of these zombie machines to others for use in DDoS attacks and massive spam mailings. Since DDoS attacks have been going on for some time, why has no effective means been found to prevent them or at least minimize their effects__?__ Actually, the authors of this paper claim that such means already exist, but organizations in the best position to implement them have no economic incentive to do so. Under our current Internet organizational structure, only the target of the attack (the ICP) and indirectly its regional Internet service provider (ISP) have economic incentives to prevent particular attacks. While the ICP itself is simply overwhelmed, the providing ISP is likely to have so much excess capacity that it is not compromised. The excess capacities of the regional ISPs to which the zombie computers connect and the backbone ISP networks over which they communicate mean that those systems are not comprised either. Given that DDoS attacks do not comprise their services, the ISPs have no incentive to implement what Huang, Geng, and Whinston take to be the two most effective ways to handle DDoS attacks: cooperative filtering and cooperative caching. Both of these techniques are designed to blunt attacks once they are underway. As their names suggest, they require wide-scale cooperation among ISPs. Achieving such cooperation requires fixing the "incentive chain," which currently stops prematurely at the content provider. In cooperative filtering, ISPs along the attack path filter out attack traffic. This involves three phases: alarming, where an intrusion detection system identifies suspicious traffic; tracing, the tracking back as far as possible along each attack path; and filtering, where ISPs far back along each path simply filter out attack traffic. The most effective tracking would require ISPs to ban Internet protocol (IP) spoofing (the use of false IP addresses), which could be done by the immediate ISPs of attacking computers. This would allow attacking zombie computers to be identified and then taken offline. How can an economic incentive be provided to ISPs to take such actions__?__ The authors suggest switching from a subscription-based capacity model, where all of the players routinely have far more bandwidth than they need, to a dynamic model, in which each player pays for actual bandwidth used. In such a system, everyone would have an incentive to use network resources judiciously, and in particular eliminate spurious traffic. Many ISPs using caching to provide faster service to their own customers. Cooperative caching involves ISPs providing caching services to noncustomers as well. If a request could be satisfied by any number of caching servers across the Internet, the quality of service provided to all customers would be improved. Almost as a side benefit, the effects of DDoS attacks would be diluted. Rather than a particular site being overwhelmed with traffic, the many caching sites would be able to handle the increased traffic flow. Of course, there are issues with nonstatic content, which currently only the ICP could provide. But technologies like Edge Side Includes are being developed that would allow dynamic content to be generated at multiple locations rather than just at the ICP. To coordinate this caching scheme, the authors propose a capacity provision network market mechanism, in which regional ISPs have their caching organized by a third entity, which receives payments directly from the various ICPs. The authors spend a fair amount of time in the paper arguing the merits of this model, which seems promising. This is an interesting and important paper. Its diagnosis of why we can't seem to stop DDoS attacks leads to bold recommendations that would change the fundamental economic structure of the Internet. If we believe the arguments of the authors, such changes will lead not only to an end of DDoS attacks, but also to a higher quality of service for all Internet users. Online Computing Reviews Service