OPERETTA: An OPEnflow-based REmedy to mitigate TCP SYNFLOOD Attacks against web servers
Introduction
TCP SYNFLOOD attacks are a type of Distributed Denial of Service (DDoS) attack that rely on the normal TCP Three-Way Handshake mechanism to consume resources on the targeted server. In this way server resources are blocked and the server is made unresponsive. As a consequence the attacked server is overwhelmed and cannot support the requested service.
The TCP SYNFLOOD attack was identified by Ziegler in 1994 [1]. Analyzing statistics on this type of attacks, it has been observed that it represents the 90% of the DoS attacks worldwide [2]; so it is a widespread and critical menace to be faced. In the TCP SYNFLOOD attack it is assumed that the victim node, upon receiving a connection request in the form of a SYN segment from a remote user, enters a listening state where its resources are frozen waiting for the confirmation ack from the initiating node. The victim waits for a certain amount of time and then gives up. If the victim’s buffer allows to enqueue multiple packets, this mechanism will exhaust the victim available resources.
TCP SYNFLOOD attacks have been widely addressed in the literature as discussed in [3].
Methodologies used to counteract such a menace typically employ firewalls and intrusion detection schemes which can be ineffective and can be violated.
In SDN networks the decoupling between the data plane and the Control Plane allows to set up more effective solutions to TCP SYNFLOOD attacks. In fact, in these networks, the intelligence for counteracting security menaces can be moved to a single network element, i.e., the OpenFlow Controller, which has complete information about the network and is in the best situation to identify ongoing attacks. However, in this way TCP SYNFLOOD attacks can turn into attacks to the Controller, which becomes a unique point of failure for the network.
In this paper we propose OPERETTA, an OPEnflow-based Remedy to TCP SYNFLOOD Attacks. OPERETTA is implemented in the Controller which manages incoming TCP SYN packets and rejects fake connection requests. According to a traditional SDN architecture, OPERETTA logically consists of a single Controller, although physically OPERETTA can also be employed in a decentralized manner where multiple Controllers are available in the access routers at the users’ premises to run control operations. This delocalization of the Controller function into multiple Controllers also achieves the objective of higher system reliability since, in case of DoS attacks, only a portion of the network, and not the entire network, is involved in the attack. OPERETTA has been tested using MININET and to this purpose prototypes of the relevant Control Plane functions have been implemented starting from the POX Controller. Numerical results show that OPERETTA achieves good performance in terms of resilience to TCP SYNFLOOD attacks and low level of CPU and memory usage.
The rest of this paper is organized as follows. In Section 2 we discuss the background literature in the field. In Section 3 we describe OPERETTA and in Section 4 we discuss the protocol performance. Finally, in Section 5 conclusions are drawn.
Section snippets
Background
In this section we provide a brief overview of the relevant literature in the field. More specifically, in Section 2.1 we discuss Denial of Service attacks in general and in Section 2.2 we focus on the TCP SYNFLOOD attack in particular. In Section 2.3 we recall Software Defined Networks with special focus on OpenFlow and in Section 2.4 we illustrate the few solutions to TCP SYNFLOOD attacks proposed so far for SDNs.
OPERETTA
In this section we describe OPERETTA, an OPEnflow-based Remedy to TCP SYNFLOOD Attacks. In particular, in Section 3.1 we illustrate OPERETTA in a nutshell; then, in Section 3.2 the protocol behavior is described in more details.
Performance Assessment
In this section we describe the implementation details of our experimental testbed and illustrate the scenarios being considered and the model of attack implemented.
Conclusions
In this paper we have introduced OPERETTA, an OpenFlow Remedy to TCP SYNFLOOD attacks. OPERETTA relies on the use of an SDN approach to protect the OF Controller from TCP SYNFLOOD attacks. OPERETTA achieves four main targets, i.e., it provides a robust methodology to identify TCP SYNFLOOD attacks while also providing a flexible network mechanism for coping with these attacks which does not introduce significant CPU processing or memory overhead. Observe that OPERETTA works in heterogeneous
Silvia Fichera received her laurea degree in Telecommunications Engineering from University of Catania, Catania, Italy, in 2014. She was also trainee at Ecole Polytechnique Fédérale de Lausanne (EPFL). Now she is with Scuola Superiore di Studi S. Anna, Pisa, Italy.
References (28)
Hacker tangles panix web site
Wall Street J.
(September 12, 1996)- et al.
Inferring internet denial of service activity
Proceedings of USENIX Security Symposium
(2001) - et al.
A taxonomy of DDoS attack and DDoS defense mechanisms
ACM SIGCOMM Comput. Commun. Rev.
(April 2004) - et al.
Hands-on denial of service lab exercises using SlowLoris and RUDY
Proceedings of INFOCSECD
(2012) - et al.
Analysis of the SYN Flood DoS Attack
Int. J. Comput. Netw. Inf. Secur.
(2013) - Radware, security report, global application & network, 2013,...
- Cisco, defining strategies to protect against TCP SYN denial of service attacks, 2006,...
Defenses against TCP SYN flooding attacks
Internet Protoc. J.
(2006)Resisting SYN flood DoS attacks with a SYN cache
Proceedings of the BSD Conference
(2002)- P. Ferguson, D. Senie, 2000, RFC 2827 Network ingress filtering: defeating denial of service attacks which employ IP...
OpenFlow: enabling innovation in campus networks
ACM SIGCOMM Comput. Commun. Rev.
Cited by (67)
SYNTROPY: TCP SYN DDoS attack detection for Software Defined Network based on Rényi entropy
2024, Computer NetworksM-RL: A mobility and impersonation-aware IDS for DDoS UDP flooding attacks in IoT-Fog networks
2024, Computers and SecurityDOCUS-DDoS detection in SDN using modified CUSUM with flash traffic discrimination and mitigation
2022, Computer NetworksCitation Excerpt :We categorize this section as four sub sections based on detection approach of schemes as DDoS detection using half-open connections, statistical detection techniques, DDoS detection with flash traffic separation and DDoS detection in recent new environments. The schemes [13,16] detect the DDoS attack by counting the number of half-open connections for each source MAC address. Statistical techniques like entropy, information distance, CUSUM are successful in DDoS attack detection.
A comprehensive survey of DDoS defense solutions in SDN: Taxonomy, research challenges, and future directions
2021, Computers and SecurityEnhancing the security of blockchain-based software defined networking through trust-based traffic fusion and filtration
2021, Information FusionCitation Excerpt :They further presented a prototype using the NetFPGA OpenFlow platform. Fichera et al. [54] described OPERETTA, a mechanism that could secure the OpenFlow controller from TCP SYNFLOOD attacks. It aims to handle incoming TCP SYN packets and reduce fake connection requests.
Silvia Fichera received her laurea degree in Telecommunications Engineering from University of Catania, Catania, Italy, in 2014. She was also trainee at Ecole Polytechnique Fédérale de Lausanne (EPFL). Now she is with Scuola Superiore di Studi S. Anna, Pisa, Italy.
Laura Galluccio received her laurea degree in Electrical Engineering from University of Catania, Catania, Italy, in 2001. In March 2005 she got her Ph.D. in Electrical, Computer and Telecommunications Engineering at the same university under the guidance of Prof. Sergio Palazzo. Since 2002 she is also at the Italian National Consortium of Telecommunications (CNIT), where she worked as a Research Fellow within the VICOM (Virtual Immersive Communications) and the SATNEX Projects. Since November 2010 she is Assistant Professor at University of Catania. Her research interests include ad hoc and sensor networks, protocols and algorithms for wireless networks, and network performance analysis. From May to July 2005 she has been a Visiting Scholar at the COMET Group, Columbia University, NY under the guidance of Prof. Andrew T. Campbell. She is member of the Sigmobile, IEEE and N2Women.
Salvatore Grancagnolo received his laurea degree in Telecommunications Engineering from University of Catania, Catania, Italy, in 2014. Formerly he was with Consorzio nazionale Interuniversitario per le Telecomunicazioni. Now he is consultant at Altran Italia SPA.
Giacomo Morabito was born in Messina, Sicily (Italy) on March 16, 1972. He received the laurea degree in Electrical Engineering and the PhD in Electrical, Computer and Telecommunications Engineering from the Istituto di Informatica e Telecomunicazioni, University of Catania, Catania (Italy), in 1996 and 2000, respectively. From November 1999 to April 2001, he was with the Broadband and Wireless Networking Laboratory of the Georgia Institute of Technology as a Research Engineer. Since April 2001 he is with the Dipartimento di Ingegneria Informatica e delle Telecomunicazioni of the University of Catania where he is currently Associate Professor. His research interests focus on analysis and solutions for wireless networks.
Sergio Palazzo was born in Catania, Italy, on December 12, 1954. He received his degree in electrical engineering from the University of Catania in 1977. Until 1981, he was at ITALTEL, Milano, where he was involved in the design of operating systems for electronic exchanges. He then joined CREI, which is the center of the Politecnico di Milano for research on computer networks. Since 1987 he has been at the University of Catania, where is now a Full Professor of Telecommunications Networks. In 1994, he spent the summer at the International Computer Science Institute (ICSI), Berkeley, as a Senior Visitor. He is a recipient of the 2003 Visiting Erskine Fellowship by the University of Canterbury, Christchurch, New Zealand. Since 1992, he has been serving on the Technical Program Committee of INFOCOM, the IEEE Conference on Computer Communications. He has been the General Chair of some ACM conferences, including MobiHoc 2006 and MobiOpp 2010, and currently is a member of the MobiHoc Steering Committee. He has also been the TPC Co-Chair of the IFIP Networking 2011, IWCMC 2013, and European Wireless 2014 conferences. Moreover, in the recent past, he has been the Program Co-Chair of the 2005 International Tyrrhenian Workshop on Digital Communications, focused on “Distributed Cooperative Laboratories: Networking, Instrumentation, and Measurements”, the General Vice Chair of the ACM MobiCom 2001 Conference, and the General Chair of the 2001 International Tyrrhenian Workshop on Digital Communications, focused on “Evolutionary Trends of the Internet”. He currently serves the Editorial Board of the journal Ad Hoc Networks. In the recent past, he also was an Editor of IEEE Wireless Communications Magazine (formerly IEEE Personal Communications Magazine), IEEE/ACM Transactions on Networking, IEEE Transactions on Mobile Computing, Computer Networks, and Wireless Communications and Mobile Computing. He was a Guest Editor of Special Issues in the IEEE Journal of Selected Areas in Communications (“Intelligent Techniques in High-Speed Networks”), in the IEEE Personal Communications Magazine (“Adapting to Network and Client Variability in Wireless Networks”), in the Computer Networks journal (“Broadband Satellite Systems: a Networking Perspective”), in the EURASIP Journal on Wireless Communications and Networking (“Ad Hoc Networks: Cross-Layer Issues”, and “Opportunistic and Delay Tolerant Networks”). He also was the recipient of the 2002 Best Editor Award for the Computer Networks journal. His current research interests include mobile systems, wireless and satellite IP networks, intelligent techniques in network control, multimedia traffic modeling, and protocols for the next generation of the Internet.