DoS Resilience in Ad Hoc Networks
I. Aad, J.-P. Hubaux and E. Knightly
MobiCom 2004, Sept. 29th 2004,
Philadelphia - PA, USA
1
Outline
Introduction and system model
DoS attacks:“Protocol-compliant” attacks: JellyFishBlackHole
The cost of counter-measures
Network performance under DoS attacks
Conclusion
2
Introduction
Significant work has been made in:
Key Establ.
General
Authentication
Group / Multic
ast
Arms ra
ce
Localisation
Cooperation
Routing
Intrusion detectio
n
Reputation
32P
erce
nta
ge
26
12
7 65 4 3
2 2
3
Introduction
Significant work has been made in:
Key Establ.
General
Authentication
Group / Multic
ast
Arms ra
ce
Localisation
Cooperation
Routing
Intrusion detectio
n
Reputation
32P
erce
nta
ge
We are here
0
DoS assessment
26
12
7 65 4 3
2 2
Our goal: quantify the damage of a DoS attack on anad-hoc network
3
Introduction
Significant work has been made in:
Key Establ.
General
Authentication
Group / Multic
ast
Arms ra
ce
Localisation
Cooperation
Routing
Intrusion detectio
n
Reputation
32P
erce
nta
ge
We are here
0
DoS assessment
26
12
7 65 4 3
2 2
Design (and study) a new class of “protocol-compliant”attacks
3
System model
Ad-hoc multi-hop network, Mobile nodes, Secure routing,
Node Authentication, 1 ID/node, Packet Authentication and
Encryption...4
System model
JF
JF: JellyFishBH: BlackHole
BH
JF
The dual role of hosts as routers introduces a criticalvulnerability!
4
Outline
Introduction and system model
DoS attacks:
“Protocol-compliant” attacks: JellyFishBlackHole
The cost of counter-measures
Network performance under DoS attacks
Conclusion
5
What is a "protocol-compliant" attack?
Just like any IP service, it can:
Drop packets
Reorder packets
Delay / jitter packets
6
What is a "protocol-compliant" attack?
Just like any IP service, it can:
Drop packets
Reorder packets
Delay / jitter packets
BUT!in a MALICIOUS way...
6
What is a "protocol-compliant" attack?
Just like any IP service, it can:
Drop packets
Reorder packets
Delay / jitter packets
Why use "protocol-compliant" attacks ?Detection and diagnosis are time consuming!
6
Example: the JellyFish
� �� �� �� �� ���
���
� �� �� �� �� ���
���
� �� �� �� �� ���
���
Buffer size
JF−reordering node
Pkt Recv
SrcJF
Dst
Random select
Pkt Send
� �� �� �� �� ���
���
7
Example: the JellyFish
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
1 1.5 2 2.5 3 3.5 4 4.5 5
Goo
dput
(M
b/s)
Reordering buffer size
2 hops3 hops4 hops5 hops
Reordering >3 packets reduces TCP throughput to ≈zero!7
The JellyFish
For closed-loop traffic:TCP, TFRC-like...
Passive
Hard to detect...... until after the "sting"
End-to-end control protocols infer network status fromfeedback measurements.
JF interferes with these measurements...
... to attenuate the traffic flows.8
The JellyFish
For closed-loop traffic:TCP, TFRC-like...
Passive
Hard to detect...... until after the "sting"
Species:
JF-Reorder → “multipath”
JF-drop → “congestion, buffer overflow...”
JF-Jitter (variable RTT) → “variable loads” 8
JF-drop
For wired networks: the Shrew [Kuzmanovic & Knightly]
Dropping 5% of the packets periodically (@T = 1sec)
T
Time
SrcJF
Dst
T x d%
9
JF-drop
Dropping 5% of the packets periodically (@T = 1sec)
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0 0.5 1 1.5 2 2.5 3
Goo
dput
(M
b/s)
Time period (s)
2 hops3 hops4 hops5 hops
... reduces TCP throughput to zero!9
JF-drop
TC
P c
on
ges
t. w
ind
ow
Time
JF Outage: ~RTT
9
JF-drop
TC
P c
on
ges
t. w
ind
ow
minRTO
Time
JF Outage: ~RTT
9
JF-drop
TC
P c
on
ges
t. w
ind
ow
minRTO n x minRTO
Time
JF Outage: ~RTT
9
JF-drop
TC
P c
on
ges
t. w
ind
ow
1 sec n x 1 sec
Time
RFC 2988
JF Outage: ~RTT
9
JF-drop
TC
P c
on
ges
t. w
ind
ow
1 sec n x 1 sec
Time
RFC 2988
JF Outage: ~RTT
9
JF-jitter
������ �� �� �� �� �� �� �� ��� �����
JF−jitter−delay node
time
IDLE
Server with vacations
JFDst
Src
10
JF-jitter
TCP infers network/congestion status using RTT...
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0 1 2 3 4 5
Goo
dput
(M
b/s)
Idle period (s)
JF-jitter
JF interferes with RTT to attenuate the TCP flow!10
The BlackHole
For non-responsive / open-loop traffic...
Passive
Forwards routing packets
"Absorbs" all data packets
Hard to detect...11
The BlackHole
MAC/PHY
UpstreamBH
DstMAC/PHY
IP IP
Data
MAC−ACK
Drop!
of MAC layerfailure
Detection
neighbor
MAC ACK avoids immediate diagnosing
11
The BlackHole
MAC/PHY
UpstreamBH
DstMAC/PHY
IP IP
Data
MAC−ACK
Drop!
of MAC layerfailure
Detection
neighbor
(zero throughput)
11
Passive ACK (PACK) [DSR]
A is sending a packet to C via B
A B C
12
Passive ACK (PACK) [DSR]
A overhears B’s transmission/forward to C
A B C
12
Passive ACK (PACK) [DSR]
PACK can be fooled by low-power transmissions...
A B C
12
Passive ACK (PACK) [DSR]
... Or by using directional antennas!
A B C
12
Outline
Introduction and system model
DoS attacks:“Protocol-compliant” attacks: JellyFishBlackHole
The cost of counter-measures
Network performance under DoS attacks
Conclusion
13
Non-goal: escalating the “arms race”
Diagnosis are inevitableLocally ?End-to-end ?
Our goal: how do they perform ?14
The cost of counter-measures
Counter-measure parameters:
Diagnosis time → E(T ndiag)
(re)Route request → E(T nRR)
Routing protocol limitations:
Rate limiter → E(T nRL)
Let:
Flow lifetime → E(TL)
Proportion of JF → p
Path length (for recvd. pkts.) → h
15
The cost of counter-measures
Goodput = E(TL)
E(TL)+(E(T ndiag
)+E(T nRL
)+E(T nRR
))(1−p)−h
0
0.2
0.4
0.6
0.8
1
0 0.1 0.2 0.3 0.4 0.5 0.6
Goo
dput
Fraction of JellyFish Nodes
3 relay nodes6 relay nodes9 relay nodes
Diagnosis and rerouting times get magnified by (1 − p)−h.
(h: average hop-count, p: proportion of JF)15
The cost of counter-measures
Goodput = E(TL)
E(TL)+(E(T ndiag
)+E(T nRL
)+E(T nRR
))(1−p)−h
Mobility
Network size
“PACK++”
Watchdog, path-rater [Marti et al.]
Identifying “Byzantine nodes” [Awerbuch et al.]
Reputation systems [Buchegger et al., Michiardi et al.]
Rushing attack [Hu et al.]
15
Rushing attack [Hu et al.]
16
Rushing attack [Hu et al.]
JF
The malicious node increases its transmission range
16
Rushing attack [Hu et al.]
JF
... to "attract" more flows, therefore increasing p!
16
Rushing attack [Hu et al.]
Goodput = E(TL)
E(TL)+(E(T ndiag
)+E(T nRL
)+E(T nRR
))(1−p)−h
0
0.2
0.4
0.6
0.8
1
0 0.1 0.2 0.3 0.4 0.5 0.6
Goo
dput
Fraction of JellyFish Nodes
no rushing attack2x rushing4x rushing
The rushing attack makes things even worse,exponentiating the effect with hop length!
(h: average hop-count, p: proportion of JF) 16
Rushing attack [Hu et al.]
Goodput = E(TL)
E(TL)+(E(T ndiag
)+E(T nRL
)+E(T nRR
))(1−p)−h
0
0.2
0.4
0.6
0.8
1
0 0.1 0.2 0.3 0.4 0.5 0.6
Goo
dput
Fraction of JellyFish Nodes
no rushing attack2x rushing4x rushing
The goodput collapses under 10% of attackers!
16
Outline
Introduction and system model
DoS attacks:“Protocol-compliant” attacks: JellyFishBlackHole
The cost of counter-measures
Network performance under DoS attacks
Conclusion
17
What about the network resistance?
Simulation setup:
2000m × 2000m topology
200 mobile nodes
Velocity: 0 to 10m/s
Average pause time: 10s
50 UDP flows: 500B packets / 5s, (800b/s)
Clear non-fading channel
Simulation: 100s warmup + 500s simulation
(50 simulations, 18 topologies) / point, 95% conf.intervals
18
What about the network resistance?
System-wide total throughput = sum of E-2-E throughputs:
%
Sys
tem
Th
rpt.
Percentage of JF
18
What about the network resistance?
System-wide total throughput = sum of E-2-E throughputs:
100%
Sys
tem
Th
rpt.
Percentage of JF
18
What about the network resistance?
System-wide total throughput = sum of E-2-E throughputs:
100%
Sys
tem
Th
rpt.
Percentage of JF
18
What about the network resistance?
System-wide total throughput = sum of E-2-E throughputs:
100%
Sys
tem
Th
rpt.
Percentage of JF
18
again ?
DoS increases the capacity of ad-hoc networks!
19
Path length for received packets
0
0.05
0.1
0.15
0.2
0.25
0.3
0.35
0 5 10 15 20
Pro
babi
lity
Number of hops
0 JF / 200 nodes16 JF, Grid. plac. / 200 nodes25 JF, Grid. plac. / 200 nodes49 JF, Grid. plac. / 200 nodes
After DoS: → Long paths are extinguished...
→ Short paths will survive...20
Path length for received packets
− End−to−End throughput = channel capacity− Less interference− More channel reuse
After DoS: → Long paths are extinguished...
→ Short paths will survive...20
Path length for received packets
− End−to−End throughput = channel capacity− Less interference− More channel reuse
− E2E throughput = ch. capacity / 3− More interference− Less channel reuse
After DoS: → Long paths are extinguished...
→ Short paths will survive...20
Path length for received packets
− End−to−End throughput = channel capacity− Less interference− More channel reuse
− E2E throughput = ch. capacity / 3− More interference− Less channel reuse
System throughput maximizer
After DoS: → Long paths are extinguished...
→ Short paths will survive...20
Path length for received packets
− End−to−End throughput = channel capacity− Less interference− More channel reuse
− E2E throughput = ch. capacity / 3− More interference− Less channel reuse
System throughput maximizer
and this is what JF and BlackHoles are doing!20
System throughput
0
0.5
1
1.5
2
2.5
0 5 10 15 20 25
Nor
mal
ized
sys
tem
thro
ughp
ut
Percentage of JFs
50 1Mb/s CBR flows250 1Mb/s CBR flows
5 TCP flows
System throughput often increases after DoS!21
BUT!
0
0.2
0.4
0.6
0.8
1
0 5 10 15 20 25
Jain
’s in
dex
of fa
irnes
s
Percentage of JF
50 1Mb/s CBR flows250 1Mb/s CBR flows
5 TCP50 TCP
System becomes unfair, in favor of short paths.22
After DoS...
Network gets severely partitioned
Short flows survive
Long flows are attenuated
Aggregated system throughput may increase!
23
More in the paper...
We analyze the performance of the system when varyingthe:
Offered load
Network size
Node density
Node mobility
JF placement strategy
24
Outline
Introduction and system model
DoS attacks:“Protocol-compliant” attacks: JellyFishBlackHole
The cost of counter-measures
Network performance under DoS attacks
Conclusion
25
Conclusion
TCP collapses with malicious:Dropping, reordering, jitter ...
More generally, all closed-loop mechanisms arevulnerable to malicious tampering
“Protocol-compliance” makes defense moreproblematic
First paper to quantify DoS effects on ad-hoc networks:DoS increases capacity! BUT!Network gets partitionedFairness decreases→ System throughput, alone, is not enough tomeasure DoS impacts
26
PACK
PACK power
i j k i j k
27
PACK
PACK fool
i j k i j k
27
PACK
PACK directional antenna
i j k i j k
27
Reminder on TCP
TimersCong. Window
Pkt Recv(ACK recv)
Sender Receiver
Data Pkt
ACK
8x
8x
9x
Sender Receiver
Slow Start (SS)
Congest. Avoid. (CA)(cwnd > ssthresh)
b |SRTT−RTT|
SRTT = (1−a) SRTT + a RTT
RTTVAR = (1−b) RTTVAR +
SRTT+ max(G, 4 RTTVAR))
Timers
cwnd += 1/cwnd (CA)
ssthresh
RTO = max(minRTO ,
Cong. Window
Pkt Recv(ACK recv)
cwnd += 1 (SS)
1 RTT
28
Reminder on TCP
TimersCong. Window
Pkt Recv(ACK recv)
Data Pkt
Sender Receiver
28
Reminder on TCP
b |SRTT−RTT|
SRTT = (1−a) SRTT + a RTT
RTTVAR = (1−b) RTTVAR +
SRTT+ max(G, 4 RTTVAR))
Timers
ssthresh
RTO = max(minRTO ,
Cong. Window
Pkt Recv(ACK recv)
cwnd += 1 (SS)
1 RTT
Data Pkt
ACK
Sender Receiver
28
Reminder on TCP
b |SRTT−RTT|
SRTT = (1−a) SRTT + a RTT
RTTVAR = (1−b) RTTVAR +
SRTT+ max(G, 4 RTTVAR))
Timers
ssthresh
RTO = max(minRTO ,
Cong. Window
Pkt Recv(ACK recv)
cwnd += 1 (SS)
1 RTT
Data Pkt
ACK
Sender Receiver
28
Reminder on TCP
b |SRTT−RTT|
SRTT = (1−a) SRTT + a RTT
RTTVAR = (1−b) RTTVAR +
SRTT+ max(G, 4 RTTVAR))
Timers
ssthresh
RTO = max(minRTO ,
Cong. Window
Pkt Recv(ACK recv)
cwnd += 1 (SS)
1 RTT
Data Pkt
ACK
Sender Receiver
28
Reminder on TCP
b |SRTT−RTT|
SRTT = (1−a) SRTT + a RTT
RTTVAR = (1−b) RTTVAR +
SRTT+ max(G, 4 RTTVAR))
Timers
ssthresh
RTO = max(minRTO ,
Cong. Window
Pkt Recv(ACK recv)
cwnd += 1 (SS)
1 RTT
Data Pkt
ACK
Sender Receiver
Slow Start (SS)
28
Reminder on TCP
b |SRTT−RTT|
SRTT = (1−a) SRTT + a RTT
RTTVAR = (1−b) RTTVAR +
SRTT+ max(G, 4 RTTVAR))
Timers
ssthresh
RTO = max(minRTO ,
Cong. Window
Pkt Recv(ACK recv)
cwnd += 1 (SS)cwnd += 1/cwnd (CA)
1 RTT
Data Pkt
ACK
8x
8x
Sender Receiver
Slow Start (SS)
28
Reminder on TCP
b |SRTT−RTT|
SRTT = (1−a) SRTT + a RTT
RTTVAR = (1−b) RTTVAR +
SRTT+ max(G, 4 RTTVAR))
Timers
ssthresh
RTO = max(minRTO ,
Cong. Window
Pkt Recv(ACK recv)
cwnd += 1 (SS)cwnd += 1/cwnd (CA)
1 RTT
Data Pkt
ACK
8x
8x
9x
Sender Receiver
Slow Start (SS)
28
Reminder on TCP
28
Reminder on TCP
1 RTT
Data Pkt
ACK
Sender Receiver
Slow Start (SS)
b |SRTT−RTT|
SRTT = (1−a) SRTT + a RTT
RTTVAR = (1−b) RTTVAR +
SRTT+ max(G, 4 RTTVAR))
Timers
cwnd += 1/cwnd (CA)cwnd += 1 (SS)
ssthresh
RTO = max(minRTO ,
Cong. Window
Pkt loss
Pkt Recv
T.O.)
(dup. ACKs,
(ACK recv)
Duplicate ACK
28
Reminder on TCP
1 RTT
Data Pkt
ACK
Sender Receiver
Slow Start (SS)
b |SRTT−RTT|
SRTT = (1−a) SRTT + a RTT
RTTVAR = (1−b) RTTVAR +
SRTT+ max(G, 4 RTTVAR))
Timers
cwnd += 1/cwnd (CA)cwnd += 1 (SS)
ssthresh
RTO = max(minRTO ,
Cong. Window
Pkt loss
Pkt Recv
T.O.)
(dup. ACKs,
(ACK recv)
Duplicate ACK
28
Reminder on TCP
1 RTT
Data Pkt
ACK
Sender Receiver
Slow Start (SS)
b |SRTT−RTT|
SRTT = (1−a) SRTT + a RTT
RTTVAR = (1−b) RTTVAR +
SRTT+ max(G, 4 RTTVAR))
Timers
cwnd += 1/cwnd (CA)cwnd += 1 (SS)
ssthresh
RTO = max(minRTO ,
Cong. Window
Pkt loss
Pkt Recv
T.O.)
(dup. ACKs,
(ACK recv)
Duplicate ACK
28
Reminder on TCP
1 RTT
Data Pkt
ACK
Sender Receiver
Slow Start (SS)
b |SRTT−RTT|
SRTT = (1−a) SRTT + a RTT
cwnd = 1
RTTVAR = (1−b) RTTVAR +
SRTT+ max(G, 4 RTTVAR))
ssthresh = cwnd / 2
Timers
RTO = RTO x 2
cwnd += 1/cwnd (CA)cwnd += 1 (SS)
ssthresh
RTO = max(minRTO ,
Cong. Window
Pkt loss
Pkt Recv
T.O.)
(dup. ACKs,
(ACK recv)
Duplicate ACK
28
Reminder on TCP
1 RTT
Data Pkt
ACK
Sender Receiver
Slow Start (SS)
b |SRTT−RTT|
SRTT = (1−a) SRTT + a RTT
cwnd = 1
RTTVAR = (1−b) RTTVAR +
SRTT+ max(G, 4 RTTVAR))
ssthresh = cwnd / 2
Timers
RTO = RTO x 2
cwnd += 1/cwnd (CA)cwnd += 1 (SS)
ssthresh
RTO = max(minRTO ,
Cong. Window
Pkt loss
Pkt Recv
T.O.)
(dup. ACKs,
(ACK recv)
Duplicate ACK
/ T.O. ?
28
Reminder on TCP
1 RTT
Data Pkt
ACK
Sender Receiver
Slow Start (SS)
b |SRTT−RTT|
SRTT = (1−a) SRTT + a RTT
cwnd = 1
RTTVAR = (1−b) RTTVAR +
SRTT+ max(G, 4 RTTVAR))
ssthresh = cwnd / 2
Timers
RTO = RTO x 2
cwnd += 1/cwnd (CA)cwnd += 1 (SS)
ssthresh
RTO = max(minRTO ,
Cong. Window
Pkt loss
Pkt Recv
T.O.)
(dup. ACKs,
(ACK recv)
Duplicate ACK
/ T.O. ?
28
JF-drop
TimerRetx
1s
Time
TimersCong. Window
Pkt Recv
Pkt loss
29
JF-drop
TimerRetx
1s−RTT1s
Time1s
1s
TimersCong. Window
Pkt Recv
Pkt losscwnd = 1 RTO = RTO x 2
29
JF-drop
TimerRetx
2s−RTT
1s−RTT1s
2s
Time1s
1s 1s+R
TT
Timers
Pkt loss
Pkt Recv
Cong. Window
SRTT+ max(G, 4 RTTVAR))
RTO = max(minRTO,cwnd +=1 (SS)
29
JF-drop
TimerRetx
2s−RTT
1s−RTT1s
2s
Time1s
1s 1s+2
RT
T1s
+RT
T
Timers
SRTT+ max(G, 4 RTTVAR))cwnd +=1 (SS)
RTO = max(minRTO,
Pkt Recv
Pkt loss
Cong. Window
29
JF-drop
TimerRetx
2s−RTT
1s−RTT1s
2s
Time1s
1s 1s+2
RT
T1s
+RT
T
Timers
SRTT+ max(G, 4 RTTVAR))cwnd +=1 (SS)
RTO = max(minRTO,
Cong. Window
Pkt Recv
Pkt loss
29
JF-drop
TimerRetx
2s−RTT
1s−RTT1s
2s
Time1s
1s 1s+2
RT
T1s
+RT
T
Timers
SRTT+ max(G, 4 RTTVAR))
RTO = max(minRTO,cwnd +=1 (SS)
Pkt Recv
Pkt loss
Cong. Window
29
JF-drop
TimerRetx
2s−RTT
1s−RTT1s
2s
Time1s
1s 1s+2
RT
T1s
+RT
T
t 0
Timers
cwnd = 1 RTO = RTO x 2Pkt loss
Pkt Recv
Cong. Window
29
JF-drop
TimerRetx
2s−RTT
1s−RTT1s
2s
Time1s
1s 1s+2
RT
T1s
+RT
T
t t +2s0
Timers
cwnd = 1 RTO = RTO x 2
0
Pkt loss
Pkt Recv
Cong. Window
29
JF-drop
TimerRetx
SRTT+ max(G, 4 RTTVAR))
RTO = max(minRTO,cwnd +=1 (SS)
2s−RTT
1s−RTT1s
2s
Time1s
1s 1s+2
RT
T1s
+RT
T
t t +2s0
Timers
RTO = RTO x 2
0
cwnd = 1
Pkt Recv
Pkt loss
Cong. Window
29
JF-drop
TimerRetx
SRTT+ max(G, 4 RTTVAR))
RTO = max(minRTO,cwnd +=1 (SS)
2s−RTT
1s−RTT1s
2s
Time1s
1s 1s+2
RT
T1s
+RT
T
t t +2s0
Timers
RTO = RTO x 2
0
cwnd = 1
Pkt Recv
Pkt loss
Cong. Window
t +1s0
29
Simulation results: Number of hops
0
1
2
3
4
5
6
7
502512.580
Ave
rage
num
ber
of h
ops
Percentage of JF
Baseline: 50 1Mb/s CBR flows
30