A comparative analysis of denial of service vulnerabilities in network protocols

Abstract

As global reliance on the Internet continues to grow, Denial of Service [DoS] attacks pose an ever greater threat to society. In recent years the proliferation of poorly secured "Internet of Things" [IoT] devices has enabled attackers to build massive botnets which have delivered on this threat with floods of unprecedented scale. Most mitigation tactics focus on re-routing this trac or preventing devices from becoming compromised. While valiant, these efforts address only the symptoms of a deeper problem: design flaws in network protocols which make the servers supporting them vulnerable to attack. The tremendous complexity and diversity of protocols makes it difficult to analyze their security in a systematic way, and protocol designers still lack a set of best practices for DoS prevention. Establishing such guidelines will require the quantication of attack vectors to determine which protocol features tend to engender the most severe vulnerabilities. Yet an attack's impact depends on characteristics of the server being targeted and of the services it offers, making objective measurement infeasible. Thus, we take a comparative approach to protocol analysis { tracking an array of server- and client-side metrics for various attack vectors in a controlled testbed environment. We develop a software suite for this purpose which can be easily extended to include new metrics and attack types. Initial data from this platform reveals novel attack vectors, indicates which existing protocols are most vulnerable, and lays a foundation for the systematic evaluation of new protocol specifications.