Adaptive Selective Verification: An Efficient Adaptive Countermeasure to Thwart DoS Attacks

作者：Khanna Sanjeev^*; Venkatesh Santosh S; Fatemieh Omid; Khan Fariba; Gunter Carl A

来源：IEEE/ACM Transactions on Networking, 2012, 20(3): 715-728.

DOI：10.1109/TNET.2011.2171057

• Bandwidth
• distributed denial of service (DDoS)
• performance analysis
• selective verification
• shared channel model
• theorem

Denial-of-service (DoS) attacks are considered within the province of a shared channel model in which attack rates may be large but are bounded and client request rates vary within fixed bounds. In this setting, it is shown that clients can adapt effectively to an attack by increasing their request rate based on timeout windows to estimate attack rates. The server will be able to process client requests with high probability while pruning out most of the attack by selective random sampling. The protocol introduced here, called Adaptive Selective Verification (ASV), is shown to use bandwidth efficiently and does not require any server state or assumptions about network congestion. The main results of the paper are a formulation of optimal performance and a proof that ASV is optimal.

• 出版日期2012-6