On the Design and Performance of an Adaptive,Global Strategy for Detecting and Mitigating Distributed DoS Attacks in GRID and Collaborative Workflow Environments

Abstract

While intrusion detection systems have seen a great deal of commercialization in recent years, these products are not geared towards environments, which require support for high-performance applications and open access policy for collaboration. A second limitation of existing intrusion detection systems is their lack of flexibility to deal with the ever-evolving characteristics of the attacks, in terms of diversity and intensity. Moreover, applications in high-performance collaborative environments are very diverse, with possible extreme performance requirements. Consequently, effective strategies to detect attacks in these environments strongly depend on how closely the underlying intrusion detection mechanisms reflect the “specifics” of the application. The focus of this paper is on secure GRID and workflow environments. The purpose is to investigate a distributed defense method that can secure collaborative GRID and workflow environments and neutralize attacks before they reach their potential target en mass. To this end, the paper proposes a progressive, globally deployable sentinel scheme for data sampling, packet inspection, and DoS attack detection and recovery. A simulation framework is developed to study the performance of the proposed scheme. The results show a significant improvement in how the network deals with DoS attacks to secure GRID and workflow environments, in comparison to local DoS detection and prevention schemes.

Keywords

DoS Attacks GRID Collaborative Workflow Environments

Get full access to this article

View all access options for this article.

References

Peng, T. , C. Leckie , and K. Ramamohanarao . (2007). Survey of network-based defense mechanisms countering the DoS and DDoS problems. ACM Computing Surveys 39(1):1—42.

Arbor. ( 2005). Worldwide ISP Security Report. Whitepaper. Arbor Networks, Lexington, MA.

Amoroso, E. (1999). Intrusion Detection. Intrusion.net Books, New Jersey.

Murali, A. , and M. Rao. (2005). A Survey on Intrusion Detection Approaches . In Proceedings of the First International Conference on Information and Communication Technologies, IEEE Communications Society Press, pp. 233—240.

Song, D.X. , and Perrig, A. (2001). Advanced and authenticated marking schemes for IP traceback. In Proceedings of IEEE Infocom, IEEE Communications Society, Anchorage, AK, pp. 878— 886.

Chari, S.N. , and P.-C. Cheng. (2003). BlueBoX: a policy driven host-based intrusion detection system. ACM Transactions on Information and System Security (TISSEC) 6(2):173—200.

Kruegel, C. , T. Toth , and E. Kirda. (2002). Service specific anomaly detection for network intrusion detection. In Proceedings of the Symposium on Applied Computing (SAC), ACM Press . Spain, pp. 201—208.

Keromytis, A. , D.V. Misra , and D. Rubenstein. (2002). SOS: secure overlay services. In Proceedings of SIGCOMM'02, ACM, Pittsburgh, pp. 61—72.

Li, J. , M. Sung , J. Xu , and L. Li. (2004). Large-scale IP traceback in high-speed internet: practical techniques and theoretical foundation. In Proceedings of the IEEE Symposium on Security and Privacy, IEEE Computer Society, Berkeley, CA.

10.

Levchenko, K. , R. Paturi , and G. Varghese. (2004). On the difficulty of scalably detecting network attacks. In Proceedings of ACM CCS, ACM, Washington, pp. 12—20.

11.

Sangpachatanaruk, C. , S.M. Khattab , T. Znati , R. Melhem , and D. Mosse. (2004). Design and analysis of a replicated elusive server scheme for mitigating denial of service attacks . Journal of Systems and Software 73(1):15—29.

12.

Mirkovic, J. , and P. Reiher. (2004). A taxonomy of DDoS attack and DDoS defense mechanisms. ACM Computer Communications Review, 34(2):39—53.

13.

Ioannidis, J. , and S.M. Bellovin. (2002). Implementing pushback — router-based defense against DDoS attacks. In Proceedings of Network and Distributed System Security Symposium, Internet Society, San Diego, CA.

14.

Khattab, S.M. , C. Sangpachatanaruk , D. Mosse , R. Melhem , and T. Znati. (2004). Roaming honeypots for mitigating service-level denial-of-service attacks. In Proceedings of the 24th International Conference on Distributed Computing Systems (ICDCS'04), IEEE Computer Society , Tokyo, Japan, pp. 328— 337.

15.

Mahajan, R. , S. Floyd , J. Ioannidis , V. Paxon , and S. Shenker. (2002). Controlling high bandwidth aggregates in the network. ACM SIGCOMM Computer Communication Review 32(3):62— 73.

16.

Papadopoulos, C. , R. Lindell , J. Mehringer , A. Hussain , and R. Govindan. (2003). Cossack: coordinated suppression of simultaneous attacks. In Proceedings of DISCEX III, IEEE Computer Society, Washington, DC.

17.

Lee, H. , and K. Park. (2001). On the effectiveness of probabilistic packet marking for IP traceback under denial of service attack. In Proceedings of IEEE Infocom, IEEE Communication Society, Anchorage, AK, pp. 338—347.

18.

Denning, D.E. (1987). An intrusion-detection model. IEEE Transactions on Software Engineering 13(2):222—232.

19.

Savage, S. , D. Wethesall , A. Karlin , and T. Anderson. (2000). Practical network support for IP traceback . In Proceedings of SIGCOMM'00, Stockholm, Sweden.

20.

Lunt, T.F. (1993). A survey of intrusion detection techniques. Computers and Security, 12(4):405—418.

21.

Ilgun, K. (1993). USTAT: a real-time intrusion detection system for UNIX. In Proceedings of EEE Computer Society Symposium on Research in Security and Privacy, IEEE Computer Society, Oakland, California, pp. 16—28.

22.

Znati, T. , J. Amadei , D.R. Pazehoski , and S. Sweeny (2006). Design and analysis of an adaptive, global strategy for detecting and mitigating distributed DoS Attacks in GRID Environments . In Proceedings of IEEE Annual Simulation Symposium, IEEE Computer Society, Huntsville, AL, pp. 2—9.

23.

Snoeren, A.C. , C. Partridge , L.A. Sanchez , C.E. Jones , F. Tchakountio , B. Schwartz , et al. (2002). Single packet IP traceback. IEEE/ACM Transactions on Networking (ToN) 10(6):721—734.

24.

Xuan, D. , R. Bettati , and W. Zhao. (2001). A gateway-based defense system for distributed DoS attacks in high-speed networks. In Proceedings of 2001 IEEE Workshop on Information Assurance and Security, pp. 212—219.

25.

Xu, D. , and P. Ning. (2004). Alert correlation through triggering events and common resources. In Proceedings of 20th Annual Computer Security Applications Conference, pp. 360—369.