Shrew Attack Research Articles

TCP/IP stack transport layer performance, privacy, and security issues

Transmission Control Protocol/ Internet Protocol (TCP/IP) is the backbone of Internet transmission. The Transport Layer of the TCP/IP stack, which includes TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) protocols, plays a crucial role in ensuring reliable communication between devices over a network. To come up with measures that make networks more secure, it is important to learn about the vulnerabilities that exist in the transport TCP/IP stack and then have an understanding of the typical attacks carried out in such layer. This paper explores how the TCP Protocol works, the TCP/IP 3 Way Handshake, TCP Header Structure, the typical vulnerabilities and the classical attacks of transport layer TCP/IP, tools, and solutions adopted to prevent and reduce the chances of some of these attacks. The findings indicated that the major TCP/ IP stack transport layer threats include Finger printing, SYN Flood, TCP reassembly and sequencing, IP Spoofing, TCP session hijacking, RST and FIN denial of service attack, Ping of Death, Low Rate/ Shrew Attacks. Their preventive measures and mechanisms are discussed.

An SDN-Assisted Defense Mechanism for the Shrew DDoS Attack in a Cloud Computing Environment

The integration of cloud computing with Software Defined Networking (SDN) addresses several challenges of a typical cloud infrastructure such as complex inter-networking, data collection, fast response, etc. Though SDN-based cloud opens new opportunities, the SDN controller may itself become vulnerable to several attacks. The unique features of SDN are used by the attackers to implement the severe Distributed Denial of Service (DDoS) attacks. Several approaches are available in literature to defend against the traditional DDoS flooding attacks in SDN-cloud. To elude the detection systems, attackers try to employ the cultivated attack strategies. Such sophisticated DDoS attack strategies are implemented by generating low-rate attack traffic. The most common type of Low-Rate DDoS (LR-DDoS) attack is the Shrew attack. The existing approaches are not capable to detect, mitigate, and traceback such attacks. Thus, this work discusses a new mechanism which not only detects and mitigates the shrew attack but traces back the location of the attack sources as well. The attack is detected using the information entropy variations, and the attack sources are traced-back using the deterministic packet marking scheme. The experiments are performed in a real SDN-cloud scenario, and the experimental results show that the approach requires 1 packet and 8.27 packets on an average to locate the bots and attackers respectively. The approach detects and traces back the attack sources in between 14.45 ms to 10.02 s and provides 97.6% accuracy.

Low-High Burst: A Double Potency Varying-RTT Based Full-Buffer Shrew Attack Model

The full-buffer Shrew (FB-Shrew) denial of service (DoS) attack is a variant of the classic Shrew attack that exploits the congestion control mechanism of transmission control protocol (TCP). Here, an attacker sends a high-rate burst of attack packets only after the router buffer is filled with TCP packets, causing the router to drop legitimate packets, and forcing the retransmission of TCP packets. As such, an FB-Shrew attack can cause maximum damage with minimum resources. In this paper, we challenge an assumption of constant round trip time adopted in the original FB-Shrew model. As a result, this model fails to achieve its expected attack effect. In response, we analyze the TCP congestion window and queue behaviors to develop two low-high burst models for maximizing the potency of the FB-Shrew attack. Model 1 is designed to achieve the attack effect expected of the original model. Then, the attack potency of Model 1 is enhanced by simply adjusting the starting time of the attack burst to form Model 2. Mode 1 only exploits the retransmission timeout (RTO) mechanism. Model 2 takes advantage of both the RTO mechanism and the fast retransmission mechanism. In this way, Model 2 further slows down the growth of the congestion window and extends the attack period. A combination of theoretical analyses and simulations are adopted to first validate the proper functioning and effectiveness of the two models for a standard network configuration, and then we assess their attack performances with variations in different network parameters. Our performance assessment demonstrates that one attack unit of Model 2 damages almost twice the number of TCP units as one attack unit of Model 1, which represents an increase in attack potency of nearly 200 percent. The present study provides an expanded basis to explore FB-Shrew attack patterns that may be utilized by attackers. Moreover, the damage that could be inflicted by such attack and the extent to which defense strategies are capable of mitigating the attack's impact could be assessed more precisely by defenders.

A New Exploration of FB-Shrew Attack

Shrew attack is a type of typical transmission control protocol (TCP)-targeted low-rate denial of service attacks. Guirguis proposed a variant of the Shrew attack, which is called the full-buffer Shrew (FB-Shrew) attack. By maximizing the attack period and minimizing the attack rate, FB-Shrew attack can achieve the optimal impact. However, Guirguis’s study has some limitations that mainly lie in neglecting the competition between TCP packets and attack packets. In this letter, we restudy the behavior model of TCP congestion window with a single TCP flow to expose the upper bound of attack impact. Test results of NS-2 experiments indicate that, compared with Guirguis’s model, our model provides a more realistic, more accurate, and higher upper bound on the impact of the FB-Shrew attack.

A Study on High Rate Shrew DDOS Attack

Denial of Service attacks is frequently presenting an increasing threat to the global inter-networking infrastructure in networking area and scenario. The algorithm for Transfer Control Protocol (TCP) congestion control is highly efficient for the various networking areas and operations as well its internal assumption of end-system cooperation results is well prone to attack by high-rate flows. A Shrew attack uses the concept of a low-rate burst which is carefully designed to use the TCP’s retransmission timeout mechanism in an unfair way and can affect the bandwidth of a TCP flow in a smooth manner without coming into appearance as an intruder. A Shrew attack has further classifications such as a low rate shrew attack or a high rate shrew attack. A high rated shrew attack uses the concept of timely sending high rate packet stream in low frequency. Such attack can affect the performance of a network to a large extent.

On a Mathematical Model for Low-Rate Shrew DDoS

The shrew distributed denial of service (DDoS) attack is very detrimental for many applications, since it can throttle TCP flows to a small fraction of their ideal rate at very low attack cost. Earlier works mainly focused on empirical studies of defending against the shrew DDoS, and very few of them provided analytic results about the attack itself. In this paper, we propose a mathematical model for estimating attack effect of this stealthy type of DDoS. By originally capturing the adjustment behaviors of victim TCPs congestion window, our model can comprehensively evaluate the combined impact of attack pattern (i.e., how the attack is configured) and network environment on attack effect (the existing models failed to consider the impact of network environment). Henceforth, our model has higher accuracy over a wider range of network environments. The relative error of our model remains around 10% for most attack patterns and network environments, whereas the relative error of the benchmark model in previous works has a mean value of 69.57%, and it could be more than 180% in some cases. More importantly, our model reveals some novel properties of the shrew attack from the interaction between attack pattern and network environment, such as the minimum cost formula to launch a successful attack, and the maximum effect formula of a shrew attack. With them, we are able to find out how to adaptively tune the attack parameters (e.g., the DoS burst length) to improve its attack effect in a given network environment, and how to reconfigure the network resource (e.g., the bottleneck buffer size) to mitigate the shrew DDoS with a given attack pattern. Finally, based on our theoretical results, we put forward a simple strategy to defend the shrew attack. The simulation results indicate that this strategy can remarkably increase TCP throughput by nearly half of the bottleneck bandwidth (and can be higher) for general attack patterns.

Shrew Attack Prevention in RED Queue with Partial Flow Analysis

Shrew Attacks or Low Rate Denial of Service(LDoS) Attacks are initiated by sending large amount of packets for very short span of time such that the packet sending rate crosses the link capacity resulting in network congestion. Compared to Denial of Service (DoS) Attack, LDoS attack is very difficult to be detected because, the attacker can maintain low average packet sending rate while executing an attack. If the rate and interval of LDoS attack is properly estimated and executed, this attack can cause a severe threat to the retransmission time out adjustment of TCP and hence reduce its throughput to near zero. This paper proposes a lightweight LDoS filter which can be added with Preferential Dropping RED, to detect and prevent LDoS packets before they reach RED dropping policy. The advantage of this method is that only partial flows need to be analyzed to detect an attack. Simulations done in NS2 shows that, our method can effectively mitigate LDoS attack while maintaining fairness in bandwidth and low average queuing delay. General Terms Networking, Security, Intrusion Detection System

Shrew Attack on Internet Congestion Control Protocol in Control Engineering

Low-rate Denial of Service(LDoS) attacks with their hidden,high efficiency features can significantly degrade service performance of large number of connection-oriented services,or even worse,thoroughly deny the services.Shrew attack is a typical LDoS attack.Firstly we studied the basic mechanism of the attack and congestion control.The source of adaptive congestion control mechanism in the security vulnerability was revealed according to the different levels of the intrinsic link between Internet congestion control at TCP layer and IP layer.Secondly,using the Network simulator NS2 software package,we set up attack model to simulate a large number of attack experiments with various congestion control mechanism and algorithms.Finally we draw the conclusions that continuous Shrew attack makes services nearly crash,while congestion control algorithms taking into account of fairness,such as Stochastic Fairness Queuing (SFQ) and Deficit Round Robin (DRR),can effectively suppress such kind of attack.

Redball: Throttling Shrew Attack in Cloud Data Center Networks

In homeland security and defense, cloud security is critical. As an increasing number of governments and organizations outsource their computing to the cloud, they at the same time make it an attractive target for terrorists and hackers. Cloud computing offers a great opportunity for improved productivity and lowered cost, however, it meanwhile raises potential security issues as attackers from around the nation or world could be its legal tenants. This paper studies one of the potential security problem, namely, legal yet malicious tenants would launch low-rate DoS (Denial of Service) attack (or Shrew attack for short) to the co-residents once they rent and control a part of computing resources. To explore the feasibility and understand the possible attack pattern, we try to identify bottlenecks in the underlying DCNs (Data Center Networks), and then attack the victim with as little traffic. Moreover, an analytical model is built to quantitatively analyze the necessary and sufficient traffic for an effective attack. Finally, we propose a universal receiver-enforced dynamic bandwidth allocation technique named Redball to enhance defense capabilities of the cloud. Redball could intelligently throttle shrew attack in DCNs by decomposing its group behavior, enforce an average fair share of bandwidth among tenants in a workconserving way, and yet sacrifice only a small proportion of flows by delaying allocating bandwidth for them. Further, our proposal modifies only the endpoints, leaving the network gears untouched.

The neurobiology of Etruscan shrew active touch.

The Etruscan shrew, Suncus etruscus, is not only the smallest terrestrial mammal, but also one of the fastest and most tactile hunters described to date. The shrew's skeletal muscle consists entirely of fast-twitch types and lacks slow fibres. Etruscan shrews detect, overwhelm, and kill insect prey in large numbers in darkness. The cricket prey is exquisitely mechanosensitive and fast-moving, and is as big as the shrew itself. Experiments with prey replica show that shape cues are both necessary and sufficient for evoking attacks. Shrew attacks are whisker guided by motion- and size-invariant Gestalt-like prey representations. Shrews often attack their prey prior to any signs of evasive manoeuvres. Shrews whisk at frequencies of approximately 14 Hz and can react with latencies as short as 25–30 ms to prey movement. The speed of attacks suggests that shrews identify and classify prey with a single touch. Large parts of the shrew's brain respond to vibrissal touch, which is represented in at least four cortical areas comprising collectively about a third of the cortical volume. Etruscan shrews can enter a torpid state and reduce their body temperature; we observed that cortical response latencies become two to three times longer when body temperature drops from 36°C to 24°C, suggesting that endothermy contributes to the animal's high-speed sensorimotor performance. We argue that small size, high-speed behaviour and extreme dependence on touch are not coincidental, but reflect an evolutionary strategy, in which the metabolic costs of small body size are outweighed by the advantages of being a short-range high-speed touch and kill predator.

The taming of the shrew: mitigating low-rate TCP-targeted attack

A Shrew attack, which uses a low-rate burst carefully designed to exploit TCP's retransmission timeout mechanism, can throttle the bandwidth of a TCP flow in a stealthy manner. While such an attack can significantly degrade the performance of all TCP-based protocols and services including Internet routing (e.g., BGP), no existing scheme clearly solves the problem in real network scenarios. In this paper, we propose a simple protection mechanism, called SAP (Shrew Attack Protection), for defending against a Shrew attack. Rather than attempting to track and isolate Shrew attackers, SAP identifies TCP victims by monitoring their drop rates and preferentially admits those packets from the victims with high drop rates to the output queue. This is to ensure that well-behaved TCP sessions can retain their bandwidth shares. Our simulation results indicate that under a Shrew attack, SAP can prevent TCP sessions from closing, and effectively enable TCP flows to maintain high throughput. SAP is a destination-port-based mechanism and requires only a small number of counters to find potential victims, which makes SAP readily implementable on top of existing router mechanisms.

Mathematical Model for Low-Rate DoS Attacks Against Application Servers

In recent years, variants of denial of service (DoS) attacks that use low-rate traffic have been proposed, including the Shrew attack, reduction of quality attacks, and low-rate DoS attacks against application servers (LoRDAS). All of these are flooding attacks that take advantage of vulnerability in the victims for reducing the rate of the traffic. Although their implications and impact have been comprehensively studied, mainly by means of simulation, there is a need for mathematical models by which the behaviour of these sometimes complex processes can be described. In this paper, we propose a mathematical model for the LoRDAS attack. This model allows us to evaluate its performance by relating it to the configuration parameters of the attack and the dynamics of network and victim. The model is validated by comparing the performance values given against those obtained from a simulated environment. In addition, some applicability issues for the model are contributed, together with interpretation guidelines to the model's behaviour. Finally, experience of the model enables us to make some recommendations for the challenging task of building defense techniques against this attack.

On the impacts of low rate DoS attacks on VoIP traffic

AbstractLow rate TCP DoS (Shrew) and reduction of quality (RoQ) attacks have been proven to be detrimental to TCP traffic in the Internet. In this paper, we investigate the effect of these attacks on QoS sensitive, real time UDP traffic, like VoIP. Both of these attacks are difficult to detect, as the average attack traffic is low. These stealthy RoQ attacks are especially hard to detect as their periodicity is not well‐defined, and the attacks can contain spoofed source as well as destination IP addresses. Extensive ns2 simulations have been performed under realistic scenarios to validate the effects of these attacks on real time VoIP traffic using the G711 and G729a audio codecs. Forward Error Correction (FEC) is also considered in our analysis to recover packets from the packet loss caused by attacks. Without FEC, these attacks can drastically reduce the quality of VoIP traffic, leading to denial of service. To evaluate the perceptual quality of voice under attacks, the network losses are mapped to user's quality perception by using the ITU E‐model. The MOS range of the E‐model decreases from best to medium due to the low rate TCP DoS and RoQ attacks even when FEC is deployed. In some of the attack scenarios, the packet losses are bursty, which can lead to dropped calls. In addition, the stealthy RoQ attacks with higher burst lengths are as effective as the shrew attack in impairing VoIP traffic. We have also evaluated the effects of the attack on the VoIP traffic on the DETERLAB testbed, which has specifically been built for conducting network security research, and the results are consistent with the ns2 simulation results. We believe our investigation is important to remove the misconception about low rate TCP DoS and RoQ attacks that they affect only TCP traffic in the Internet. Copyright © 2008 John Wiley & Sons, Ltd.

Collaborative detection and filtering of shrew DDoS attacks using spectral analysis

This paper presents a new spectral template-matching approach to countering shrew distributed denial-of-service (DDoS) attacks. These attacks are stealthy, periodic, pulsing, and low-rate in attack volume, very different from the flooding type of attacks. They are launched with high narrow spikes in very low frequency, periodically. Thus, shrew attacks may endanger the victim systems for a long time without being detected. In other words, such attacks may reduce the quality of services unnoticeably. Our defense method calls for collaborative detection and filtering (CDF) of shrew DDoS attacks. We detect shrew attack flows hidden in legitimate TCP/UDP streams by spectral analysis against pre-stored template of average attack spectral characteristics. This novel scheme is suitable for either software or hardware implementation. The CDF scheme is implemented with the NS-2 network simulator using real-life Internet background traffic mixed with attack datasets used by established research groups. Our simulated results show high detection accuracy by merging alerts from cooperative routers. Both theoretical modeling and simulation experimental results are reported here. The experiments achieved up to 95% successful detection of network anomalies along with a low 10% false positive alarms. The scheme cuts off malicious flows containing shrew attacks using a newly developed packet-filtering scheme. Our filtering scheme retained 99% of legitimate TCP flows, compared with only 20% TCP flows retained by using the Drop Tail algorithm. The paper also considers DSP, FPGA, and network processor implementation issues and discusses limitations and further research challenges.

Short-Tailed Shrew Attacks Garter Snake

Short-Tailed Shrew Attacks Garter Snake

Short-Tailed Shrew Attacks Young Snowshoe Hare

Short-Tailed Shrew Attacks Young Snowshoe Hare