Iguatemi E. Fonseca

A Selective Defense for Application Layer DDoS Attacks

Distributed Denial of Service (DDoS) attacks remain among the most dangerous and noticeable attacks on the Internet. Differently from previous attacks, many recent DDoS attacks have not been carried out over the network layer, but over the application layer. The main difference is that in the latter, an attacker can target a particular application of the server, while leaving the remaining applications still available, thus generating less traffic and being harder to detect. Such attacks are possible by exploiting application layer protocols used by the target application. This paper proposes a novel defense for Application Layer DDoS attacks (ADDoS) based on the Adaptive Selective Verification (ASV) defense used for mitigating Network Layer DDoS attacks. We formalize our defense mechanism in the computational system Maude and demonstrate by using the statistical model checker PVeStA that it can be used to prevent ADDoS. In particular, we show that even in the presence of a great number of attackers, an application running our defense still has high levels of availability. Moreover, we compare our results to a defense based on traffic monitoring proposed in the literature and show that our defense is more robust and also leads to less traffic.

Estimating the blocking probability in wavelength-routed optical networks

Abstract In this work, a new methodology to compute the blocking probability in wavelength-routed optical networks is presented. The proposal is based on an interactive procedure, named Interactive Matrix Methodology (IMM), that executes actualization of the network traffic distribution in order to reach a precise blocking performance. The IMM updates an initial network link load continuously and computes the blocking probability for each output link considering that the traffic among the links is dependent and related with all links and nodes in the network, not only with all links in a given path or route. The simulation results obtained in the same conditions and in several optical network scenarios match very well with the theoretical approximation achieved with this methodology. The advantage of this theoretical methodology is to be fast, accurate and applicable in low load regions, where a discrete event simulation is not precise. Furthermore, this method can be used to compute the estimative of blocking probabilities per node and in the network, including the cases where the number of wavelengths is different on each node.

Slow TCAM Exhaustion DDoS Attack

Software Defined Networks (SDN) facilitate network management by decoupling the data plane which forwards packets using efficient switches from the control plane by leaving the decisions on how packets should be forwarded to a (centralized) controller. However, due to limitations on the number of forwarding rules a switch can store in its TCAM memory, SDN networks have been subject to saturation and TCAM exhaustion attacks where the attacker is able to deny service by forcing a target switch to install a great number of rules. An underlying assumption is that these attacks are carried out by sending a high rate of unique packets. This paper shows that this assumption is not necessarily true and that SDNs are vulnerable to Slow TCAM exhaustion attacks (Slow-TCAM). We analyse this attack arguing that existing defenses for saturation and TCAM exhaustion attacks are not able to mitigate Slow-TCAM due to its relatively low traffic rate. We then propose a novel defense called SIFT based on selective strategies demonstrating its effectiveness against the Slow-TCAM attack.

Real-time link quality estimation for industrial wireless sensor networks using dedicated nodes

Adaptive mechanisms, such as dynamic channel allocation or adaptive routing, are used to deal with the variations in the link quality of Wireless Sensor Networks (WSN). In both cases, the first step is to estimate the link quality, so that the network nodes can decide if a channel or route change is needed. This paper proposes a Link Quality Estimator (LQE) for Industrial WSN, and a new type of node, the LQE node, that estimates the link quality in real-time, using the Received Signal Strength Indication (RSSI), and information obtained from received data packets. The proposed LQE is capable of capturing the effects of multipath, interference, and link asymmetry. Experiments were performed in a real industrial environment using IEEE 802.15.4 radios, and models were developed to allow the use of RSSI samples to proper estimate the link quality. A comparison was performed with a state-of-the-art LQE, the Opt-FLQE, and the results showed that the proposed estimator is more accurate and reactive for the type of environment in study. Different from other LQEs in literature, in the proposed LQE the sensor nodes do not need to send broadcast probe packets. Besides, using the LQE node, the other nodes of the WSN do not need to stop their operation to monitor the link quality.

Survey and systematic mapping of industrial Wireless Sensor Networks

Abstract The Wireless Sensor Network (WSN) is an infrastructure comprised of sensing, computing, and communication devices, that obtain and process data to help understand the behavior of the monitored environment, and to react to events and phenomena that occur in it. The WSN can be used in domains such as agriculture, energy, industrial automation, medical health care, smart building, and so on. In industry, the characteristics of the wireless channel are different in comparison to other WSN environments, such as home and office environments. The use of WSN in industry is subject to typical problems of wireless communications, such as noise, shadowing, multipath fading and interference. In addition, the wireless channel in many industrial environments is non-stationary for a long term, which can cause abrupt changes in the characteristics of the channel over time. A set of standards was developed for industrial WSN, to overcome these limitations, such as WirelessHART, ISA100.11a, WIA-PA, and IEEE 802.15.4e. All the mentioned standards are based on the IEEE 802.15.4 physical layer, but define different mechanisms for the upper layers. However, according to recent publications, problems still can arise in the deployment of networks that follow the standards, because of multipath effects, and interference. This survey provides a structured overview of the standards used to implement industrial WSN, their advantages and drawbacks, and discusses the characteristics of the wireless channel in industrial environments. Finally, a systematic mapping is described, that presents results of publications about industrial WSN, and highlights important topics to be studied in this field.

Formal Specification and Verification of a Selective Defense for TDoS Attacks

Telephony Denial of Service (TDoS) attacks target telephony services, such as Voice over IP, not allowing legitimate users to make calls. There are few defenses that attempt to mitigate TDoS attacks, most of them using IP filtering, with limited applicability. In our recent work, we proposed to use selective strategies for mitigating HTTP Application-Layer DDoS Attacks demonstrating their effectiveness in mitigating different types of attacks. This paper demonstrates that selective strategies can also be successfully used to mitigate TDoS attacks, in particular, two attacks: the Coordinated Call Attack and the Prank Call attack. We formalize a novel selective strategy for mitigating these attacks in the computational tool Maude and verify these defenses using the statistical model checker PVeStA. When compared to our experimental results (reported elsewhere), the results obtained by using formal methods were very similar. This demonstrate that formal methods is a powerful tool for specifying defenses for mitigating Distributed Denial of Service attacks allowing to increase our confidence on the proposed defense before actual implementation.

Distributed approach for channel quality estimation using dedicated nodes in industrial WSN

A way to deal with the variations in the link quality of Wireless Sensor Networks (WSN) is the use of strategies for Dynamic Channel Allocation (DCA). The first step to perform DCA is estimating the channel quality, so that the network nodes can decide if a channel change is needed, and the best channel to be used. This paper proposes a distributed approach with nodes dedicated to monitor channel quality, by using the Received Signal Strength Indication (RSSI) and the Link Quality Indicator (LQI) to identify low quality channels. This approach is acceptable in industrial WSN, since the network deployment can be performed with adequate planning. Furthermore, the sensor nodes do not need to stop their operation for monitoring the channel quality. As a first step, experiments were performed in a real industrial environment to identify the relation between RSSI and LQI traces, and the Packet Error Rate for different channels, by using IEEE 802.15.4 radios operating in the 2.4 GHz band.

On the Accuracy of Formal Verification of Selective Defenses for TDoS Attacks

Telephony Denial of Service (TDoS) attacks target telephony services, such as Voice over IP (VoIP), not allowing legitimate users to make calls. There are few defenses that attempt to mitigate TDoS attacks, most of them using IP filtering, with limited applicability. In our previous work, we proposed to use selective strategies for mitigating HTTP Application-Layer DDoS Attacks demonstrating their effectiveness in mitigating different types of attacks. Developing such types of defenses is challenging as there are many design options, eg, which dropping functions and selection algorithms to use. Our first contribution is to demonstrate both experimentally and by using formal verification that selective strategies are suitable for mitigating TDoS attacks. We used our formal model to help decide which selective strategies to use with much less effort than carrying out experiments. Our second contribution is a detailed comparison of the results obtained from our formal models and the results obtained by carrying out experiments. We demonstrate that formal methods is a powerful tool for specifying defenses for mitigating Distributed Denial of Service attacks allowing to increase our confidence on the proposed defense before actual implementation.

Comparison between Channel Hopping and Channel Adaptation for Industrial Wireless Sensor Networks.

One of the differences between the new standard IEEE 802.15.4e, in comparison to the previous IEEE 802.15.4 standard, is the use of multiple channels. The Time-Slotted Channel Hopping (TSCH) mode employs channel hopping, and the Deterministic and Synchronous Multi-channel Extension (DSME) mode employs channel hopping or channel adaptation, during the contention free periods. When using the channel adaptation as the channel diversity technique, a pair of nodes communicate using the same channel while the channel quality is good enough in terms of signal-to-noise ratio. Thus, it is necessary to evaluate the quality of the links, in order to proper use this mechanism. In this paper, three different approaches, based on the DSME protocol, were implemented and evaluated through a simulation study. The first one (CH-DSME) is based on a simple channel hopping mechanism, the second one (CA-DSME) employs channel adaptation, and the third one is a novel hybrid approach (H-DSME), that uses both channel hopping and channel adaptation. The H-DSME outperformed the other two approaches for the scenario in consideration, which shows that the use of channel adaptation is better than channel hopping for the transmission of unicast packets, when the quality of the links are monitored continuously. However, for packets transmitted in broadcast by the coordinator, the use of channel hopping is a good alternative to deal with the spatial variation in the quality of the channels.

A Training System to Help Professionals in the Electric Sector in Risky Operations

This paper aims at showing a simulator with the educational intent based on operations of the electricity sector that will be able to help professionals that realize tasks of constant danger as change of insulators is aerial lift control. The simulator provides a realistic system of environments to operator giving illusion of the situation found in their everyday, the simulator presents warning signs and error messages when practicing premature or precipitated actions to the current action. It is also reported the simulator activity processor that has as main objective to assist in the development of new applications using Virtual Reality, focusing mainly on practices of procedures and evaluation of the actions performed by the operator.