Kareem Amin

A moving target defense approach to mitigate DDoS attacks against proxy-based architectures

Distributed Denial of Service attacks against high-profile targets have become more frequent in recent years. In response to such massive attacks, several architectures have adopted proxies to introduce layers of indirection between end users and target services and reduce the impact of a DDoS attack by migrating users to new proxies and shuffling clients across proxies so as to isolate malicious clients. However, the reactive nature of these solutions presents weaknesses that we leveraged to develop a new attack - the proxy harvesting attack - which enables malicious clients to collect information about a large number of proxies before launching a DDoS attack. We show that current solutions are vulnerable to this attack, and propose a moving target defense technique consisting in periodically and proactively replacing one or more proxies and remapping clients to proxies. Our primary goal is to disrupt the attackers reconnaissance effort. Additionally, to mitigate ongoing attacks, we propose a new client-to-proxy assignment strategy to isolate compromised clients, thereby reducing the impact of attacks. We validate our approach both theoretically and through simulation, and show that the proposed solution can effectively limit the number of proxies an attacker can discover and isolate malicious clients.

Strategic Payment Routing in Financial Credit Networks

Credit networks provide a flexible model of distributed trust, which supports transactions between untrusted counterparties through paths of intermediaries. We extend this model by introducing interest rates (prices on lines of credit), both as a means to incentivize credit issuance and to provide a framework for modeling networks of financial relationships. Including interest rates poses a new constraint on transactions, as intermediaries will route payments only if the interest received covers any interest paid. We account for these constraints in an efficient algorithm for finding the maximum transaction flow between two agents in a financial network. There are generally many feasible payment paths serving a given transaction, and we show that the policy for selecting among such paths can have a substantial effect on liquidity, as measured by steady-state probability of transaction success. Finally, we consider the situation where the transaction source can choose among heuristic path selection mechanisms, in order to maximize their payoff. Through empirical game-theoretic analysis, we find that routing is inefficient due to the positive externality of choices promoting network liquidity. However, agent choices do reflect some consideration of overall network liquidity, in addition to their own interest payments.