Mohammad A. Noureddine

Mohammad A. Noureddine, Ahmed Fawaz, Tamer Basar et al.

In this paper, we address the challenges facing the adoption of client puzzles as means to protect the TCP connection establishment channel from state exhaustion DDoS attacks. We model the problem of selecting the puzzle difficulties as a Stackelberg game with the server as the leader and the clients as the followers and obtain the equilibrium solution for the puzzle difficulty. We then present an implementation of client puzzles inside the TCP stack of the Linux 4.13.0 kernel. We evaluate the performance of our implementation and the obtained solution against a range of attacks through experiments on the DETER testbed. Our results show that client puzzles are effective at boosting the tolerance of the TCP handshake channel to state exhaustion DDoS attacks by rate limiting the flood rate of malicious attackers while allocating resources for legitimate clients. Our results illustrate the benefits that the servers and clients amass from the deployment of TCP client puzzles and incentivize their adoption as means to enhance tolerance to multi-vectored DDoS attacks

Ahmed M. Fawaz, Mohammad Noureddine, William H. Sanders

We propose PowerAlert, an efficient external integrity checker for untrusted hosts. Current attestation systems suffer from shortcomings in requiring complete checksum of the code segment, being static, use of timing information sourced from the untrusted machine, or use of timing information with high error (network round trip time). We address those shortcomings by (1) using power measurements from the host to ensure that the checking code is executed and (2) checking a subset of the kernel space over a long period of time. We compare the power measurement against a learned power model of the execution of the machine and validate that the execution was not tampered. Finally, power diversifies the integrity checking program to prevent the attacker from adapting. We implement a prototype of PowerAlert using Raspberry pi and evaluate the performance of the integrity checking program generation. We model the interaction between PowerAlert and an attacker as a game. We study the effectiveness of the random initiation strategy in deterring the attacker. The study shows that \power forces the attacker to trade-off stealthiness for the risk of detection, while still maintaining an acceptable probability of detection given the long lifespan of stealthy attacks.