Phalanx : Withstanding Multimillion-Node Botnets Presented by : Eric Chan, J. Scott Miller

Botnets? A large collection of compromised computers controlled by hackers Widely used to Spam emails Steal identities Launch large scale DDoS attacks

Botnets?

Botnets?

Goals Eventual Communication Protect Established Connections Possible connection regardless of the number of attackers Protect Established Connections Protecting connections once established Unilateral Deployment Deployment on a single ISP without global agreement Endpoint Policy Destination controls which connections to be established Resistance to Compromise Tolerate compromised nodes/routers Autoconfiguration Path changes should be transparent to protection Efficiency Maintain performance even under attack

Our Approach Swarm of machines forward traffic Explicitly request each packet Attacks must down all mailboxes and thus all paths

Mailboxes A large number of machines offer to carry traffic for certain destinations Traffic is stored in mailboxes to be picked up. If ignored it will be dropped from buffer.

Iterated Hash Sequences Each packet in a flow is sent to a cryptographically random mailbox Mailbox is secretly selected by destination; an attacker cannot “follow” a flow by attacking each mailbox just before it is used

Mailbox Sets Tradeoff between performance and resilience Initially select 10 nearby mailboxes Different set for forward and reverse path Nearby according to iPlane Expand/change set based on loss conditions Changes piggybacked on packets

Filtering Ring Filters out unrequested traffic at Tier 1 Each edge router maintains set of requested nonces (white list) and received nonces (blacklist) Implemented with 4 Bloom filters False negatives result in single loss Request added to white list -> sent packet checked again white/black list -> added to bliack list

Nonces, Tokens and Puzzles How does the first packet get through? General purpose request nonce issued by destination Rate is in control of destination Can be issued for range of IPs

Nonces, Tokens and Puzzles Isn’t this an opportunity for attack? Authentication tokens required for connections Take the form of cryptographic puzzles or provider-granted cookies based on previous authentication

Micro-benchmarks on Planetlab Tested Phalanx path between pairs of nodes Ten mailboxes used 25 KBps (25 packets/sec) ~1000 packets/connection Compared with vanilla UDP

Congestion Control TCP ill-suited to the reordering and loss we expect in our system Developed congestion control protocol based on destination-advertised sending rates Losses experienced at mailbox indicated to the destination

Impact on Latency Minor impact on latency

Impact on Loss Minor impact on loss rate

Effect of Attack on Rate Half of mailboxes drop 75% of packets starting at 12 sec Average sending rate (25KBps) maintained

Simulation Router level topology gather by having PL hosts use iPlane to probe Akamai hosts PL hosts act as servers under attack Akamai hosts act as mailboxes

Effect of Limited Deployment 100k attackers, 1000 good hosts Single deployment aides substantially

Effects of Varying Attacker Size For up to 1 million attackers many good hosts see no losses

Conparison with Single-Path Many more acceptable connections with Phalanx

Conclusion Strong DDoS solution for centralized servers Incremental deployment possible Resilient to compromise