1. Deployable Filtering Architectures Against Denial-of-Service Attacks Department of Computer Science University College London Telephone: +44 (0)20 7679 0401 Fax: +44 (0)20 7679 1397 Electronic Mail: f.huici@cs.ucl.ac.ukf.huici@cs.ucl.ac.uk URL: http://www.cs.ucl.ac.uk/staff/f.huici/ Felipe Huici Transfer Report February 4, 2007

2. Introduction ► Attacks increasing in size and frequency  About 8,000 per day according to Symantec  Botnets reportedly as big as 1,500,000 nodes ► Motivation behind them has changed  Initially perpetrated by “script kiddies” to show off  Now carried out by professional criminals in extortion schemes ► Solution is needed if Internet is to continue to grow

3. Related Work ► Research Field  Proposals often have difficult deployment issues  Initial deployment incentives unclear or misaligned ► Commercial Field  Solutions prohibitively expensive for many  Do not scale to architectural levels ► Still no solution to large, distributed DoS attacks despite years of work

4. 12 Servers ISP Network Routing and Tunneling E-BGP: Advertise S E-BGP Advertise S I-BGP 3 Malicious traffic Monitor Request Filter SSS Normal traffic

5. Edge-to-Edge Architecture D1 D2 F2 F1G1 Host H1 Host H2 Host H3 Server Router Decapsulator Encapsulator Legacy ISP A ISP B ISP C ISP D Legacy ISP E ISP FISP G B1 C1 G1

6. Terminus Architecture B1 B2 B3 B4 A1 A2 A3 A4 Client BP1 BP2 BP3 BP4 Border patrol BM1 BM2 Border manager S IDS FM Filter manager Router C1 B1 A1 D1 E1 F1 F2 D2 ISP A ISP B Legacy ISP C ISP D ISP E ISP F

7. Research Progress ► Design and implementation of encapsulator and decapsulator using Click ► Encapsulator experiments  Basic forwarding  Forwarding plus IP-in-IP encapsulation  Filtering performance  Filter look-up performance  CPU cache trashing ► Decapsulator experiments  Basic forwarding  Forwarding plus decasulation

8. Future Experiment Plan (I) ► Baseline experiments  Click packet generation and counting  Click and Linux basic forwarding performance ► Encapsulator / Border Patrol experiments  Performance when number of decapsulators increases  Scalability of number of filters held  Performance under different mixes of traffic  Design and implementation of different filter types

9. Future Experiment Plan (II) ► Decapsulator / Filter Manager experiments  Performance when dealing with filtering requests  Performance of filter manager when receiving large rate of requests ► Border Manager experiments  Performance when receiving large rate of requests ► Architectural Experiments

10. Time Table # Weeks Dates Task Description 2 3 rd week Feb – 4 th week Feb Baseline experiments 8 1 st week March – 4 th week April Encapsulator and border patrol experiments 3 1 st week May – 3 rd week May Filtering protocol 5 4 th week May – 4 th week June Decapsulator and filter manager experiments 2 1 st week July – 2 nd week July Border manager experiments 10 3 rd week July – 4 th week Sept Architectural experiments 2 1 st week Oct – 2 nd week Oct Buffer time 12 3 rd week Oct – 2 nd week Jan 08 Thesis write-up 1 3 rd week Jan 08 Thesis submission