1. Phalanx : Withstanding Multimillion-Node Botnets
Presented by : Eric Chan, J. Scott Miller

2. Botnets?
A large collection of compromised computers controlled by hackers
Widely used to
Spam s
Steal identities
Launch large scale DDoS attacks

3. Botnets?

4. Botnets?

5. Goals Eventual Communication Protect Established Connections
Possible connection regardless of the number of attackers
Protect Established Connections
Protecting connections once established
Unilateral Deployment
Deployment on a single ISP without global agreement
Endpoint Policy
Destination controls which connections to be established
Resistance to Compromise
Tolerate compromised nodes/routers
Autoconfiguration
Path changes should be transparent to protection
Efficiency
Maintain performance even under attack

6. Our Approach Swarm of machines forward traffic
Explicitly request each packet
Attacks must down all mailboxes and thus all paths

7. Mailboxes
A large number of machines offer to carry traffic for certain destinations
Traffic is stored in mailboxes to be picked up. If ignored it will be dropped from buffer.

8. Iterated Hash Sequences
Each packet in a flow is sent to a cryptographically random mailbox
Mailbox is secretly selected by destination; an attacker cannot “follow” a flow by attacking each mailbox just before it is used

9. Mailbox Sets Tradeoff between performance and resilience
Initially select 10 nearby mailboxes
Different set for forward and reverse path
Nearby according to iPlane
Expand/change set based on loss conditions
Changes piggybacked on packets

10. Filtering Ring Filters out unrequested traffic at Tier 1
Each edge router maintains set of requested nonces (white list) and received nonces (blacklist)
Implemented with 4 Bloom filters
False negatives result in single loss
Request added to white list -> sent packet checked again white/black list -> added to bliack list

11. Nonces, Tokens and Puzzles
How does the first packet get through?
General purpose request nonce issued by destination
Rate is in control of destination
Can be issued for range of IPs

12. Nonces, Tokens and Puzzles
Isn’t this an opportunity for attack?
Authentication tokens required for connections
Take the form of cryptographic puzzles or provider-granted cookies based on previous authentication

13. Micro-benchmarks on Planetlab
Tested Phalanx path between pairs of nodes
Ten mailboxes used
25 KBps (25 packets/sec)
~1000 packets/connection
Compared with vanilla UDP

14. Congestion Control
TCP ill-suited to the reordering and loss we expect in our system
Developed congestion control protocol based on destination-advertised sending rates
Losses experienced at mailbox indicated to the destination

15. Impact on Latency
Minor impact on latency

16. Impact on Loss
Minor impact on loss rate

17. Effect of Attack on Rate
Half of mailboxes drop 75% of packets starting at 12 sec
Average sending rate (25KBps) maintained

18. Simulation
Router level topology gather by having PL hosts use iPlane to probe Akamai hosts
PL hosts act as servers under attack
Akamai hosts act as mailboxes

19. Effect of Limited Deployment
100k attackers, 1000 good hosts
Single deployment aides substantially

20. Effects of Varying Attacker Size
For up to 1 million attackers many good hosts see no losses

21. Conparison with Single-Path
Many more acceptable connections with Phalanx

22. Conclusion Strong DDoS solution for centralized servers
Incremental deployment possible
Resilient to compromise