1. CONTRA Camouflage of Network Traffic to Resist Attack (Intrusion Tolerance Using Masking, Redundancy and Dispersion)
DARPA OASIS PI Meeting – Hilton Head – March 12-15, 2002
Janet Lepanto
William Weinstein
The Charles Stark Draper Laboratory, Inc.
Aegis Research Corporation®
Aegis Research Corporation

2. DDoS Flooding Attack is Analogous to Jamming
DDoS Flooding Attacks
DDoS Flooding Attack is Analogous to Jamming
Jammer concentrates energy at a particular frequency and location
Jamming
Attacker directs traffic against a particular IP address
DDoS Flood
Frequency Hopping
Jamming Defenses
IP Address Masking
IP Address Hopping
Flooding Defenses
Energy Dispersion
IP Identity Dispersion

3. Key Ideas Spread the identity of a server across multiple IP addresses
Add redundancy to each message, and send a portion of each message to each of the IP addresses of the server
If some of the addresses are flooded, that traffic can be dropped
The messages can be reconstructed from the remaining traffic
Prevent an attacker from associating a set of addresses with a particular server
Force the attacker to dilute the attack by spreading the flood across randomly chosen sets of IP addresses

4. Assumptions CONTRA system comprises a set of cooperating hosts
Communicate among themselves over the Internet
Servers could be made available to outsiders by designating some of the clients as gateways
Attacker attempts to determine address(es) of high value target
By monitoring traffic at one or more accessible points of the Internet
By analyzing communication patterns
Attacker can use public data to determine IP block assignments
Attacker knows the organization that is communicating
Pipes have sufficient capacity to accommodate the total traffic

5. Approach Leverage selected aspects of Consider ease of deployment
VPNs
Anonymity systems
Fault-tolerant communications
Consider ease of deployment
Implement as a communications proxy on top of UDP
Redundancy in messages provides reliability
Real source IP addresses can be masked
Structure protocols to support
Continuous operation through attack
Distribution of reconfiguration information
Monitoring of attack progress
Extension to mitigate “insider” attacks

6. Implementation
Messages are sent from a source to a destination host as follows:
Messages are encoded with redundancy and divided into N parts, any K<N of which can be used to recover the message
The N parts are sent over different paths, each of which contains at least one relay host that functions as a mix
The N parts of the message are dispersed across all of the IP addresses that define the destination host
The “real” IP addresses of the source and destination, and the message content, are encrypted
Only the IP addresses of individual hops are exposed
A virtual network topology can be chosen that exposes only a portion of the system’s IP address to an attacker sniffing at a single point

7. Message Encoding X = -1 X = ? Predetermined Transformation Origin Host
Relay Host
MESSAGE ?
NETWORK M1 M2 M3
T11
T31
T41
T12
T32
T42
T13
T33
T43 -1
T21
T51
T22
T52
T23
T53
SELECT 1, 3, 4
T11
T21
T31
T41
T51
T12
T22
T32
T42
T52
T13
T23
T33
T43
T53 X Z1 Z2 Z3 Z4 Z5 = Z1 Z3 Z5 Z4
Destination Host w/ Multiple IP Addresses Z1 Z3 Z4 X = M1 M2 M3
MESSAGE

8. CONTRA Packet Structure
Encrypted Between Hops
Encrypted Source-to-Destination
IP Header
Transport Header
CONTRA Header
Payload
Contains:
Real SourceIP/port
Real Destination IP/port
K-of-N Encoding
Msg Segment Number
Padding
Source/relay host status
Vnet configuration status

9. Message Relay
Relay
Host
Destination
Source

10. Relay Operations Decrypt CONTRA header Extract real destination
Change padding
Reencrypt with key of next hop
Mix

11. Server IP Address Assignments
Internet
Server listens on M >= N addresses
K<N parts needed to rebuild message
Site Router
Server
Client
Server

12. Challenges Robustness of traffic mixing “Insider” attacks
Minimum level of traffic
“Insider” attacks
Clients are users as well as relays
The CONTRA proxy on the client needs to know the real addresses of CONTRA destinations
Need to protect this information