1. Denial-of-Service Flooding Detection in Anonymity Networks Computer Networks & Communications Group Institute for IT-Security and Security Law University of Passau Germany Performance Measurement and Management for Two-Level Optimization of Networks and Peer-to-Peer Applications (GR/S69009/01) Network of Excellence: Design and Engineering of the Future Generation Internet (IST-028022) Jens Oberender Melanie Volkamer Hermann de Meer MonAM 2007 LAAS-CNRS, Toulouse, France 5. November 2007

2. jens.oberender@uni-passau.de Attacks in Anonymity Networks  Chaum’s Mixer  A sender remains anonymous, if an adversary catches no evidence on sender identity  How to protect receivers from anonymous flooding attacks? 1. Enable traffic flow detection  DoS attack detection 2. Prevent anonymity breach  protect sender identity  Message Tagging 21.10.2015DoS Flooding Detection in Anonymity Networks2

3. jens.oberender@uni-passau.de Linkability Continuum  Two messages are linkable by an adversary, if evidence on their relation can be provided.  Pseudonyms –Adversary links all messages  malicious profiling  Unobservability +Observer cannot link any messages together  Limited Linkability  Restricted number of linkable messages  Enables traffic flow clustering 21.10.2015DoS Flooding Detection in Anonymity Networks3 1  NoneLifelong #Messages per Profile Message Linkability Limited

4. jens.oberender@uni-passau.de Attacker Model Security Objectives 1. Limited linkability 2. Linkability resistant to malicious influence 21.10.2015DoS Flooding Detection in Anonymity Networks4 Privacy Adversary Aim: disclose sender anonymity Observe incoming tags Collude with other DoS engines Message Flooding Attacker Aim: Denial-of-Service Exhausts victim resources DoS Mitigation Adversary Access Control Attacker Anonymity Network Access Control Adversary Receiver Access Control Adversary Receiver Assumptions  Anonymity Network unbroken  Access Control Entity trusted by sender & receivers

5. jens.oberender@uni-passau.de Message tagging  Fast, local traffic flow cluster criteria  Hash from characteristic strings (key derivation function)  Values not comparable with fresh salt  Linkability control Tag properties  Sender differentiate senders  Receiverdisables cross-server profiling  Time Framedisables lifelong linkability 21.10.2015DoS Flooding Detection in Anonymity Networks5

6. jens.oberender@uni-passau.de Internal vs. External Tags Anonymity Attack using external tags  Collude to learn anonymous paths Proposed internal Message Tagging  Tags reside within encrypted channel 21.10.2015DoS Flooding Detection in Anonymity Networks6

7. jens.oberender@uni-passau.de Clustering of Anonymous Traffic Flows  Anonymous Messages  Header data stripped off, application level analysis needed  Message tags enable flow clustering  Clusters of [ Sender,  ] at Engine  Detection frames cluster partial message flows  Arrival rate 21.10.2015DoS Flooding Detection in Anonymity Networks7

8. jens.oberender@uni-passau.de Clustering of time-based Tags 21.10.2015DoS Flooding Detection in Anonymity Networks8

9. jens.oberender@uni-passau.de Scalability Issues  Clock skew in distributed systems  misuse degrades linkability Access control entity  Counts messages per sender  Logarithm effects on tag 21.10.2015DoS Flooding Detection in Anonymity Networks9 Traffic flow classification  Arrival rate per message tag  Activity profiling

10. jens.oberender@uni-passau.de Sender Linkability  Scales with message volume  Depends on arrival rate towards each receiver  Message tags collisions  Flow splitting increases linkability  Incentive mechanism  Strategic players’ goal: maximize privacy  Inoffensive communication encouraged 21.10.2015DoS Flooding Detection in Anonymity Networks10

11. jens.oberender@uni-passau.de Multiple sender identities  Equivalent to DDoS  No defense against attacks from different sender identities, but…  Example BotNets  Anonymity for attacker only  Proxy functionality  Yet these don’t spy SMTP authentication  Anonymity networks  No need to operate a BotNet  Anonymous attacks using real identity  Hard-to-detect without add-ons  Benefits the privacy of the broad public! 21.10.2015DoS Flooding Detection in Anonymity Networks11

12. jens.oberender@uni-passau.de Conclusions  Partial traffic flows  Ability to detect Anonymous DoS Flooding Attacks state-of-the-art techniques applicable  Sender Anonymity maintained  Sender Privacy  Defense of cross-server profiling  Restricted amount of message linkable  Arrival Rate  Linkability 21.10.2015DoS Flooding Detection in Anonymity Networks12 Jens Oberender