CT-ISG: Pollution Resilience for Internet Caches

CT-ISG：互联网缓存的污染恢复能力

• 批准号: 0627715
• 负责人: Aleksandar Kuzmanovic
• 金额: $ 35万
• 依托单位: Northwestern University
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2006
• 资助国家: 美国
• 起止时间: 2006-09-01 至 2009-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0627715&HistoricalAwards=false
• 关键词: CT; ISG; Pollution; Resilience; Internet

Aleksandar KuzmanovicPollution Resilience for Internet CachesNorthwestern University0627715AbstractThe majority of requests for the Domain Name System (DNS) entries, web, or even peer-to-peer (p2p) content in today's Internet are not served by origin servers, but rather by intermediate caches. As such, they pose an attractive target for malicious attackers. This project will address the problem of cache-targeted DoS attacks on a broad front: (i) by developing and studying a new generation of large-scale cache-targeted pollution attacks, (ii) by designing fundamental knowledge in creating deployable anti-pollution mechanisms, and (iii) by designing and implementing counter-DoS solutions for three imminent threats: web, p2p, and local DNS cache-targeted pollution attacks.The proposed pollution attacks pose a challenging problem for the entire Internet community: (i) they are capable of degrading overall network performance without flooding network resources; (ii) they possess a dangerous level of indirection; (iii) they pollute the cache with unpopular, rather than bogus files; (iv) they may operate at much longer time-scales than classical DoS attacks operate and are thus invisible for state-of-the-art counter-DoS schemes. By leveraging data streaming computation techniques, our goal is to attain a scalable solution by significantly reducing the amount of state needed to maintain, and to make the detection system itself resilient to DoS attacks. The involvement of industrial partners in this project will accelerate the transfer of the research results into operation. In particular, we will collaborate closely with the UltraDNS Corporation which provides DNS services for over 20\% of the world domains, including top-level domains as well as numerous private organizations.

Aleksandar Kuzmanovic 互联网缓存的污染弹性西北大学0627715摘要当今互联网中对域名系统 (DNS) 条目、Web 甚至点对点 (p2p) 内容的大多数请求不是由源服务器提供服务，而是由中间缓存提供服务。因此，它们对恶意攻击者来说是一个有吸引力的目标。该项目将广泛解决以缓存为目标的 DoS 攻击问题：(i) 通过开发和研究新一代大规模以缓存为目标的污染攻击，(ii) 通过设计创建可部署的反污染攻击的基础知识机制，以及 (iii) 针对三种迫在眉睫的威胁设计和实施反 DoS 解决方案：Web、p2p 和本地 DNS 缓存目标污染攻击。拟议的污染攻击给整个互联网社区带来了一个具有挑战性的问题：(i)能够降解整体网络性能，不淹没网络资源； (ii) 它们具有危险程度的间接性； (iii) 它们用不受欢迎的文件而不是伪造的文件污染缓存； (iv) 它们的运行时间可能比传统的 DoS 攻击长得多，因此对于最先进的反 DoS 方案来说是不可见的。通过利用数据流计算技术，我们的目标是通过显着减少维护所需的状态量来获得可扩展的解决方案，并使检测系统本身能够抵御 DoS 攻击。产业合作伙伴参与该项目将加速研究成果转化为应用。特别是，我们将与 UltraDNS Corporation 密切合作，该公司为全球超过 20% 的域名提供 DNS 服务，其中包括顶级域名以及众多私人组织。