Mitigating bandwidth-exhaustion attacks using congestion puzzles

d Abstract) XiaoFeng Wang∗ Michael K. Reiter† We present congestion puzzles (CP), a new countermeasure to bandwidth-exhaustion attacks. Like other defenses based on client puzzles, CP attempts to force attackers to invest vast resources in order to effectively perform denialof-service attacks. Unlike previous puzzle-based approaches, however, ours is the first designed for the bandwidth-exhaustion attacks that are common at the network (IP) layer. At the core of CP is an elegant distributed puzzle mechanism that permits routers to cooperatively impose and check puzzles. We demonstrate through analysis and simulation that CP can effectively defend networks from flooding attacks without relying on the formulation of attack signatures to filter traffic. Moreover, as many such attacks are conducted by “zombie” computers that have been silently commandeered without the knowledge of their owners, the overheads that CP imposes on heavily engaged zombies can increase the likeliho...

• Type: Conference
• Year: 2004
• Where: CCS
• Authors: XiaoFeng Wang, Michael K. Reiter
• Keywords: Bandwidth-exhaustion Attacks, CCS 2004, Client Puzzle, Denialof-service Attacks, Security Privacy