2023_Experimental Evaluation of LDoS Attacks on QUIC

Transcript

1. Experimental Evaluation of LDoS Attacks on QUIC †Future University Hakodate, Japan Ryuku Hisasue†，Akito Kawauchiya †, Hiroshi Inamura†， Shigemi Ishida† The 14th International Conference on Mobile Computing and Ubiquitous Networking 2023 November 29, 2023 (Wed) © 2023 Future University Hakodate, Ryuku Hisasue.
2. Denial of Service (DoS) is a kind of cyber attack  Occupy the target's network traffic bandwidth by sending attack traffic → Degrades Quality of Service (QoS) of the network Threats on the Internet：Cyber Attacks Normal Traffic DoS Attack Traffic ・・・・・ ・ ・・・・ bandwidth © 2023 Future University Hakodate, Ryuku Hisasue. 1
3. Flooding DoS (FDoS)  Occupy 100% of Bandwidth  Easy to detect because of large traffic amount Low-rate DoS (LDoS)  Occupy about 10 – 30 % of Bandwidth (Low-rate)  Realized by periodic pulse What is a LDoS Attack? [1] FDoS Attack Traffic LDoS Attack Traffic Focus of this study [1] W. Zhijun, et al., “Low-rate dos attacks, detection, defense, and challenges: a survey,” IEEE access, vol. 8, pp. 43 920–43 943 (2020). 𝑅 𝑡 : Traffic Rate at time 𝑡, 𝐶: Link Bandwidth, 𝑎𝑠𝑡𝑟 , 𝑎𝑒𝑛𝑑 : duration of attack 𝑅 ∶ Attack Pulse Traffic Rate, 𝐿: Attack Pulse width, 𝑇: Attack Pulse Period © 2023 Future University Hakodate, Ryuku Hisasue. 2
4.  QUIC: transport protocol standard by IETF in 2021[1]  High security : All transfer data are encrypted  High reliability : Reliable byte stream, equipped with retransmission and congestion control Usage  HTTP/3 uses QUIC at the transport layer  Facebook: 75% users; 2.8 billion people[2]  YouTube : 50% users; 2.0 billion people[3] No Research of LDoS Attacks against QUIC 3 © 2023 Future University Hakodate, Ryuku Hisasue. In other research, as far as the authors have investigated, LDoS attacks against QUIC are not considered [1] J. Iyengar, et al., “RFC 9000: QUIC: A UDP-Based Multiplexed and Secure Transport (2021). [2] M. Joras, et al, “How Facebook is bringing QUIC to billions”, 2020, https://engineering.fb.com/2020/10/21/networking-traffic/how- facebook-is-bringing-quic-to-billions/, (accessed: Oct.21, 2023). [3] maprag, “Some updates on QUIC deployment numbers”, 2019, https://datatracker.ietf.org/meeting/106/materials/slides-106-maprg- quic-deployment-update-00.
5. Purpose 4 © 2023 Future University Hakodate, Ryuku Hisasue. Propose a LDoS Attack method against QUIC
6. There are two types of LDoS attack method: Shrew method[1]  Exploit the retransmission algorithm using exponential backoff  Fill the router buffer at the timing of retransmission RoQ method[2]  Exploit the loss-based congestion control algorithm  Congest the TCP link before the recovering regular congestion window (cwnd) size LDoS Attack Methods against TCP 5 Different between Shrew and RoQ [1] A. Kuzmanovic, et al, “Low-rate TCP-targeted denial of service attacks: the shrew vs. the mice and elephants, ACM SIGCOMM 2003, pp. 75–86 (2003). [2] M. Guirguis, et al, “Reduction of quality (RoQ) attacks on Internet end-systems”, IEEE INFOCOM 2005, pp. 1362–1372 (2005). © 2023 Future University Hakodate, Ryuku Hisasue. 𝑻 Method Exploited algorithm Pulse period 𝑻 Shrew Retransmission timeout (RTO) 𝑇 < 5 s (usually 1 s) RoQ Loss-based congestion control 𝑇 ≥ 5 s
7. Hypothesis:  QUIC has the mechanism which resembles TCP, but implementation of the mechanism is different from TCP  However, there is a possibility that attacking QUIC with periodic pulses is affected by  Timeout based retransmission control (Shrew method) or Congestion control (RoQ method) Verification: We clarify the key factor in the success of LDoS attack by Shrew attacking Experimental Evaluation: LDoS Attacks on QUIC 6 © 2023 Future University Hakodate, Ryuku Hisasue. Protocol Timeout based Retransmission Congestion QUIC PTO Delay-based (BBR) TCP RTO Loss-based Different Mechanisms
8. Topology Scenario 1. From the timing of when Sender starts sending data and 5 secs passed, Attacker sends attack traffic to Receiver 2. Congestion happens because attack traffic is queued on router buffer 3. Observer the packets from router A to Receiver for evaluation Experiment Setup 7 © 2023 Future University Hakodate, Ryuku Hisasue. ※ Experiments were conducted in ns-3; a network simulator Bottleneck Link
9.  Throughput decreased 84.2% (Table I)  PTO Retransmission mechanism is NOT called  The size of cwnd decreases from the attack (Fig. 1) Result: Congestion control exploited 8 © 2023 Future University Hakodate, Ryuku Hisasue. cwnd time Start Attack Throughput is decreased by BBR Congestion Control Fig. 1 CHANING OF THE CWND SIZE
10. We term the LDoS attack to QUIC with exploiting BBR as “RoQ Attack against BBR on QUIC (RABQ) method”  To decrease throughput over 80%, RABQ method reduces bandwidth occupancy 𝑾 to 25% (compared to conventional Shrew method) RABQ Method: RoQ Attack against BBR on QUIC 9 © 2023 Future University Hakodate, Ryuku Hisasue. Conventional Shrew method 25％ 80% more Stealthier than conventional Shrew method
11. We proposed Low-rate RABQ DoS attack that exploits the congestion mechanism BBR on QUIC  Reduce the throughput to more than 80% with 25% less bandwidth occupancy  There is a possibility that this result is caused by adjusting cwnd in congestion control Future work  Conduct mathematical analysis to show the successful conditions for the RABQ method  Clarify the effect and characteristics to detect the attacks Conclusion 10 © 2023 Future University Hakodate, Ryuku Hisasue.
12. BBR has status shown on the right  The amount of data transmission is adjusted by cyclically repeating, ProbeBW_DOWN , ProbeBW_CRUISE , ProbeBW_REFILL , and ProbeBW_UP .  These status are transited based on changes in BDP  BDP  Calculated as the product of the minimum RTT and the bottleneck link bandwidth  Indicate whether the queue is empty or not Discussion 11 © 2023 Future University Hakodate, Ryuku Hisasue. Startup Drain ProbeBW_DOWN ProbeBW_CRUISE ProbeBW_REFILL ProbeBW_UP ProbeRTT There is a possibility that BDP is key factor for the RABQ method