2026-09-20T17:07:50Z https://www.ideals.illinois.edu/oai-pmh

oai:www.ideals.illinois.edu:2142/29832 2023-07-10 col_2142_5131 col_2142_10761 com_2142_5130 com_2142_10755 com_2142_234

Gunter, Carl A. Caesar, Matthew C. Khanna, Sanjeev Nahrstedt, Klara Khan, Fariba 2012-02-06T20:20:33Z 2012-02-06T20:20:33Z 2011-12 2012-02-06T20:20:33Z 2011-12 During an Internet distributed denial-of-service (DDoS) attack, attackers pose as a superpower overloading bandwidth and services that otherwise would have been lightly used by genuine users. These legitimate users send few packets and occasionally back-off and fail while competing for resources. The Internet architecture provides only modest support for verifying the true origin of a packet or intention of a sender. This makes identification and filtering of attack traffic difficult. DDoS attacks could be limited greatly if there were a way to fairly distribute the resources among the parties despite limited origin integrity. In our work, we propose two methods for achieving fairness despite no or partial implementation for integrity verification. Adaptive Selective Verification (ASV) provides legitimate clients service despite large but bounded attack rates without any integrity infrastructure. ASV can be implemented, without the cooperation of the core routers, by slight modification of the client and server applications. The other system is Integrity Based Queuing (IBQ). In this work, we expect that integrity will not be perfect, but observe that even an imperfect implementation can improve the effectiveness of queuing when parities with better a integrity level are incentivized. ASV and IBQ together create a mechanism for incentives, infrastructure and independence for network service assurance. ASV is shown to be efficient in terms of bandwidth consumption using network simulations. It differs from previously-investigated adaptive mechanisms for bandwidth based payment by requiring very limited state on server. Our study of IBQ includes proof of direct relationship of integrity to service, a network simulation for comparative study, simulation with real attack traffic and security analysis. Our network assurance architecture provides a synergistic approach for defending against DDoS attacks. With moderate infrastructure support, IBQ can be an architecture to provide graded source validation on the Internet. Clients that do not have the support from the ISP, use their spare bandwidth with ASV for service. Item withdrawn by Mark Zulauf (zulauf@illinois.edu) on 2011-11-26T19:22:54Z Item was in collections: University of Illinois Theses & Dissertations (ID: 1) No. of bitstreams: 2 Thesis Raw.zip: 16367476 bytes, checksum: ed4899cfec2e0c3d8279181d5b15f385 (MD5) Khan_Fariba.pdf: 7007314 bytes, checksum: bf13f67af3c77267ebd744a198b7f140 (MD5) Made available in DSpace on 2012-02-06T20:20:33Z (GMT). No. of bitstreams: 3 Khan_Fariba.pdf: 7007314 bytes, checksum: bf13f67af3c77267ebd744a198b7f140 (MD5) Thesis Raw.zip: 16367476 bytes, checksum: ed4899cfec2e0c3d8279181d5b15f385 (MD5) license.txt: 4059 bytes, checksum: a3f79d0f6cf6a70babad8b2d2b568c41 (MD5) http://hdl.handle.net/2142/29832 en Copyright 2011 Fariba Khan Distributed Denial of Service (DDoS) Incentives Integrity Fairness Spoofing Index Assuring network service with bandwidth and integrity based fairness Dissertation / Thesis text Computer Science 1434 Computer Science 0112 University of Illinois at Urbana-Champaign Dissertation Ph.D. PHD:Computer Science -UIUC 10KS0112PHD