TCP SYN Cookie Vulnerability

Me Love (SYN-)Cookies: SYN Flood Mitigation in Programmable Data Planes

The SYN flood attack is a common attack strategy on the Internet, which tries to overload services with requests leading to a Denial-of-Service (DoS). Highly asymmetric costs for connection setup - putting the main burden on the attackee - make SYN flooding an efficient and popular DoS attack strategy. Abusing the widely used TCP as an attack vector complicates the detection of malicious traffic and its prevention utilizing naive connection blocking strategies. Modern programmable data plane devices are capable of handling traffic in the 10 Gbit/s range without overloading. We discuss how we c…

SDN-SYN PoW：基于非交互式PoW的自适应入口感知防御机制以对抗体积型SYN洪水

EdgePoW: Adaptive Ingress-Aware Defense with Non-Interactive PoW Against Volumetric SYN Floods

本文提出SDN-SYN PoW，结合非交互式PoW与SDN控制平面，通过动态调整PoW难度和精细化源地址管控，有效缓解体积型SYN洪水带来的带宽压力，提升应用服务质量。

Dapper: Data Plane Performance Diagnosis of TCP

With more applications moving to the cloud, cloud providers need to diagnose performance problems in a timely manner. Offline processing of logs is slow and inefficient, and instrumenting the end-host network stack would violate the tenants' rights to manage their own virtual machines (VMs). Instead, our Dapper system analyzes TCP performance in real time near the end-hosts (e.g., at the hypervisor, NIC, or top-of-rack switch). Dapper determines whether a connection is limited by the sender (e.g., a slow server competing for shared resources), the network (e.g., congestion), or the receiver (e…

Defense against SYN-Flood Denial of Service Attacks Based on Learning Automata

SYN-flooding attack uses the weakness available in TCP's three-way handshake process to keep it from handling legitimate requests. This attack causes the victim host to populate its backlog queue with forged TCP connections. In other words it increases Ploss (probability of loss) and Pa (buffer occupancy percentage of attack requests) and decreases Pr (buffer occupancy percentage of regular requests) in the victim host and results to decreased performance of the host. This paper proposes a self-managing approach, in which the host defends against SYN-flooding attack by dynamically tuning of it…

Domain-Sharding for Faster HTTP/2 in Lossy Cellular Networks

HTTP/2 (h2) is a new standard for Web communications that already delivers a large share of Web traffic. Unlike HTTP/1, h2 uses only one underlying TCP connection. In a cellular network with high loss and sudden spikes in latency, which the TCP stack might interpret as loss, using a single TCP connection can negatively impact Web performance. In this paper, we perform an extensive analysis of real world cellular network traffic and design a testbed to emulate loss characteristics in cellular networks. We use the emulated cellular network to measure h2 performance in comparison to HTTP/1.1, for…

基于雾 computing 的多路径 TCP/IP 5G 连接中满足延迟约束的虚拟机节能 live 迁移

Fog-supported delay-constrained energy-saving live migration of VMs over MultiPath TCP/IP 5G connections

本文提出了一种基于多路径 TCP/IP 5G 连接的虚拟机节能 live 迁移方案，通过可设置复杂度的带宽管理器实现能耗最小化和延迟约束。