A Taxonomy for Denial of Service Attacks in Content-based Publish/Subscribe Systems

1. A Taxonomy for Denial of Service Attacks in Content-based Publish/Subscribe Systems Alex Wun, Alex Cheung, Hans-Arno Jacobsen Department of Electrical and Computer Engineering Department of Computer Science University of Toronto

2. Current State of Denial of Service • Prominent DoS news in 2007: • 6 of 13 Root DNS servers attacked [ICANN2007] • DC++ P2P networks used in attacks [DCPP2007] • Estonian sites: government, bank, police [Yahoo2007] • Plenty more … • DoS problems are not going away

3. Research Goals • Stimulate discussion about DoS in CPS • Avoid repeating old DoS weaknesses (e.g., IPv6 source routing) • Identify new DoS Concerns • Will DoS attacks in CPS systems be any different? • What are the prominent issues? • How can potential DoS attacks be classified?

4. Our Contributions • Study impact of CPS features on DoS effects • Distributed event delivery • Content-based processing overhead • State maintenance • Classify potential DoS attack characteristics • Identify CPS concepts with DoS implications

5. A B C Content-based Publish/Subscribe Enterprise Servers Embedded Devices Sensor Networks Publishers Subscribers P P S S Messaging Middleware

6. DoS Taxonomy

7. Message Propagation Effects • Multi-hop routing • Localization • Transmission

8. Propagation • Non-matching message injection • Malicious unsubscribe • Edge broker access control • Local clients • Co-operative detection not helpful • Effects may still be distributed Localized • Broker multicast • Per-hop security schemes • Client location Single-Hop • Matching message injection • Rendezvous routing • Remote clients • Transmitting DoS effects remotely Multi-Hop • Flooding • Global client interest • May span organizations Global

9. State Management Effects • Assumptions on distribution message type • Cumulative effects

10. Statefulness • Recovery through normal processing • Unretained publication injections • Connection attempts Attack Attack stops Time Stateless Effects • Effects continue due to state change • Malicious unsubscriptions • Subscription injections • Publications retained for CEP Attack Attack stops Stateful Time Effects • Recovery through normal maintenance • Expiry mechanisms • Periodic optimizations Attack Attack stops Time Soft-state Periodic cleanup Effects • Recovered state causes DoS • DB-based Fault-tolerance • Historic data • Configuration corruptions Load from persistent storage Persistent Time Effects

11. Content-based Processing Effects Low content complexity High content complexity

12. Content-based Processing Effects • Performance variability highly dependent on workload complexity • Response times • System recovery

13. Content-dependence Load # of Victims # of Targets Downtime • Severity of DoS effects are the same regardless of content complexity • ID-based filter removal Independent • Higher complexity content produces more severe DoS effects • Inducing matching load Proportional • Lower complexity content produces more sever DoS effects • Filter-based filter removal Inverselyproportional Content complexity

14. Techniques - Thrashing • DoS from processing repeated state changes • Subscription cover thrashing example: • Many non-covering subscriptions exist from other client(s) • Adversary issues covering subscription (triggers removal) • Adversary removes covering subscription (triggers restoration) • Repeat …

15. Techniques - Stockpiling • Store malicious state for use in future attack(s) • Can be low rate to avoid detection • Subscription flood example: • Stockpile subscription state • Issue advertisement to attract subscriptions

16. Techniques - Traffic Amplification • Malicious traffic of adversary multiplied • Known to be a problem in traditional Internet • Smurf attack • Source routing • Reflection (connection retries) • Fundamental to many CPS features? • Highly generic subscriptions and advertisements • Uncovering and Unmerging • Historic data

17. Filter versus ID State Removal

18. Related Work • Mirkovic and Reiher [Mirkovic2004] • DDoS taxonomy in traditional Internet domain • Srivatsa and Liu [Srivatsa2005] • Authentication to limit flooding-based DoS • Wang et al. [Wang2002] • Discussed DoS briefly along with other security concerns

19. Conclusion • CPS characteristics with DoS implications • Message propagation (remote attacks) • Content complexity (highly variable performance) • State maintenance (assumptions on message type distribution) • Abusing features for DoS • Stockpiling • Traffic Amplification • Filter Removal (Thrashing, Victims)

20. References • [ICANN2007] • http://icann.org/announcements/factsheet-dns-attack-08mar07_v1.1.pdf • [DCPP2007] • http://dcpp.wordpress.com/2007/05/22/denying-distributed-attacks/ • [Yahoo2007] • http://fe48.news.sp1.yahoo.com/s/infoworld/20070517/tc_infoworld/88610 • [Mirkovic2004] • A Taxonomy of DDoS Attack and DDoS Defense Mechanisms, ACM SIGCOMM • [Srivatsa2005] • Securing Publish-Subscribe Overlay Services with EventGuard, ACM Conference on Computer and Communications Security • [Wang2002] • Security Issues and Requirements for Internet-Scale Publish-Subscribe Systems, Hawaii International Conference on System Sciences

21. Extra Slides

22. Enterprise Servers Embedded Devices Sensor Networks Publishers Subscribers xxxxx xxxxx xxxxx xxxxx xxxxx xxxxx • Distributed broker federations • Subscription state management • Content-based processing Messaging Middleware

23. Content-based Publish/Subscribe Publishers Subscribers P P S S