Query-Flood DoS Attacks In Gnutella

Query-Flood DoS Attacks In Gnutella Neil Daswani and Hector Garcia-Molina Stanford University Department of Computer Science

Problem & Approach • Problem • Gnutella: multiplicative query broadcast • Application-layer denial-of-service • Approach • Load balancing / provide fairness

How does Gnutella Work? Remote Peers • Super-nodes • Messages • Ping / Pong • Query / QueryHit • Push • Already Seen • Time To Live • File X-fer: HTTP Local Peers

Questions • Which queries to drop? • Traffic management policies? • Effect of topology? • How is “damage” distributed?=> Need Traffic Model & Metrics

Gnutella Traffic Model Remote Peers • Discrete-event • Only super-nodes explicitly modeled • Only queries are modeled • q=(origin,ttl) • Max capacity: C = 6 queries / time unit Local Peers

Gnutella Traffic Model • Local Work ={q1,q2,q3} B C A q1 q3 q2

Gnutella Traffic Model • Local Work ={q1,q2,q3} • Remote Work = {q4,…,q9} {q10,q11} B q5 q7 q4 q9 q6 q8 C q11 A q10 q1 q2 q3

Gnutella Traffic Model • Local vs. Remote Work: • Reservation Ratio () • Remote Work: • How many? (IAS) • Which ones? (DS) B C q5 q6 q4 q9 q7 q10 q8 q1 q11 q2 q3

Gnutella Traffic Model • Local Work ={q1,q2,q3} • Remote Work = {q4,…,q9} {q10,q11} • Local Work Accepted = {q1} • Remote Work Accepted = • IB,A(1)={q4,q5} • IC,A(1)={q10,q11} B C q5 q6 q4 q9 q7 q10 q8 q1 q11 q2 q3

q5 q11 q4 q10 q1 Gnutella Traffic Model • Local Work ={q1,q2,q3} • Remote Work = {q4,…,q9} {q10,q11} • Local Work Accepted = {q1} • Remote Work Accepted = • IB,A(1)={q4,q5} • IC,A(1)={q10,q11} • Work Broadcasted ={q1,q4,q5,q10,q11} B C A

Reservation Ratio () • Only used in high load situations. • Max C queries from local peers. • Max (1-)C queries from remote peers. • If =1/3 and C=6, C=(1/3)(6)=2 Local B C A q1 q2 q3

Incoming Alloc. Strategy • (1-)C=(4/6)(6)=4 Remote • IAS Possibilities: • Fractional:2 from B2 from C • Weighted:3 from B1 from C B q5 q7 q4 q9 q6 q8 C q11 q10 A q1 q2

Drop Strategy Which queries to drop? D E H B F G q5 q7 q4 q9 q6 q8 A q11 C q1 q10 q2

Drop Strategy Which queries to drop? q6 D E q9 H q4 q8 q5 q7 B F G A q11 C q1 q10 q2

Drop Strategy Equal q6 q9 D E H q4 q8 q5 q7 B F G A q11 C q1 q10 q2

Drop Strategy Proportional q6 D E q9 H q4 q8 q5 B q7 F G A q11 C q1 q10 q2

Drop Strategy PreferHighTTL q6 D E q9 H q4 q8 q5 q7 B F G A q11 C q1 q10 q2

Drop Strategy PreferLowTTL q6 q9 D E H q4 q8 q5 q7 B F G A q11 C q1 q10 q2

Good & Malicious Nodes • Good nodes:  =   = 1/3 • In general, for symmetric networks: = 1 / (D() + 1) • Malicious nodes: m = 1 K3; =2 B Total Remote Queries Processed A C 0  1

5 0 M D 4 6 B B A A C C Damage • Service Guarantee: Sj(t), Sj(t) • Damage for node j (at time t): Dj(t) = (Sj(t) – Sj(t)) / Sj(t) • Cumulative Network Damage:D(t) = “bad” queries / “total” queries SA(t)=8 SA(t)=16 5 4 DA(t)=(16-8)/16=0.5

Simulations • Various Representative Topologies: K14, C14, G16, L14, P16, S14, W14 • All IAS/DS described earlier • Single malicious node /various placements • Fundamental effects / trade-offs • C=10,000;  = ; m = 1; =7; t=100

Results/Observations

Results/Observations • IAS/DS vs. Damage • Which IAS/DS minimizes damage? • Depends upon topology? • Topology vs. Damage • Some topologies better than others? • Some nodes particularly vulnerable to attack? • Damage Distribution • How is damage distributed? • Flood vs. Structural damage

IAS/DS vs. Damage • O1: Fractional IAS + Equal or PreferHighTTL DS optimal

IAS/DS vs. Damage • O2: Weighted/Prop always worse than Fractional/Equal by about 2x or more

IAS/DS vs. Damage • O3: PreferLowTTL incurs (at least as much or) more damage than other DSs

Topology vs. Damage • O4: Complete topology (K) under Frac/Eq IAS/DS least prone to damage & insensitive to malicious node position. Damage Topology Topologies K=Complete C=Cycle G=Grid L=Line Malicious Node Positions Ce=Center Co=Corner Ed=Edge H=Highly-connected L=Lowly-connected P=Power-Law S=Star W=Wheel

Topology vs. Damage • O5: Good topology is not enough. Must use good policies too.

C14 Damage Distribution (Cycle) • O6: Nodes should distance themselves from untrusted nodes. • Damage decreases as distance from malicious node increases.

Damage Distribution(Cycle) • O7: Disconnect protocols must be used to prevent “structural” damage. • Fractional/Equal IAS/DS minimizes “flood” damage in cycle topology. Weighted/Proportional Fractional/Equal

Conclusion • Defined model & metrics; Evaluation • 7 observations: • Fractional IAS + Equal or PreferHighTTL DS optimal • Weighted IAS always worse than Fractional IAS by ~ 2x • PreferLowTTL incurs more damage than other DSs (or at least as much) • Complete topology (K) under Frac/Eq IAS/DS least prone to damage & insensitive to malicious node position. • Good topology is not enough. Must use good policy too. • Nodes should distance themselves from untrusted nodes. • Disconnect protocols must be used to prevent “structural” damage.

Q & A • Paper & slides available at:http://www.stanford.edu/~daswani

Query-Flood DoS Attacks In Gnutella