[Paper Review] Active Internet Traffic Filtering: Real-time Response to Denial of Service Attacks

Katerina Argyraki, David R. Cheriton|arXiv (Cornell University)|Sep 29, 2003

Network Security and Intrusion DetectionComputer Science13 references165 citations

TL;DR

This paper proposes AITF (Active Internet Traffic Filtering), a scalable, secure, and automatic filter propagation protocol that enables real-time mitigation of DDoS attacks by pushing filtering responsibilities to the attacker's service provider. It ensures protection with bounded router resources, prevents abuse by malicious nodes, and scales with Internet growth by leveraging traceback to route filtering requests efficiently to the source's edge.

ABSTRACT

Denial of Service (DoS) attacks are one of the most challenging threats to Internet security. An attacker typically compromises a large number of vulnerable hosts and uses them to flood the victim's site with malicious traffic, clogging its tail circuit and interfering with normal traffic. At present, the network operator of a site under attack has no other resolution but to respond manually by inserting filters in the appropriate edge routers to drop attack traffic. However, as DoS attacks become increasingly sophisticated, manual filter propagation becomes unacceptably slow or even infeasible. In this paper, we present Active Internet Traffic Filtering, a new automatic filter propagation protocol. We argue that this system provides a guaranteed, significant level of protection against DoS attacks in exchange for a reasonable, bounded amount of router resources. We also argue that the proposed system cannot be abused by a malicious node to interfere with normal Internet operation. Finally, we argue that it retains its efficiency in the face of continued Internet growth.

Motivation & Objective

• To address the growing challenge of manual, slow, and infeasible filter propagation during sophisticated DDoS attacks.
• To design an automatic filter propagation mechanism that guarantees significant protection with bounded router resources.
• To ensure security by preventing malicious nodes from abusing the system to block legitimate traffic.
• To scale efficiently with Internet growth by minimizing filter propagation hops and offloading filtering to attacker-side providers.

Proposed method

• The victim initiates a filtering request to its gateway, which then propagates it toward the attacker’s gateway using traceback to identify the source path.
• Each router validates filtering requests by ensuring the requestor is on the same path as the malicious traffic, preventing spoofing or abuse.
• Filters are applied only at the attacker’s gateway or service provider edge, minimizing the number of hops and router resource usage.
• The system enforces a filtering contract between clients and service providers, specifying maximum request rates (R1, R2) and limiting required filters to n_v = R1·T_tmp ≪ N_v.
• It leverages existing traceback mechanisms (e.g., [SWKA00]) to locate the attacker’s path and ensure filtering is applied close to the source.
• The protocol ensures that only flows already under the victim’s control are filtered, preventing unintended disruption to other traffic.

Experimental results

Research questions

• RQ1 Can an automatic filter propagation system mitigate DDoS attacks faster and more reliably than manual methods?
• RQ2 How can filtering be securely applied without allowing malicious nodes to forge requests and disrupt legitimate traffic?
• RQ3 Can the system scale with Internet growth while maintaining bounded resource usage at each router?
• RQ4 What mechanisms ensure that filtering is applied close to the attacker’s source without relying on hop-by-hop propagation?
• RQ5 How can filtering contracts between clients and providers guarantee protection with minimal resource overhead?

Key findings

• AITF reduces filter propagation to only four nodes—victim, victim’s gateway, attacker’s gateway, and attacker—dramatically improving scalability over hop-by-hop methods.
• The system guarantees protection against N_v = R1·T undesired flows using only n_v = R1·T_tmp filters, where T_tmp ≪ T, ensuring bounded resource usage.
• Filtering requests are validated based on path consistency, making it impossible for malicious nodes to disrupt legitimate traffic unless they control the flow path.
• The protocol prevents abuse by ensuring that only the victim or its gateway can initiate filtering, and only for traffic already on the same path.
• By pushing filtering to the attacker’s service provider, AITF minimizes load on backbone routers and scales efficiently with Internet growth.
• The system remains effective even if some routers are compromised, as long as the majority of infrastructure remains trustworthy.