Message Dropping Attacks in Overlay Networks: Attack Detection and Attacker Identification

ABSTRACT

Overlay multicast networks are used by service providers to distribute contents such as Web pages, static and streaming multimedia data, or security updates to a large number of users. However, such networks are extremely vulnerable to message-dropping attacks by malicious or selfish nodes that intentionally drop the packets they are required to forward to others. It is difficult to detect such attacks both efficiently and effectively and to further identify the attackers, especially when members in the overlay switch between online/offline statuses frequently. In this article, we consider various attacking strategies of an attacker and propose an optimal sampling-based scheme to detect such attacks in the overlay network. We analyze the detection problem from a game-theoretical viewpoint and show that our scheme outperforms a random sampling-based scheme in terms of detection rate. In addition, based on a reputation system, we propose a sampling-based path-resolving scheme to identify compromised or selfish nodes. Unlike other existing approaches, our schemes do not assume global knowledge of the overlay hierarchy and work for dynamic overlay networks as well. Extensive analysis and simulation results show that besides being band width efficient, our schemes have high detection and identification rates and low false-positive rates.

REFERENCES

• 1: Almeroth, K. and Ammar, M. 1997. Multicast group behavior in the Internet's multicast bckbone (mbone). IEEE Comm.
• 2: David Andersen , Hari Balakrishnan , Frans Kaashoek , Robert Morris, Resilient overlay networks, Proceedings of the eighteenth ACM symposium on Operating systems principles, October 21-24, 2001, Banff, Alberta, Canada
• 3: Suman Banerjee , Bobby Bhattacharjee , Christopher Kommareddy, Scalable application layer multicast, Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications, August 19-23, 2002, Pittsburgh, Pennsylvania, USA
• 4: Suman Banerjee , Seungjoon Lee , Bobby Bhattacharjee , Aravind Srinivasan, Resilient multicast using overlays, ACM SIGMETRICS Performance Evaluation Review, v.31 n.1, June 2003
• 5: M. Blaze , J. Feigenbaum , J. Ioannidis , A. Keromytis, The KeyNote Trust-Management System Version 2, RFC Editor, 1999
• 6: Matt Blaze , Joan Feigenbaum , Jack Lacy, Decentralized Trust Management, Proceedings of the 1996 IEEE Symposium on Security and Privacy, p.164, May 06-08, 1996
• 7: Buchegger, S. and Boudec, J. 2004. A robust reputation system for p2p and mobile ad-hoc networks. In Proceedings of 2nd Workshop of Economics of P2P Systems.
• 8: Yang Chu , Sanjay Rao , Srinivasan Seshan , Hui Zhang, Enabling conferencing applications on the internet using an overlay muilticast architecture, Proceedings of the 2001 conference on Applications, technologies, architectures, and protocols for computer communications, p.55-67, August 2001, San Diego, California, United States
• 9: Yang-hua Chu , Sanjay G. Rao , Hui Zhang, A case for end system multicast (keynote address), Proceedings of the 2000 ACM SIGMETRICS international conference on Measurement and modeling of computer systems, p.1-12, June 18-21, 2000, Santa Clara, California, United States
• 10: CSIM. Web site at www.mesquite.com.
• 11: Chrysanthos Dellarocas, Mechanisms for coping with unfair ratings and discriminatory behavior in online reputation reporting systems, Proceedings of the twenty first international conference on Information systems, p.520-525, December 2000, Brisbane, Queensland, Australia
• 12: Drabkin, V., Wallach, D., and Druschel, P. 2005. Incentives-compatible peer-to-peer multicast. In Proceedings of the International Conference on Dependable Systems and Networks (DSN'05).
• 13: Saurabh Ganeriwal , Mani B. Srivastava, Reputation-based framework for high integrity sensor networks, Proceedings of the 2nd ACM workshop on Security of ad hoc and sensor networks, October 25-25, 2004, Washington DC, USA [doi>10.1145/1029102.1029115]
• 14: Yih-Chun Hu , Adrian Perrig , Marvin Sirbu, SPV: secure path vector routing for securing BGP, Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications, August 30-September 03, 2004, Portland, Oregon, USA
• 15: John Jannotti , David K. Gifford , Kirk L. Johnson , M. Frans Kaashoek , James W. O'Toole, Jr., Overcast: reliable multicasting with on overlay network, Proceedings of the 4th conference on Symposium on Operating System Design & Implementation, p.14-14, October 22-25, 2000, San Diego, California
• 16: Seung Jun , Mustaque Ahamad , Jun (Jim) Xu, Robust Information Dissemination in Uncooperative Environments, Proceedings of the 25th IEEE International Conference on Distributed Computing Systems, p.293-302, June 06-10, 2005 [doi>10.1109/ICDCS.2005.70]
• 17: Ninghui Li , John C. Mitchell , William H. Winsborough, Design of a Role-Based Trust-Management Framework, Proceedings of the 2002 IEEE Symposium on Security and Privacy, p.114, May 12-15, 2002
• 18: Mathy, L., Blundell, N., Roca, V., and El-Sayed, A. 2004. Impact of simple cheating in application-level multicast. In Proceedings of the Annual Joint Conference of the IEEE Computer and Communication Societies (INFOCOM), 2, 1318--1328.
• 19: Ngan, T., Wallach, S., and Druschel, P. 2004. Incentives-compatible peer-to-peer multicast. 2nd Workshop on Economics of Peer-to-Peer Systems.
• 20: Venkata N. Padmanabhan , Helen J. Wang , Philip A. Chou , Kunwadee Sripanidkulchai, Distributing streaming media content using cooperative networking, Proceedings of the 12th international workshop on Network and operating systems support for digital audio and video, May 12-14, 2002, Miami, Florida, USA [doi>10.1145/507670.507695]
• 21: Palter, D. Sept. 2002. Multicast fan-out saves bandwidth. Network World.
• 22: Dimitrios Pendarakis , Sherlia Shi , Dinesh Verma , Marcel Waldvogel, ALMI: an application level multicast infrastructure, Proceedings of the 3rd conference on USENIX Symposium on Internet Technologies and Systems, p.5-5, March 26-28, 2001, San Francisco, California
• 23: Reiher, J. and Popek, G. 2004. Resilient self-organizing overlay networks for security update delivery. IEEE J. Selec. Areas Comm.
• 24: Lakshminarayanan Subramanian , Volker Roth , Ion Stoica , Scott Shenker , Randy H. Katz, Listen and whisper: security mechanisms for BGP, Proceedings of the 1st conference on Symposium on Networked Systems Design and Implementation, p.10-10, March 29-31, 2004, San Francisco, California
• 25: Alan T. Sherman , David A. McGrew, Key Establishment in Large Dynamic Groups Using One-Way Function Trees, IEEE Transactions on Software Engineering, v.29 n.5, p.444-458, May 2003 [doi>10.1109/TSE.2003.1199073]
• 26: Dawn Song , J. D. Tygar , David Zuckerman, Expander Graphs for Digital Stream Authentication and Robust Overlay Networks, Proceedings of the 2002 IEEE Symposium on Security and Privacy, p.258, May 12-15, 2002
• 27: Rebecca N. Wright , Patrick D. Lincoln , Jonathan K. Millen, Efficient fault-tolerant certificate revocation, Proceedings of the 7th ACM conference on Computer and communications security, p.19-24, November 01-04, 2000, Athens, Greece [doi>10.1145/352600.352605]
• 28: Hao Yang , Haiyun Luo , Yi Yang , Songwu Lu , Lixia Zhang, HOURS: Achieving DoS Resilience in an Open Service Hierarchy, Proceedings of the 2004 International Conference on Dependable Systems and Networks, p.83, June 28-July 01, 2004
• 29: Zhang, B., Jamin, S., and Zhang, L. 2002. Host multicast: A framework for delivering multicast to end users. In Proceedings of the Annual Joint Conference of the IEEE Computer and Communication Societies (INFOCOM). 1366--1375.
• 30: Zhu, S., Yao, C., Liu, D., Setia, S., and Jajodia, S. 2005. Efficient security mechanisms for overlay multicast-based content distribution. In Proceedings of International Conference on Applied Cryptography and Network Security (ACNS'05). 40--55.

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Cryptographic controls

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)

General Terms:
Algorithms, Design, Security

Keywords:
Overlay networks, attack detection, attacker identification, message dropping attacks