Title :
Emulation versus simulation: a case study of TCP-targeted denial of service attacks
Author :
Chertov, Roman ; Fahmy, Sonia ; Shroff, Ness B.
Author_Institution :
Purdue Univ., West Lafayette, IN
Abstract :
In this paper, we investigate the applicability of simulation and emulation for denial of service (DoS) attack experimentation. As a case study, we consider low-rate TCP-targeted DoS attacks. We design constructs and tools for emulation testbeds to achieve a level of control comparable to simulation tools. Through a careful sensitivity analysis, we expose difficulties in obtaining meaningful measurements from the DETER and Emulab testbeds with default system settings, and find dramatic differences between simulation and emulation results for DoS experiments. Our results also reveal that software routers such as Click provide a flexible experimental platform, but require understanding and manipulation of the underlying network device drivers. We compare simulation and testbed results to a simple analytical model for predicting the average size of the congestion window of a TCP flow under a low-rate TCP-targeted attack, as a function of the DoS attack frequency. We find that the analytical model and ns-2 simulations closely match in typical scenarios. Our results also illustrate that TCP-targeted attacks can be effective even when the attack frequency is not tuned to the retransmission timeout. The router type, router buffer size, attack pulse length, attack packet size, and attacker location have a significant impact on the effectiveness and stealthiness of the attack
Keywords :
security of data; sensitivity analysis; telecommunication network routing; telecommunication security; transport protocols; DETER testbed; Emulab testbed; TCP-targeted DoS attack; denial of service attack; ns-2 simulation; sensitivity analysis; software router; Analytical models; Computer aided software engineering; Computer crime; Emulation; Frequency; IP networks; Predictive models; Routing protocols; Sensitivity analysis; System testing;
Conference_Titel :
Testbeds and Research Infrastructures for the Development of Networks and Communities, 2006. TRIDENTCOM 2006. 2nd International Conference on
Conference_Location :
Barcelona
Print_ISBN :
1-4244-0106-2
DOI :
10.1109/TRIDNT.2006.1649164