Low-rate TCP-targeted denial of service attacks (the shrew vs. the mice and elephants

Denial of Service attacks are presenting an increasing threat to the global inter-networking infrastructure. While TCP’s congestion control algorithm is highly robust to diverse network conditions, its implicit assumption of end-system cooperation results in a well-known vulnerability to attack by high-rate non-responsive flows. In this paper, we investigate a class of low-rate denial of service at-tacks which, unlike high-rate attacks, are difficult for routers and counter-DoS mechanisms to detect. Using a combination of ana-lytical modeling, simulations, and Internet experiments, we show that maliciously chosen low-rate DoS traffic patterns that exploit TCP’s retransmission time-out mechanism can throttle TCP flows to a small fraction of their ideal rate while eluding detection. More-over, as such attacks exploit protocol homogeneity, we study fun-damental limits of the ability of a class of randomized time-out mechanisms to thwart such low-rate DoS attacks