Implementing and testing dynamic timeout adjustment as a DoS counter-measure

In this paper we experimentally analyse various dynamic timeout adjustment strategies in server queues as poten-tial counter-measures against degradation of service attacks. Previous theoretical work studied the relative performance of both coarse-grained threshold-based timeout and fine-grained adjusment strategies where the timeout value is as the number of connections in the queue varies. In addi-tion, two methods for removing timed-out connections were explored: the deterministic method where the expiry time is determined at connection arrival depending on the time-out value at that moment, and the deferred method where connections are continuously polled and flushed when the time-in-queue is larger than the current timeout value. We report on experiments performed on a laboratory net-work where these strategies were tested against various con-figuration and attack parameters. The experimental results confirm the conclusions previously obtained from mathemat-ical modelling and simulation, i.e. that a) finer-grained dy-namic adjustment performs better than coarse-grained or no adjustment, and b) that the deferred method performs better than the deterministic one. Furthermore, our im-plementation of these counter-measures is very efficient and transparent with the respect to the servers and applications it tries to protect. It could therefore be easily integrated into existing OS and applications or implemented in sepa-rate network devices, either on dedicated machines or net-work appliances. 1