A Game Theory Based Approach to the Geerato of Optmal DDo edg trategy Lag Huag, Degguo Feg, Yfeg La, Ygju Zhag, ad Yulg Lu Trusted Computg ad Iformato Assurace Laboratory, Isttute of oftware, The Chese Academy of ceces, Bejg, Cha {lacerhuag, feg, layf, yjzhag, yllu}@tcascasacc ABTRACT Wth the growg threat of DDo attacks, ew attackg mechasms emerge every day I order to cofrot the ever-evolvg DDo attacks, t s suffcet to select defedg strategy merely from exstg strategy set I ths paper, we propose a method that geerates ew defedg strateges ad that selects the optmal oe amog them, thus creasg the defedg ablty The Game Model for DDo Coutermeasure electo s establshed to model the DDo scearo that cosders the attacker ad the defeder as two players the game The the ew defedg strateges are geerated ad are cluded the defedg strategy set Next, the Nash equlbrum s calculated to dcate the optmal defedg strategy The expermets, whch s performed wth the etwork smulator, show the effectveess of our method KEYWORD DDo, Game Theory, Optmal edg trategy, trategy electo, Effect Evaluato INTRODUCTION The Dstrbuted Deal-of-ervce (DDo) attack has become oe of the most severe threats to the etwork securty ackers utlze the compromsed hosts to sed overwhelmgly large umber of requests to the vctm, exhaustg the vctm s ources, makg t uable to provde servces I order to fght agast the DDo attack effectvely, ot oly coutermeasu agast the DDo attacks are proposed, but also methods of selectg the optmal defese coutermeasu are developed These methods help to select the sutable defedg strategy the defedg strategy set However, attackers cotuously refe attackg process to crease the attack effect, so that ew attackg mechasms emerge every day Therefore, t s suffcet to select the best coutermeasure amog exstg defese coutermeasu I order to cofrot the ever-evolvg attacks, we have to fd a way to mprove coutermeasu Ths paper proposes a approach of geeratg ew defedg strateges ad selectg the optmal oe from them As a ult, the defese effect s creased Frstly, the defedg strateges are combed to geerate ew strateges ecodly, the Game Model for DDo Coutermeasure electo (GMDC) s bult The attacker ad the defeder are two players the model Thrdly, utlty fuctos for the attacker ad the defeder are troduced, cludg the fuctos of calculatg the effect of the combed defedg strateges ad the effect of the corpodg attackg strateges Thrdly, the Nash equlbrum that dcates the optmal defedg strategy both the orgal defedg strategy set ad the ewly geerated defedg strategy set s solved Fally, expermets are made usg the etwork smulator to valdate the correctess ad the effectveess of the method The t of the paper s orgazed as follows We descrbe related works ecto 2, pet the GMDC model ecto 3 Detals of utlty fuctos for both the attacker ad the defeder are provded ecto 4 We demostrate the expermets ecto 5, ad we summarze ths paper ecto 6 2 RELATED WORK I order to cofrot the DDo attacks, may coutermeasu have bee proposed, such as attack detectg, flow flterg, source detfyg, ad so o [-3] Mrkovc et al [4] classfed the DDo IBN: 978--98935-4-7 24 DIWC 4
attacks ad coutermeasu, Peg et al [5] surveyed the coutermeasu defedg the Dos ad DDo attacks They aalyzed the defese effect of every coutermeasure Based o the sold work of DDo attack ad defese survey, methods of the attack evaluato ad the defese evaluato are proposed Butler [6] proposed ecurty rbute Evaluato Method (AEM) The method frst evaluated how well each defese coutermeasure mtgated the threats The t aalyzed the types of threat each defese coutermeasure could hadle At last, t evaluated the cost of each defese coutermeasure These three factors were cosdered as a whole to gude the selecto of defese coutermeasu Bellache et al [7] poted out that the evaluato ad comparso were based o 4 aspects, e performace, cost of deploymet, fluece to the target system, robust chwab et al [8] put the dces for DDo evaluato to three categores: dces of etwork traffc, dces of attack effect ad dces of effectveess of defese He stated that the attack effect should be evaluated by the chage of the dces before ad durg the attack, the defese effect should be evaluated by the chage of defese effect before ad after the deploymet of the defese coutermeasure However, o cocrete calculato method was provded Meadows [9] defed the cost set C ad the truder capablty set G The the tolerace relato set C G was defed to aalyze whether the protocol could st the Do attack or ot Ths method provded a comprehesve aalyss for the strateges of both attacks ad defeses However, t was too theoretcal to be put to practce Mrkovc et al [] suggested that the key of DDo defese was to keep the servce rug at a user-acceptable level Wth ths dea, Mrkovc et al [, 2] proposed a thhold based DDo attack effect evaluato method usg Qo dces ssued by 3rd Geerato Partershp Project (3GPP) If the dex was beyod the ormal Qo rage, the applcato was cosdered as faled The percetage of faled trasactos (PFT) was used as the evaluato metrc of DDo attack effect The weghted sum of PFT of the whole applcatos the etwork traffc llustrated the overall effect of DDo attacks L et al [3] evaluated the effect of DDo attacks based o packets The LAR, rato of the legtmate traffc passed rate (LTPR) over the attack traffc passed rate (ATPR), was used to measure the performace of the DDo defese The hgher of the LAR, the better of the defese Recetly may earches focused o selectg the optmal defedg strategy order to crease the securty level May theores are corporated Game theory s oe of the ma approaches Ya et al [4] bult a game-theoretcal framework for evaluatg DDo attacks ad defese The work studed the stuato that, whe mult-layer defese was deployed, how the system parameters would affect the decso of both the attacker ad the defeder Lu et al [5] bult models for attacker s teto, objectves ad strateges The attack scearos are categorzed to e types from two dmesos of aglty ad accuracy of truso detecto, ad correlato amog attack actos It was poted out that the teto, objectves ad strateges could be ferred usg game theoretc approach, whch would beeft the cyber securty We et al [6] troduced the cocept of the defese graph Icorporated wth the defese graph, the cost of strategy was calculated It the utlzed the game theoretc method to select the optmal defedg strategy Bed et al [7] modeled the badwdth depleto attack The work focused o the probabltes of allowg, redrectg ad droppg the comg traffc The optmal values of the probabltes were calculated usg game theoretc approach All these works are elghteg However, these works maly cosdered the problem of selectg the optmal defedg strategy the exstg strategy set Whle we developed the method to select the optmal defedg strategy both the exstg strategy set ad the geerated strategy set, wth the help of GMDC 3 GAME MODEL FOR DDO COUNTERMEAURE ELECTION (GMDC) I DDo attack scearos, the attacker ad the defeder are two compettors They try to amplfy ther effect Both the attacker ad the defeder have strateges to crease ther effect We buld GMDC to gude the selecto of the optmal defedg strategy GMDC s a 6-tuple vector: IBN: 978--98935-4-7 24 DIWC 5
G = (,, γ,, U, U ) Com The elemets GMDC are descrbed wth more detals below: s the set of the attackg strateges I ths paper, attackers have 2 attackg strateges, large umber of zombes wth slow sedg rate (LZR), ad small umber of zombes wth fast sedg rate (ZFR) Therefore, ={LZR, ZFR} s the tal set of the defedg strateges I ths paper, defeders have 3 basc defedg strateges, creasg Q lmt (IQ), rate lmtg (RL), ad source blockg (B) Qlmt s the maxmum umber of half-opeed coectos Therefore, ={IQ, RL, B} γ s the mappg relato betwee ad Com, γ : Com It repets the process of geerate ew defedg strateges by combg the defedg strateges from the tal defedg strategy set Com s the geerated defedg strategy set by combg basc strateges Com =, + + = I ths paper, Com B, RL-B, IQ-RL-B} + = 2 ={IQ-RL, IQ- Com ad form the ew set of defedg strateges, marked as New Therefore, New = + Com =, = I ths paper, New ={IQ, RL, B, IQ-RL, IQ-B, RL-B, IQ- RL-B} U, U are the utlty fuctos for the attacker ad the defeder pectvely The utlty, whch cosders both the effect ad the cost, repets the satsfacto the player expereces whe takg the strategy Therefore, We use utlty to quatfy the strateges The utlty fuctos are further dscussed wth more detals secto 4 It s easy to uderstad that the optmal defedg strategy s the oe wth the bggest utlty However, the strategy wth the bggest utlty uder oe attackg strategy may ot be the strategy wth the bggest utlty uder aother attackg strategy Therefore, the Nash equlbrum s corporated to select the optmal defedg strategy agast DDo attacks The Nash equlbrum s the state that each player gas hs maxmum utlty They have o cetve to chage ther strategy that state As a ult the Nash equlbrum ca gude the defeder to select the optmal defedg strategy I ths paper, the Nash equlbrum s peted as a vector: = { s *, s *} Nash s * s the optmal strategy for the attacker, s * s the optmal strategy for the defeder 4 UTILITIY FUNCION OF GMDC I DDo attack scearos, both the attacker ad the defeder pay the cost ad ga the reward The dfferece betwee the reward ad the cost s defed as utlty The utlty fuctos for the attack ad the defeder are lsted below α U = α Reward β () U = α Reward β (2), β, α, β are the adjust parameters The attacker gas reward whe the attack flueces the vctm The defeder gas reward whe the protecto mtgates the attack effect Itutvely, we use the attack effect ad the defese effect to quatfy the reward gaed by the attacker ad the defeder pectvely The ature of DDo attacks s to fluece the avalablty Accordgly, the varato of avalablty ca be used to repet the attack effect ad the defese effect to (ack Effect) ack Effect E s expsed as the dfferece betwee the avalablty of the vctm wth o attack Ava o _ ad that wth attack Ava E = Ava Ava (3) o _ to 2 (ese Effect) ese Effect E s expsed as the dfferece betwee the attack effect the attacker produced wth o defese E ad that wth coutermeasu E _ wth _ IBN: 978--98935-4-7 24 DIWC 6
E = E E _ wth _ = Avao _ Ava ( Avao _ Ava _ wth _ ) = Ava Ava _ wth _ (4) The avalablty ca be perceved by dfferet approaches I ths paper, we proposed a method that measu avalablty from legtmate users perspectve If the DDo attack occurs, the ormal user wll otce that the whole applcatos volvg etwork data trasmsso become slow, ad that teractos wth those applcatos take loger tme It dcates the tme betwee sedg a request ad recevg the corpodg pose ca be used to measure the avalablty, thus reflectg the mpact of DDo attacks Here we frst gve two deftos, ad the a formula for calculatg the avalablty s peted to 3 (Average Respodg Tme) Average Respodg Tme T s the average of podg tme T wth pect to the umber of successfully request-ad-pod actos T = T = ( t ' t) (5) T s the th successfully request-ad-pod acto, s the total umber of successfully request-ad-pod actos, t s the momet the legtmate user seds the request, ad t ' s the momet he successfully receves the pose to 4 (Respodg Probablty) Respodg probablty P s the probablty of a request set by the legtmate user beg poded by the vctm I ths paper, t s defed as the percetage of successfully poded requests set C Req_uccess dvded by total requests set C Req_Total P C Req_uccess = % (6) CReq_Total The avalablty s calculated usg average podg tme T ad podg probablty P : Aval = Tob [ P T + ( P) Tob ] (7) T ob s the observato tme I fact, the expso P T + ( P) Tob s the mathematcal expectato of the tme betwee sedg a request ad recevg the corpodg pose for a legtmate user Above all, the process of calculatg the utlty s peted Moreover, the processes of calculatg the utlty of the combed defedg strategy ad the utlty of the corpodg attackg strategy are dscussed below Whe calculatg the combed defedg strategy s utlty, we frst calculate the defese effect ad the cost of the combed defedg strategy usg formula (8), (9) The the utlty of the combed defedg strategy s calculated usg formula (2) E _ ECo m = [ ( )] E (8) E = (9) Com _ E s the attackg effect gaed wthout defedg strateges The utlty for the attackg strategy that cofrot the combed defedg strategy s calculated usg formula () The cost of the attackg strategy s uchaged, but the attack effect s recalculated by formula () ECo = E ECom () E Com s the defese effect of the cofrotg defedg strategy 5 EXPERIMENT The expermet s smulated usg FNet [8], a etwork smulator It cotas modules to mmc the DDo attack actvtes For the uversalty, we radomly geerated a etwork topology wth routers ackers, the vctm ad legtmate users are all attached to the routers ackers ad legtmate users sed requests to the vctm, ad the vctm pods to the requests The expermet uses the YN-flood attack as the attackg method The YN-flood attack creates a complete TCP three-way hadshake state wth the vctm by mssg the ACK packet The vctm s forced to keep a large umber of halfopeed coectos so that the ource s exhausted Therefore, the vctm s uable to pod to ew requests The objectve of the DDo attack s acheved I ths expermet, the LZR mplemets as 5 zombes sedg at /3 request/sec each The ZFR mplemets as 2 zombes sedg at request/sec each The IQ mplemets as creasg the Qlmt from 4 to 8 The RL mplemets as droppg all the packets f traffc s over 8Kbps IBN: 978--98935-4-7 24 DIWC 7
The B mplemets as detfyg ad blockg 5 zombes ome parameters of the expermet are demostrated Table Table Parameters of the expermet Parameter Meag Value the maxmum umber of halfopeed coectos Q lmt 4 the badwdth of the bottleeck lk(mbps) BW th 2 the tme of observato(secod) T ob α attack effect 6 β attack cost α defese effect β defese cost 3 LZR the cost of LZR ZFR the cost of ZFR 75 IQ the cost of IQ 2 RL the cost of RL 5 B the cost of B FNet s used to smulate dfferet DDo scearos where the attacker ad the defeder take dfferet strateges Parameters of P ad T these scearos are collected ad are show Table 2 Table 2 P ad T collected dfferet sceros cearo P T No ack No ese 998529 699 LZR wthout ese 5834 654349 ZFR wthout ese 27342 6585 LZR vs IQ 6428 7652 LZR vs RL 939933 8328 LZR vs B 632467 688435 ZFR vs IQ 48354 668494 ZFR vs RL 44225 669 ZFR vs B 995257 533536 ese effects of the strateges are calculated based o formula (3), (4), (7) ese effects of the strateges Com are calculated usg formula (8) The ults are rouded to teger ad demostrated Table 3 Table 3 ese effects of the strateges ad Com ese Effect LZR ZFR IQ 4 22 RL 43 7 B 26 722 IQ-RL 444 333 IQ-B 24 724 RL-B 447 724 IQ-RL-B 457 725 The cost of each combed defedg strategy s calculated usg formula (9) The ult s show Table 4 Table 4 s of the combed defedg strateges edg trategy IQ-RL 7 IQ-B 2 RL-B 5 IQ-RL-B 7 The utltes of the defedg strateges are calculated usg formula (2) ad show Table 5 The we cosder the attacker s utlty The attack effects are calculated usg formula (3) for basc attackg strateges ad () for combed strateges Results are show Table 6 Wth the cost of each attackg strategy, the utltes for the attack facg dfferet defedg strateges are calculated ad show Table 7 After that, the Nash equlbrum of the GMDC s calculated The ult s p ={84%, 859%}, p ={, 82%,,,, 998%, }, whch dcates that the optmal defedg strategy s RL-B Table 5 Utltes of defedg strateges Utlty LZR ZFR IQ 324 972 RL 28 626 B 56 3632 IQ-RL 964 298 IQ-B 224 3344 RL-B 582 3244 IQ-RL-B 342 295 IBN: 978--98935-4-7 24 DIWC 8
Table 6 ack effects ecouterg dfferet defedg strateges 6 CONCLUION ack Effect LZR ZFR IQ 39 57 RL 65 558 B 369 7 IQ-RL 5 396 IQ-B 29 5 RL-B 48 5 IQ-RL-B 38 4 Table 7 Utltes of attackg strateges Utlty LZR ZFR IQ 388 54 RL 62 555 B 366 4 IQ-RL 48 393 IQ-B 288 2 RL-B 45 2 IQ-RL-B 35 I order to cofrot the severe threat of DDo attacks, ths paper proposed a approach that frst geerates ew defedg strateges, ad that selects the optmal oe amog them Frst, the GMDC model s bult based o Game theory The, from the legtmate user s perspectve, the attack effect ad the defese effect s defed They are volved calculatg the attack utlty ad the defese utlty GMDC Next, ew defedg strateges are geerated by combg exstg defedg strateges together The utltes of the combed defedg strateges ad the corpodg attackg strateges are calculated Fally, by solvg the Nash equlbrum, the optmal defedg strategy s selected Usg the etwork smulator FNet, the expermets are performed to valdate the effectveess of the method There s stll a lot to earch The cost of the defedg strateges should be surveyed from more aspects A effcet method of geeratg strategy combatos ad elmatg the bad choce at the early stage have to be foud We shall work o these jobs the future 7 ACKNOWLEDGEMENT Ths work was supported by Natoal Hgh-Tech Research ad Developmet Pla of Cha uder Grat No Q23GX2D2, 2AAA23, the Natoal Natural cece Foudato of Cha uder Grat No 6226, 633248, the Bejg Natural cece Foudato uder Grat No 42285, 44489, the Natoal cece & Techology Pllar Program of Cha durg the Twelfth Fve-year Pla Perod uder Grat No 22BAK26B 8 REFERENCE [] Yag, X ad Z Wale, Mark-aded dstrbuted flterg by usg eural etwork for DDo defese, Global Telecommucatos Coferece, 25 GLOBECOM '5 IEEE 25 [2] Choka, A, et al, Mult-Core ese ystem (MD) for Protectg Computer Ifrastructure agast DDo acks, Parallel ad Dstrbuted Computg, Applcatos ad Techologes, 28 PDCAT 28 Nth Iteratoal Coferece o 28 p 53-58 [3] Yau, DKY, et al, edg agast dstrbuted dealof-servce attacks wth max-m far server-cetrc router throttles Networkg, IEEE/ACM Trasactos o, 25 3(): p 29-42 [4] Mrkovc, J ad P Reher A taxoomy of DDo attack ad DDo defese mechasms ACM IGCOMM Computer Commucato Revew 24 [5] Peg, T, C Lecke, ad K Ramamohaarao, urvey of etwork-based defese mechasms couterg the Do ad DDo problems ACM Comput urv, 27 39() [6] Butler, A, ecurty attrbute evaluato method: a cost-beeft approach, Proceedgs of the 24th Iteratoal Coferece o oftware Egeerg 22, ACM: Orlado, Florda p 232-24 [7] Bellache, M ad J Gregore Measurg ese ystems Agast Floodg acks Wreless Commucatos ad Moble Computg Coferece, 28 IWCMC '8 Iteratoal 28 [8] chwab,, et al, Methodologes ad metrcs for the testg ad aalyss of dstrbuted deal of servce attacks ad defeses, IEEE Mltary Commucatos Coferece, 25 MILCOM 25 25 p 2686 2692 [9] Meadows, C, A Formal Framework ad Evaluato Method for Network Deal of ervce, Proceedgs of the 2th IEEE workshop o Computer ecurty Foudatos 999, IEEE Computer ocety p 4-3 [] Mrkovc, J, et al, Bechmarks for DDo defese evaluato, Mltary Commucatos Coferece, 26 MILCOM 26 26 p [] Mrkovc, J, et al, Measurg deal Of servce, Proceedgs of the 2d ACM workshop o Qualty of protecto 26, ACM: Alexadra, Vrga, UA p 53-58 [2] Mrkovc, J, et al, Towards user-cetrc metrcs for deal-of-servce measuremet, Proceedgs of the 27 workshop o Expermetal computer scece 27, ACM: a Dego, Calfora [3] L, Z, Y Xag, ad D He, mulato ad Aalyss of DDo Actve ese Evromet, Computatoal IBN: 978--98935-4-7 24 DIWC 9
Itellgece ad ecurty, Y Wag, Y-m Cheug, ad H Lu, Edtors 27, prger Berl Hedelberg p 878-886 [4] Ya, G, et al Towards a Bayesa Network Game Framework for Evaluatg DDo acks ad ese Proceedgs of the 9th ACM coferece o Computer ad commucatos securty - CC '2, 22: p 553-566 [5] Lu, P, W Zag, ad M Yu, Icetve-based Modelg ad Iferece of acker Itet, Objectves, ad trateges ACM Tras If yst ecur, 25 8(): p 78-8 [6] Jag, W, et al Optmal Network ecurty tregtheg Usg ack-ese Game Model xth Iteratoal Coferece o Iformato Techology: New Geeratos, 29 ITNG '9 29 [7] Bed, H, Roy, ad hva Game theory-based defese mechasms agast DDo attacks o TCP/TCPfredly flows 2 IEEE ymposum o Computatoal Itellgece Cyber ecurty (CIC) 2 [8] FNet, calable smulato framework etwork models, http://wwwssfetorg/homepagehtml IBN: 978--98935-4-7 24 DIWC 2