Lecture 6

Denial of service is a form of attack on the availability of some service. In the con- text of computer and communications security, the focus is generally on network services that are attacked over their network connection. We distinguish this form of attack on availability from other attacks, such as the classic acts of god, that cause damage or destruction of IT infrastructure and consequent loss of service.
The NIST Computer Security Incident Handling Guide [SCAR08] defines denial-of-service (DoS) attack as follows:From this definition, you can see that there are several categories of resources that could be attacked:
• Network bandwidth
• System resources
• Application resources
Network bandwidth relates to the capacity of the network links connecting a server to the wider Internet. For most organizations, this is their connection to their Internet service provider (ISP), as shown in the example network in Figure 7.1. Usually this connection will have a lower capacity than the links within and between ISP rout- ers. This means it is possible for more traffic to arrive at the ISP’s routers over these higher-capacity links than can be carried over the link to the organization. In this circumstance, the router must discard some packets, delivering only as many as can be handled by the link. In normal network operation such high loads might occur to a popular server experiencing traffic from a large number of legitimate users. A random portion of these users will experience a degraded or nonexistent service as a consequence. This is expected behavior for an overloaded TCP/IP network link. In a DoS attack, the vast majority of traffic directed at the target server is malicious, generated either directly or indirectly by the attacker. This traffic overwhelms any legitimate traffic, effectively denying legitimate users access to the server. The GRC. com (Gibson Research Corporation) Web site contains several reports detailing DoS attacks on its servers in 2001 and 2002 and its responses to them. These clearly illustrate the effect of such attacks.