SIFF: a stateless Internet flow filter to mitigate DDoS flooding attacks

By Abraham Yaar, Adrian Perrig, Dawn Song. IEEE Symposium on Security and Privacy : Proceedings, 2004

430 citations recorded by the source corpus.

One of the fundamental limitations of the Internet is the inability of a packet flow recipient to halt disruptive flows before they consume the recipient's network link resources. Critical infrastructures and businesses alike are vulnerable to DoS attacks or flash-crowds that can incapacitate their networks with traffic floods. Unfortunately, current mechanisms require per-flow state at routers, ISP collaboration, or the deployment of an overlay infrastructure to defend against these events. In this paper, we present SIFF, a Stateless Internet Flow Filter, which allows an end-host to selectively stop individual flows from reaching its network, without any of the common assumptions listed above. We divide all network traffic into two classes, privileged (prioritized packets subject to recipient control) and unprivileged (legacy traffic). Privileged channels are established through a capability exchange handshake. Capabilities are dynamic and verified statelessly by the routers in the network, and can be revoked by quenching update messages to an offending host. SIFF is transparent to legacy clients and servers, but only updated hosts will enjoy the benefits of it.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/1acdda971ae8a4216ebfd24e2e00358ff25133ff

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

A Survey of Defense Mechanisms Against Distributed Denial of Service (DDoS) Flooding Attacks (2013, background): “A.1.4.d. Capability-based mechanisms [95]: These mechanisms let the destination explicitly authorize the trafﬁc it desires to receive (e.g., Portcullis [96], Trafﬁc Validation Architecture (TVA) [97], [98], and Stateless Internet Flow Filter (SIFF) [99]).”
SANE: A Protection Architecture for Enterprise Networks (2006, background): “Much recent work has focused on DoS remediation through network enforced capabilities [8, 31, 32] on the WAN.”
A DoS-limiting network architecture (2005, background): “SIFF is implemented as described in [26].”