MCA2: multi-core architecture for mitigating complexity attacks

  • Authors:

  • Yehuda Afek;Anat Bremler-Barr;Yotam Harchol;David Hay;Yaron Koral

  • Affiliations:

  • Tel Aviv University, Tel Aviv, Israel;The Interdisciplinary Center, Herzliya, Israel;The Hebrew University, Jerusalem, Israel;The Hebrew University, Jerusalem, Israel;Tel Aviv University, Tel Aviv, Israel

  • Venue:
  • Proceedings of the eighth ACM/IEEE symposium on Architectures for networking and communications systems
  • Year:
  • 2012

Quantified Score

Hi-index 0.00

Visualization

Abstract

This paper takes advantage of the emerging multi-core computer architecture to design a general framework for mitigating network-based complexity attacks. In complexity attacks, an attacker carefully crafts "heavy" messages (or packets) such that each heavy message consumes substantially more resources than a normal message. Then, it sends a sufficient number of heavy messages to bring the system to a crawl at best. In our architecture, called MCA2---Multi-Core Architecture for Mitigating Complexity Attacks---cores quickly identify such suspicious messages and divert them to a fraction of the cores that are dedicated to handle all the heavy messages. This keeps the rest of the cores relatively unaffected and free to provide the legitimate traffic the same quality of service as if no attack takes place. We demonstrate the effectiveness of our architecture by examining cache-miss complexity attacks against Deep Packet Inspection (DPI) engines. For example, for Snort DPI engine, an attack in which 30% of the packets are malicious degrades the system throughput by over 50%, while with MCA2 the throughput drops by either 20% when no packets are dropped or by 10% in case dropping of heavy packets is allowed. At 60% malicious packets, the corresponding numbers are 70%, 40% and 23%.