Retos y oportunidades de crecimiento en el mercado de la dermoestética

Finally, we evaluate the influence of the surrounding traffic on the effectiveness of the attack. The traffic of a network is one of its most variable attributes and can differ greatly between different periods of a day, week or month depending on the services provided by the network. We look at the effects of the potential variation in traffic (particularly the number of flows being created) in the network on the attack to determine how it affects the number of evictions flows experience.

As explained before, the Flow Table is a limited resource and even without the presence of a malicious user performing the attack, the benign users compete for the resource. It stands to reason therefore that the more benign users competing for this resource (i.e the more benign users attempting to get flow rules into the Flow Table to move traffic through the network), the more evictions will occur. While a resource at a fixed size may be equipped to provide good service to a certain number of users, service may degrade as the number of users increases. Thus, the background traffic during the attack can actually increase the effectiveness of the attack as more users cause more traffic and more evictions. We show this here by varying the background traffic seen during the attack, holding the table size fixed and increasing the number of users/IP addresses in the traffic trace.

Our constant background traffic through the previous experiments has been a subset of a Caida dataset which includes 50 unique source-destination pairings which generate 743 flows with 199997 individual packets within a 60 second period. We vary this fixed dataset, substituting it for several other subsets of the Caida dataset which vary the number of unique source-destination pairings and so vary the number of flows in them. In this way, we are able to model a network of varying sizes, from a small network of 40 hosts to a larger network of 750 hosts. Table 3.2 lists the relevant properties of each dataset.

Name Number of Unique IP addrs Flows Packets Caida 40 40 331 154690 Caida 50 50 743 199997 Caida 100 100 1730 493050 Caida 200 200 3948 1234544 Caida 500 500 12472 2597887 Caida 750 750 17061 3272669

Table 3.2: Background Traffic Datasets

3.5.4.1 Spray attack

We keep the spray attack at our constant rate of 300FPS and use a fixed Flow Table size of 500 spaces while varying the background traffic in the datasets. We document the results of these experiments in Tables 7a-7d in the Appendix and the

throughput changes in Figure 3.12

Figure 3.12: Bandwidth Changes under varying Background Traffic: Spray Attack

The experiments show that as the amount of traffic and flows in the network increases, the number of of evictions of the experimental flow increase for both the FIFO and Random eviction policies. Increase in the number of flows in the network intensifies the competition for the flow table resource, aiding the attack in causing a higher number of rule evictions. While the base dataset (50 hosts) caused 17670 flow removals, the largest network (750 hosts) increased the number of flow removals by 2630 reducing the throughput by a further 3% in the FIFO eviction policy. The Random flow eviction policy records a difference of 8384 flow evictions between the smallest and largest network, with the largest network registering a 14% throughput reduction from the smallest. We also note that it continues to have no effect on the volume based policies. This is likely because most of the flows in the trace are short lived and do not carry large amounts of traffic which create enough competition to remove the experimental flow under these policies.

3.5.4.2 Clog Attack

We perform the clog attack with 7 attackers sending traffic through 499 rules of a table of size of 500. With the clog attack, additional traffic in the network can drastically increase the competition for flow rule space within the switch. It signif- icantly increases the rate at which new rules are added to the Flow Table and in doing so, increases the rate at which they are evicted. The more flow rule evictions that need to occur while the attack is attempting to hold the majority of the flow spaces, the more likely the experimental flow is to be selected as the flow for eviction and removed.

Figure 3.13: Bandwidth Changes under varying Background Traffic: Clog Attack

The results of the experiments (Tables 8a-8d in the Appendix and Figure 3.13) show that the number of evictions of the experimental flow increases as the amount of traffic in the network increases. Under the FIFO policy, the number of evictions ranges from 7931 evictions in the smallest network to 41755 in the largest for the duration of the 60 second flow. Consequently, the throughput reductions increase with the evictions from an 11% reduction to a 59% reduction in the largest network. Similarly with the Random eviction policy- as the number of evictions increase due to the competition for rule space, the throughput reductions increase from 9% to a 54% reduction . The LFU policy, at which the attack is aimed, registers the largest

throughput reduction (73%) in its largest network. This is consistent with the trend that the clog attack is most effective against the LFU policy and is made even more effective by the increase in traffic. LRU policy registers marginal increases in its number of evictions from 190 evictions in the smallest network to 325 evictions in the largest. It produces marginally different throughputs among the varying network sizes which is also consistent with this policy being the most resilient against attacks on long lasting flows.