{"id":204,"date":"2017-10-23T11:04:50","date_gmt":"2017-10-23T15:04:50","guid":{"rendered":"https:\/\/sites.bu.edu\/nislab\/?page_id=204"},"modified":"2019-08-01T09:29:13","modified_gmt":"2019-08-01T13:29:13","slug":"cascading-dos-attacks-on-wi-fi-networks","status":"publish","type":"page","link":"https:\/\/sites.bu.edu\/nislab\/cascading-dos-attacks-on-wi-fi-networks\/","title":{"rendered":"Cascading DoS Attacks on Wi-Fi Networks"},"content":{"rendered":"

posted by Liangxiao Xin (xlx@bu.edu)<\/p>\n

Full paper<\/a> & Simulation code<\/a><\/p>\n

Outline:<\/h5>\n
    \n
  1. About\u00a0cascading DoS attack <\/a><\/li>\n
  2. Feasibility of the attack <\/a><\/li>\n
  3. Conclusion <\/a><\/li>\n<\/ol>\n

    About\u00a0cascading DoS attack<\/h4>\n

    A cascading DoS attack exploits a coupling vulnerability due to hidden nodes. The attack propagates beyond the starting location, lasts for long periods\u00a0of time, and forces the network to operate at its lowest bit rate. The attack can be started remotely and without violating the IEEE 802.11 standard, making it difficult to trace back.<\/p>\n

    \"general_case\"
    Fig. 1: Illustration of a cascading denial of service attack. Transmissions by an attacker impact nodes located far away, due to interference coupling caused by hidden nodes.<\/figcaption><\/figure>\n

    Figure 1 serves to illustrate this phenomenon at a high level. Suppose that an attacker increases the rate at which it generates packets, and transmits these packets in accordance with the IEEE 802.11 protocol. These transmissions may cause packet collisions at nodes concurrently receiving packets from other sources. Due to the infamous hidden node problem,\u00a0which is hard to avoid in wireless networks, transmitters may be unable to hear transmission by other nodes, even when using CSMA, and hence keep retransmitting packets until they reach the so-called retry limit of the back-off procedure. These retransmissions affect other neighbours and may propagate.<\/p>\n

    Feasibility of\u00a0the attack<\/h4>\n

    Network model<\/h5>\n

    The network model considered in this paper is shown in Figure 2. We consider \\(N\\) pairs of nodes. Each node \\(A_i\\) (\\(i = 0, 1, 2, \\dots , N\\)) transmits packets to node \\(B_i\\). The dashed circle represents the range of transmission. Node \\(B_{i+1}\\) can receive packets from both node \\(A_i\\) and node \\(A_{i+1}\\). However, node \\(A_i\\) and node \\(A_{i+1}\\) cannot hear each other. That is, node\u00a0\\(A_i\\) is a hidden node with respect to node \\(A_{i+1}\\) (and viceversa). A packet collision happens at node \\(B_{i+1}\\) when packet transmissions by node \\(A_i\\) and \\(A_{i+1}\\) overlap.<\/p>\n

    \"linear_topology_new2\"
    Fig. 2: Topology of the network. Node Ai<\/sub> transmits packets to node Bi<\/sub>. Node Ai<\/sub> is a hidden node with respect to Ai+1<\/sub>.<\/figcaption><\/figure>\n
    Attack goal<\/h5>\n

    Our goal is to investigate how node \\(A_0\\) can trigger a cascading DoS attack, resulting in a congestion collapse over the entire network. We start by increasing the packet generation rate at node \\(A_0\\). Node \\(A_0\\) transmits packets over its channel, in compliance with the IEEE 802.11 standard. The transmissions by node \\(A_0\\) cause packet collisions at node \\(B_1\\). These collisions require node \\(A_1\\) to retransmit packets. The increased amount of packet transmissions and retransmissions by node \\(A_1\\) impact node \\(A_2\\) and so forth. If this effect keeps propagating and amplifying, then the result is a network-wide denial of service, which we refer to as a cascading Denial of Service (DoS) attack. Because this attack is protocol-compliant, it is difficult to detect or trace back to the initiator. We note that the topology studied here could arise over different time and space in more complex network configurations.<\/p>\n

    Experimental result<\/h5>\n

    We set up an experimental testbed composed of six nodes. The testbed configuration is shown in Figure 3. We establish an IEEE 802.11n ad hoc network consisting of three pairs of nodes. Each node consists of a PC and a TP-LINK TLMN722N Wireless USB Adapter. We use RF cables and splitters to link the nodes, isolate them from external traffic, and obtain reproducible results.\u00a0We place 70 dB attenuators on links between node \\(A_i\\) and \\(B_i\\) (\\(i \\in 0, 1, 2\\)), and 60 dB attenuators on links between nodes \\(A_i\\) and \\(B_{i+1}\\). The difference in the signal attenuation of different links insures that a packet loss occurs if a hidden node transmits.\u00a0The transmission power of each node is set to 0 dBm. We use iPerf to generate\u00a0UDP data streams and to measure the throughput achieved on each node. The length of a packet is the default IP packet size of 1500 bytes.<\/p>\n

    \"exp_setup_new2\"
    Fig. 3: Experimental testbed.<\/figcaption><\/figure>\n

     <\/p>\n

    Figure 4 demonstrates the cascading DoS attack on the experimental testbed. At first, the packet generation rates of nodes \\(A_0\\), \\(A_1\\) and \\(A_2\\) are set to 400 Kb\/s. We observe that the throughput of all the nodes remains in the vicinity of 400 Kb\/s during the first 300 seconds. After 300 seconds, \\(A_0\\) starts transmitting packets at 1 Mb\/s. As a result, the throughput of nodes \\(A_1\\) and \\(A_2\\) suddenly vanishes. Once node \\(A_0\\) resumes transmitting at 400 Kb\/s, the throughput of node \\(A_1\\) and node \\(A_2\\) recovers.<\/p>\n

    \"implementation_result_new2\"
    Fig. 4: Throughput performance measurements in testbed. When node A0<\/sub> starts increasing its packet generation rate, the throughput of nodes A1<\/sub> and A2<\/sub> vanishes.<\/figcaption><\/figure>\n
    Simulation result<\/h5>\n

    In order to gain a better insight into the attack in large-scale networks, we resort to ns-3.22 simulations, a state-of-the-art simulator which includes high-fidelity wireless libraries. We show the occurrence of cascading DoS attacks in ad hoc networks with fixed bit rate.<\/p>\n

    We describe the occurrence of a cascading DoS attack in an ad hoc network with fixed bit rate. We consider a linear topology consisting of 40 pairs of nodes (i.e. a sequence of 40 hidden nodes), as shown in Figure 2. We fix the bit rate to 1 Mb\/s and the retry limit to \\(R = 7\\).\u00a0We set up a Wi-Fi network using the standard IEEE 802.11 library in ns-3. At each node \\(A_i\\), \\(i \\geq 1\\), UDP packets arrive at rate \\(\\lambda_i = 8.125\\) pkts\/s. The packet generation rate at node \\(A_0\\), \\(\\lambda_0\\), varies from 1.25 to 61.25 pkts\/s. The size of each packet is 2000 bytes. Each node has the same transmission power (40 mW). We set the propagation loss between node \\(A_i\\) and \\(B_i\\) to 80 dB and the propagation loss between node \\(A_i\\) and \\(B_{i+1}\\) to 70 dB. We run each simulation five times for 1,000 seconds, and average out the results. The source code is available on Github<\/a>.<\/p>\n

    The (exogenous) load<\/b> at each node \\(A_i\\) is denoted \\(\\rho_i = \\lambda_i T\\), where \\(T\\) represents the duration of each packet transmission attempt (0.016 second in our case). The utilization<\/b> of a node \\(A_i\\), denoted \\(u_i\\), is defined as the fraction of time the node is busy transmitting bits on the channel.<\/p>\n

    Figures 5 and 6 depict the utilization \\(u_1\\), \\(u_{20}\\), and \\(u_{40}\\) as a function of \\(\\rho_0\\), the load at node \\(A_0\\). The utilization of node \\(A_1\\), \\(u_1\\), increases smoothly until it reaches its upper limit. However, the utilization of nodes \\(A_{20}\\) and \\(A_{40}\\) remains low until \\(u_0\\) reaches a certain threshold around \\(\\rho_0 = 0.5\\), at which point \\(u_{20}\\) and \\(u_{40}\\) suddenly jump to a high value. This sudden jump corresponds to a phase transition, and the critical threshold represents the phase transition point.<\/p>\n\n\n\n
    \n

    \"one_node_phase_transaction_new2\"
    Fig. 5: The occurrence of cascading DoS attacks in ad hoc networks with fixed bit rate. Utilization of nodes Ai<\/sub> (i \u2265 1) for different traffic loads at node A0<\/sub>. The utilization converges as i gets large. When the load at node A0<\\sub> changes from 0.4 to 0.6, the sequence of utilization converge to different limits, illustrating the phase transition.<\/sub><\/figcaption><\/figure><\/td>\n
    		\n

    \"one_node_load_phase_transaction_new2\"
    Fig. 6: The occurrence of cascading DoS attacks in ad hoc networks with fixed bit rate. As the traffic load at node A0<\/sub> increases, the utilization of remote nodes (e.g., A20<\/sub> and A40<\/sub>) exhibits a phase transition.<\/figcaption><\/figure><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

     <\/p>\n

    Analysis<\/h5>\n

    We develop an analytical model that provides insight into the network behaviour observed in the simulations and experiments. Specifically, our goal is to explain why and under what conditions the phase transition occurs, and shed light into the roles played by the retry limit R and the traffic load at the different nodes.<\/p>\n

      \n
    1. \n
        \n
      1. Notations:<\/b>\n