hotpxl / low-rate-tcp-targeted-dos-attacks

Reproduction of Low-Rate TCP-Targeted Denial of Service Attacks

Low-Rate TCP-Targeted Denial of Service Attacks

This is a reproduction of Low-Rate TCP-Targeted Denial of Service Attacks.

Steps to reproduce

1. Create a fresh GCE virtual machine with Ubuntu 16.10, and set firewall rules to be able to access the HTTP server that will be started. We recommend that you use the following commands to create and connect to the instance. Otherwise, you should perform the corresponding instance creation and firewall setup in the GCE web UI.

   gcloud compute instances create --image ubuntu-1610-yakkety-v20170502 --image-project ubuntu-os-cloud --machine-type n1-highcpu-8 --zone us-central1-c --tags http-server,https-server cs244
   gcloud compute firewall-rules create http --allow tcp:80
   gcloud compute ssh cs244

2. In your GCE instance, execute the following:

   curl "https://cs.stanford.edu/people/rpropper/cs244/setup.sh" | /bin/bash

   This script will install Python dependencies (e.g. matplotlib), check out and install Mininet. Note: We provide this setup script as a separate step from the VM image for better clarity and transparency. Feel free to inspect the script before running it.

3. Clone our git repo:

   git clone https://github.com/hotpxl/low-rate-tcp-targeted-dos-attacks.git

4. Now, cd low-rate-tcp-targeted-dos-attacks and sudo ./run.sh to run the experiment. Please be patient; a run takes between 1 to 2 hours. If you want to have the full results as in our blog post, run with sudo ./run.sh -f.

5. After the script runs, it will show you a URL where you can view the results. There should be two generated .png files in the root directory. One (results-<hostname>-date_rate.png) will show the normalized throughput, i.e., the primary figure we are trying to reproduce. The other shows the sender’s cwnd values, plotted over time, for various attack period values.

low-rate-tcp-targeted-dos-attacks's Issues

cs244-PA3

How is this related to https://github.com/hcaseyal/cs244-PA3 ?

Kind of looks like a refactored version. But it also contains differences like a different payload size for packets send as bursts.

https://github.com/hcaseyal/cs244-PA3/blob/master/shrew.py#L20 has 1500 bytes payload which I assume would lead to TWO IP fragments per UDP datagram. In this repo first 1000 zeros are created as data (https://github.com/hotpxl/low-rate-tcp-targeted-dos-attacks/blob/master/run_attacker.py#L39). But, these are never used and instead 128 zeros are send as payload which I assume will only lead to ONE IP fragment.

And I try to run it but cannot get it work. Unfortunately I don't have gcloud. I try with a Ubuntu 18.x VM, but am stuck at this AssertionError.

root@ubuntu-4gb-nbg1-1:~/low-rate-tcp-targeted-dos-attacks# ./run.sh 
Run 20211109-150039 on ubuntu-4gb-nbg1-1 (162.55.214.148) started.
python: no process found
dd: no process found
tshark: no process found
dumpcap: no process found

Starting attack, burst=0.15, period=0.50
Alice's IP is 10.0.0.1.
Bob's IP is 10.0.0.2.
Mallory's IP is 10.0.0.3.

UDP attack started from 10.0.0.3 to 10.0.0.2.
Starting receiver on 10.0.0.2.
Starting sender on 10.0.0.1.
TCP flow started on Alice and Bob.
Traceback (most recent call last):
  File "dos.py", line 153, in <module>
    main()
  File "dos.py", line 143, in main
    t = run_flow(net, cwnd_file=cwnd_file)
  File "dos.py", line 74, in run_flow
    assert c.wait() == 0
AssertionError