Institut für Verteilte Systeme der Universität Ulm

Das Landesforschungsnetz BelWü wird in den nächsten Jahren von 10 Gbit/s auf 100 Gbit/s ausgebaut. Die Verzehnfachung der physikalischen Datenrate wird aber nicht von alleine zu einem entsprechenden Anstieg der Quality of Experience der Dienstnutzer von BelWü führen. Hierzu ist es vielmehr erforderlich, das Gesamtsystem von Kommunikations– und Zugriffsprotokollen, Firewalls, Intrusion Detection Systemen, Endgeräten und zahlreicher weiterer Komponenten (z.B. Speicherkomponenten) für das 100G-Zeitalter weiterzuentwickeln. Nur so lassen sich die hohen Anforderungen hinsichtlich der von den Anwendungen bzw. Nutzern geforderten hohen Datenraten und geringen Latenzen erzielen. Diese sind essentiell für HPC und Cloud Computing sowie für viele weitere Anwendungen im Bereich Big Data. Weiter stellen die erforderliche Verfügbarkeit und Sicherheit der Diensterbringung gerade bei Netzen mit sehr hohen Datenraten im Bereich von 100G eine immense Herausforderung dar. BelWü muss sich diesen Herausforderungen stellen und benötigt hierfür geeignete technische Lösungen.

Beitrag des Instituts für Verteilte Systeme

Gleiche Sicherheit bei deutlich höherer Geschwindigkeit zu erreichen ist eines der Kernziele des Projektes. Das Institut für Verteilte Systeme fokusiert sich dabei besonders darauf, wie Instrusion Detection Systeme auf die neuen Anforderungen angepasst werden können. Sicherheit in und durch flexible Netze – realisiert durch Software Defined Networking – ist ein weiterer zentraler Forschungsbereich bei dem sich das Institut für Verteilte Systeme einbringt.

Publikationen

2018

Lukaseder, T., Maile, L., Erb, B. and Kargl, F. 2018. SDN-Assisted Network-Based Mitigation of Slow DDoS Attacks. Proceedings of the 14th EAI International Conference on Security and Privacy in Communication Networks. (Singapore, 2018), 102–121.

Slow-running attacks against network applications are often not easy to detect, as the attackers behave according to the specification. The servers of many network applications are not prepared for such attacks, either due to missing countermeasures or because their default configurations ignores such attacks. The pressure to secure network services against such attacks is shifting more and more from the service operators to the network operators of the servers under attack. Recent technologies such as software-defined networking offer the flexibility and extensibility to analyze and influence network flows without the assistance of the target operator. Based on our previous work on a network-based mitigation, we have extended a framework to detect and mitigate slow-running DDoS attacks within the network infrastructure, but without requiring access to servers under attack. We developed and evaluated several identification schemes to identify attackers in the network solely based on network traffic information. We showed that by measuring the packet rate and the uniformity of the packet distances, a reliable identificator can be built, given a training period of the deployment network.

Lukaseder, T., Stölze, K., Kleber, S., Erb, B. and Kargl, F. 2018. An SDN-based Approach for Defending Against Reflective DDoS Attacks. 2018 IEEE 43th Conference on Local Computer Networks (2018). (acceptance rate: 28%)

Distributed Reflective Denial of Service (DRDoS) attacks are an immanent threat to Internet services. The potential scale of such attacks became apparent in March 2018 when a memcached-based attack peaked at 1.7 Tbps. Novel services built upon UDP increase the need for automated mitigation mechanisms that react to attacks without prior knowledge of the actual application protocols used. With the flexibility that software-defined networks offer, we developed a new approach for defending against DRDoS attacks; it not only protects against arbitrary DRDoS attacks but is also transparent for the attack target and can be used without assistance of the target host operator. The approach provides a robust mitigation system which is protocol-agnostic and effective in the defense against DRDoS attacks.

2016

Lukaseder, T., Bradatsch, L., Erb, B. and Kargl, F. 2016. Setting Up a High-Speed TCP Benchmarking Environment - Lessons Learned. 41st Conference on Local Computer Networks (Nov. 2016), 160–163. (acceptance rate: 33%)

There are many high-speed TCP variants with different congestion control algorithms, which are designed for specific settings or use cases. Distinct features of these algorithms are meant to optimize different aspects of network performance, and the choice of TCP variant strongly influences application performance. However, setting up tests to help with the decision of which variant to use can be problematic, as many systems are not designed to deal with high bandwidths, such as 10 Gbps or more. This paper provides an overview of pitfalls and challenges of realistic network analysis to help in the decision making process.

Lukaseder, T., Bradatsch, L., Erb, B., Van Der Heijden, R.W. and Kargl, F. 2016. A comparison of TCP congestion control algorithms in 10G networks. 41st Conference on Local Computer Networks (2016), 706–714. (acceptance rate: 28%)

The increasing availability of 10G Ethernet network capabilities challenges existing transport layer protocols. As 10G connections gain momentum outside of backbone networks, the choice of appropriate TCP congestion control algorithms becomes even more relevant for networked applications running in environments such as data centers. Therefore, we provide an extensive overview of relevant TCP congestion control algorithms for high-speed environments leveraging 10G. We analyzed and evaluated six TCP variants using a physical network testbed, with a focus on the effects of propagation delay and significant drop rates. The results indicate that of the algorithms compared, BIC is most suitable when no legacy variant is present, CUBIC is suggested otherwise.

bwNet100G+

Forschung und Innovative Dienste für ein flexibles 100G-Netz in Baden-Württemberg

Beitrag des Instituts für Verteilte Systeme

Publikationen

2018

2016