This paper proposes a new adaptively distributed packet filtering mechanism to mitigate the DDoS attacks targeted at the victim's bandwidth. The mechanism employs IP traceback as a means of distinguishing attacks from legitimate traffic, and continuous action reinforcement learning automata, with an improved learning function, to compute effective filtering probabilities at filtering routers. The solution is evaluated through a number of experiments based on actual Internet data. The results show that the proposed solution achieves a high throughput of surviving legitimate traffic as a result of its high convergence speed, and can save the victim's bandwidth even in case of varying and intense attacks.

Reputation systems have been proposed as a means to encourage cooperation among the nodes of a network. According to the reputation a node acquires on the basis of its behavior in the network, it may be allowed to receive, or may be deprived of, network services. However, due to free or low-cost pseudonyms and the reputation initially assigned to newcomers, reputation systems are vulnerable to the whitewashing attack, where a selfish node whitewashes its bad reputation by re-entering the network under a new identity. In this paper, we give a multistage game of incomplete information to model the interactions among the nodes of the network. Then, we find the minimal cost of getting a new pseudonym as well as the initial reputation assigned to newcomers so that nodes prefer cooperation to whitewashing as a perfect Bayesian equilibrium of the game. It is also investigated how the view of nodes toward the possible types of other nodes, reflecting how likely a node is selfish, may result in certain behaviors of the nodes.

Quantified information-flow policies put an upper bound on the allowable amount of information flow from high inputs to low outputs of a program. Earlier research in this area has mainly focused on simple imperative languages. In this paper, we present a type system that derives the amount of information flow in the programs of a Java-like language. For this purpose, we adopt the Middlewieght Java (MJ) which is small enough for formal proofs, although it is a proper subset of Java with a fairly rich set of features. Promotable expressions, which also behave as statements, as well as method invocations and the loops they may create are of particular attention in the study of quantified information flow in such a language. We prove that our typing rules are sound and derive correct bounds of information flow for a given program. The proofs are based on a denotational semantics for MJ that we propose as part of this research.

Characterizing the security policies enforceable by run-time monitors has received great attention in recent years. The research, however, has been limited to the monitors having no prior knowledge about possible behaviors of the program they monitor and to a specific class of policies known as properties. This paper takes a first step towards identifying the policies, which are enforceable by the run-time monitors statically provided with a possibly inaccurate approximation of the target's possible executions. We define a run-time monitor as taking such an approximation and deriving an automaton that transforms individual executions. To delineate the policies enforceable in this way, we redefine the paradigms of security policy enforcement so that they can be applied to all policies. In particular, we give new classes of effective and precise enforcement and study the policies enforceable in these paradigms.

Abstract Modal logics have proven invaluable for authorization in distributed systems. The logics devised so far, however, are inadequate to meet the requirements of pervasive environments. Such environments are, in general, characterized as open systems in which computing and communication facilities are provided to human users in a dynamic manner. These features suggest the need for the modification of existing logics in two directions. First, users’ capabilities being intrinsic to pervasive computing should be incorporated into the underlying modal logic. Second, the logic should be equipped with appropriate machinery so that it can deal with the imperfection in the information required for authorization. This paper has contributions in both directions. We present a logic that reflects how the capabilities of users change in different contexts. Nonmonotonicity is then added to the logic so that earlier decisions based on imperfect information can be retracted. The usefulness of our formulation is demonstrated through the added capacity it provides for specifying and enforcing access control policies in real‐life environments. We also present a minimal model semantics that reflects nonmonotonicity through the way it gives meaning to the formulas of the logic. Finally, we propose a sound and complete decision procedure based on semantic tableaux. Copyright © 2014 John Wiley & Sons, Ltd.

ABSTRACT Defense mechanisms against distributed denial‐of‐service (DDoS) attacks usually mitigate the attack by filtering out the excess traffic targeted at the victim. These defenses should be able to discriminate the attack from the legitimate traffic so that filtering can be selectively applied. The problem is exacerbated when spoofed addresses are used in attack packets. This paper proposes traceback‐based distributed packet filter (TDPF), a novel distributed packet filtering mechanism that employs IP traceback as a means for traffic discrimination. In this defense mechanism, packet filters are relocated to the routers nearer the attack sources whenever the traceback algorithm adds such nodes to the attack tree. The filtering probabilities at packet filters are also dynamically adjusted to the volume of traffic the victim receives from each filtering router. In this way, TDPF is able to achieve a high throughput of legitimate traffic while blocking malicious flows. The burden it imposes on a participating router is negligible as well. Moreover, unlike the earlier traceback‐based defenses, it can defend against intense DDoS attacks. Experimental results show that TDPF is effective in different attack scenarios. Copyright © 2013 John Wiley & Sons, Ltd.

ABSTRACT Analyzing the executable code, instead of the high‐level model, of security protocols has received attention in recent years. To this end, a number of security type systems have already been proposed. These type systems are sound but incomplete. That is, a well‐typed protocol is certainly secure, whereas no judgment can be made about the protocol whose type‐annotated code is ill typed. In fact, the type‐based analysis of a protocol would have no result unless we are able to find a well‐typed code that represents both the protocol and the attacker's capabilities. As there is a very large space of possible type annotations and adversary models, this requires a profound knowledge of the rationale behind the underlying type system as well as the components of the protocol being analyzed. The problem is aggravated when the protocol runs in environments containing compromised principals. These issues have rendered the use of such type systems somewhat impractical. This paper is an attempt to resolve the problem for authentication protocols in environments containing Dolev–Yao attackers. We concretize our ideas in F5, a security type checker, and suggest effective type annotations and so‐called attacker interfaces representing the capabilities of a general adversary. Copyright © 2013 John Wiley & Sons, Ltd.

Providing security at programming language level has received enormous attention in recent years. FABLE is an outstanding language intended to enforce the security policies specified by programmers. In doing so, it employs a rich type system whereby only a program with appropriate labels and policy-function calls can type-check. In this paper, we present a constraint-based type system that enables FABLE to infer security labels. It can also be utilized to correct an ill-typed program by identifying missing policy-function invocations. The point is how to preserve the intended functionality of a program when we add code to satisfy a given policy.

The use of client puzzles has been recognized as a preventive defense against resource exhaustion attacks. Its original schemes, however, cannot be used against bandwidth attacks. To resolve this, some defense mechanisms have recently been proposed in which the puzzles are created and the answers are evaluated by the routers distributed over the network. Although interesting, these mechanisms are of high complexity and their success relies on high cooperation from core routers, a thing that is not possible in the near future. In this paper, we propose a novel distributed puzzle-based defense mechanism against bandwidth attacks. Unlike the earlier solutions, it only requires cooperation from the routers within a single autonomous system. To attain such a cooperation, we suggest the use of incentive mechanisms with money. We also employ game theory to decide on appropriate payments to cooperating routers as well as to adjust the difficulty level of the puzzles. Simulation results show that our mechanism is effective in mitigating bandwidth attacks.

A promising method to stimulate cooperation among the nodes of a self-organizing mobile ad hoc network is the application of reputation systems. In these systems, usually, a node uses the recommendations made by the others when evaluating the reputation of the node under consideration. This renders such systems vulnerable to the Sybil attack in which an attacker forges several identities and uses them to recommend itself as a well-behaved node. In this paper, we propose a multistage-game strategy for reputation systems that discourages Sybil attacks. The underlying notion in devising such a strategy is that a Sybil identity, to remain trustworthy, should be active and sincere in recommending the others. Thus, for an effective attack, the attacker should incur the cost of maintaining the trustworthiness of its Sybil identities. This feature can be exploited to design a reputation system in such a way that the attack becomes more costly than cooperation. It is shown that the proposed strategy makes a subgame-perfect equilibrium, which justifies its deployment in real-life networks.

In recent years, a number of puzzle-based defense mechanisms have been proposed against flooding denial-of-service (DoS) attacks in networks. Nonetheless, these mechanisms have not been designed through formal approaches and thereby some important design issues such as effectiveness and optimality have remained unresolved. This paper utilizes game theory to propose a series of optimal puzzle-based strategies for handling increasingly sophisticated flooding attack scenarios. In doing so, the solution concept of Nash equilibrium is used in a prescriptive way, where the defender takes his part in the solution as an optimum defense against rational attackers. This study culminates in a strategy for handling distributed attacks from an unknown number of sources.

A novel formal model is introduced that is tailored to the treatment of the service availability problem in concurrent systems. This model, called hierarchical services of interacting processes (HSIP), incorporates the hierarchy of services, processes, shared variables, and dense time to reason about services quantitatively. The underlying concept is that a service, via its hierarchy, relates to a number of so-called ‘atomic services’ at the bottom of the hierarchy that are the outcomes of actions having no subaction within. The services in a hierarchy are the results M̄of processes acting and interacting with each other to provide the service at the top of the hierarchy. These processes can completely be described by actions resulting in atomic services. The main features of HSIP are twofold. First, through this model, a wide range of quasi-isolated problems such as mutual exclusion, system reconfiguration, fault tolerance, resource allocation, denial of service, and quality of service can be stated and analyzed in a cohesive manner. Second, it retains the use of shared variables, but resolves the main shortcoming of the shared-variable approach, which is the implicitness of interactions among system components.

The problem of service availability is analyzed using the model developed in Part I. It is shown that the general service availability problem is undecidable, i.e. there is no single algorithm to determine whether a given service in a given system is available at a given time. In restricted cases, it is shown that the problem is decidable, but is NP-complete. The problem of service availability is then extended to nondeterministic systems. Finally, it is shown that a number of important cases can be studied in a cohesive manner based on our proposed formalism.

We develop a framework for the analysis of Denial of Service (DoS) attacks in computer networks. In this framework, we identify the components and resources that collectively and in time, construct a service that may become unavailable due to the unavailability of those resources as a result of a DoS. We also construct the notion of service resilience pre-ordering to compare the effectiveness of solutions proposed to improve a system's resilience against DoS. We apply our framework and methods to some cases, and show their usefulness and applicability in practice.