Mitigation of DoS attacks through QoS regulation

As more and more critical services are provided over the Internet, the risk to these services from malicious users is also increasing. Several networks have witnessed Denial of Service (DoS) attacks over the recent past. This paper reports on our experience in building a Linux-based prototype to mitigate the effect of such attacks. Our prototype provides an efficient way to keep track of server and network resources at the network layer and allows aggregate resource regulation. Our scheme provides a general, and not attack-specific, mechanism to provide graceful server degradation in the face of such an attack. We report on the rationale of our approach, the experience in building the prototype, and the results from real experiments. We show that traditional rate-based regulation combined with proposed window-based regulation of resources at the aggregate level at the network layer is a feasible vehicle for mitigating the impact of DoS attacks on end servers. q 2004 Published by Elsevier B.V.