QoP List of Accepted Papers

Abstract: Denial-of-service (DoS) attacks significantly degrade the service quality experienced by legitimate users, by introducing large delays, excessive losses, and service interruptions. The main goal of DoS defenses is to neutralize this effect, and to quickly and fully restore quality of various services to levels acceptable by the users. To objectively evaluate a variety of proposed defenses we must be able to precisely measure the damage created by the attack, i.e., the denial of service itself, in controlled testbed experiments. Current evaluation methodologies summarize DoS impact superficially and partially by measuring a single traffic parameter, such as duration, loss or throughput, and showing a variation of this parameter during the attack from its baseline case. These measures fail to capture the overall service quality experienced by the end users, the quality-of-service requirements of different applications and how they map into specific thresholds for various traffic parameters.

We propose a series of DoS impact metrics that are derived from traffic traces gathered at the source and the destination networks. We segment a trace into higher-level user tasks, called transactions, that require a certain service quality to satisfy users' expectations. Each transaction is classified into one of several proposed application categories, and we define quality-of-service (QoS) requirements for each category via thresholds imposed on several traffic parameters. We measure DoS impact as a percentage of transactions that have not met their QoS requirements and aggregate this measure into several metrics that expose the level of service denial and its variation over time. We evaluate the proposed metrics on a series of experiments with a wide range of background traffic and our results show that our metrics capture the DoS impact more precisely then partial measures used in the past.