wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

22-8 Industrial Communication Systems
22.3.4 DoS Prevention and Detection
Nevertheless, there are security attacks that cannot be prevented using cryptographic methods. Typical
representatives of such attacks are DoS attacks that threaten data availability. DoS attacks can be classified
into host-based and network-based DoS attacks. Host-based DoS attacks try to waste system
resources (e.g., by consuming processor time of a server by sending multiple requests) to prevent the
target from performing its expected function. Network-based DoS attacks, on the other hand, try to
interrupt the communication in a network. A common example is an adversary that tries to consume
the network bandwidth (e.g., by flooding the network with unsolicited messages). The situation is further
aggravated if multiple sources attack a single victim (distributed DoS attack).
DoS attacks foremost have massive economic impact. Consider, for example, an assembly line that is
the target of a DoS attack. A shutdown of the line leads to an economic impact that can be easily compared
to the impact of a successful attack on the company Web server. The only difference is that for the
Web server elaborate IT security measures are already common practice.
To counteract DoS attacks, two possibilities exist. DoS prevention, on the one hand, has the aim to
limit the access to system resources in a way that an adversary does not have the opportunity to successfully
perform DoS attacks. One opportunity to fully prevent DoS attacks is to limit the physical access
to the network medium and to the devices that have an interface to the medium. (e.g., immuring the
network cable or by locking the devices into a safe containment.) Obviously, such isolation is not always
easy to achieve.
Another possibility to prevent host-based DoS attacks is the use of so-called client puzzles [TUO]. The
main objective of a client puzzle is to make a DoS attack at least as expensive for the adversary as for the
target in terms of computational cost. Consider, for example, a client (e.g., operator workstation) wants
to establish a connection to a server (e.g., controller). To set up a connection, the client sends an initial
request to the server. If the server is busy (e.g., there are other open connections), the server sends back a
client puzzle that the client has to solve. A typical example of such a client puzzle would be a hash value
of limited length [WEI]. The client has the objective to find the input value that produces this hash value.
To achieve this, the client has to solve this problem by brute force. As it is very easy to verify whether the
solution is valid or not, the client must pay more computing costs than the server. After the client has
solved the puzzle, it sends the solution to the server. The server verifies the solution, and if it is correct
the server accepts further requests. If the solution is not valid, access to the requested service is denied
and further requests are temporally blocked from this client.
In situations where prevention methods are inapplicable, DoS attacks shall at least be detected (DoS
detection). In general, the aim is to make the system intrusion tolerant and limit the affected area. A typical
example would be the use of an IDS [CHR]. An IDS tries to detect abnormal system states by comparing
the actual behavior with the expected one. If a situation that may lead to a security attack has
been detected, countermeasures have to be initiated to minimize the consequences.
An IDS commonly consists of four components (cf. Figure 22.3). The data gathering component is
responsible for collecting the data by observing the network traffic as well as the behavior of the different
network devices. IDS are classified according to the type of data collection (i.e., the location of the data
gathering components). A host-based IDS tries to discover abnormal activities on a single host. These
methods observe the activities on a single device and compare the behavior pattern with a reference pattern
(profiling). Host-based intrusion detection is especially applicable for security-critical devices (e.g.,
key servers). A network-based IDS observes the entire network traffic. Therefore, these systems are able
to discover anomalies that affect more than a single host.
The core unit of an IDS is the data processing component. This component processes the collected
data and determines whether abnormal behavior is present. Again, different approaches exist. The two
most important ones are called misuse-based and anomaly-based. Misuse-based systems use a priori
knowledge of activities that form an attack. This knowledge is stored in a database that contains typical
patterns of known attacks also called signatures. To determine whether an observation can be classified
© 2011 by Taylor and Francis Group, LLC