A Moving Target Defense Approach to MitigateDDoS Attacks against Proxy-Based Architectures

Sridhar Venkatesan∗, Massimiliano Albanese∗, Kareem Amin† Sushil Jajodia∗, and Mason Wright†∗ Center for Secure Information Systems

George Mason University, 4400 University Drive, Fairfax, VA 22030, USAEmail: {svenkate,malbanes,jajodia}@gmu.edu† Division of Computer Science and Engineering

University of Michigan, 2260 Hayward Street, Ann Arbor, MI 48109, USAEmail: {amkareem,masondw}@umich.edu

Abstract—Distributed Denial of Service attacks against high-profile targets have become more frequent in recent years. Inresponse to such massive attacks, several architectures haveadopted proxies to introduce layers of indirection between endusers and target services and reduce the impact of a DDoS attackby migrating users to new proxies and shuffling clients acrossproxies so as to isolate malicious clients. However, the reactivenature of these solutions presents weaknesses that we leveraged todevelop a new attack – the proxy harvesting attack – which enablesmalicious clients to collect information about a large number ofproxies before launching a DDoS attack. We show that currentsolutions are vulnerable to this attack, and propose a movingtarget defense technique consisting in periodically and proactivelyreplacing one or more proxies and remapping clients to proxies.Our primary goal is to disrupt the attacker’s reconnaissanceeffort. Additionally, to mitigate ongoing attacks, we propose anew client-to-proxy assignment strategy to isolate compromisedclients, thereby reducing the impact of attacks. We validate ourapproach both theoretically and through simulation, and showthat the proposed solution can effectively limit the number ofproxies an attacker can discover and isolate malicious clients.

I. INTRODUCTION

In recent years, Distributed Denial of Service (DDoS)attacks have emerged as one of the biggest threats to Internetsecurity, with attack volumes reaching 500 Gbps [1]. More-over, with the pervasiveness of botnets and the declining costof launching an attack (e.g., a 1-week DDoS can cost as low as$150 [2]) the risk of DDoS attacks has dramatically increased.

Volumetric or bandwidth-based DDoS attacks disrupt theavailability of a service to its legitimate users by flooding thetarget with large volumes of traffic that result in congesting thetarget’s network infrastructure. While attackers are constantlydeveloping new types of DDoS attacks (such as multi-vectorattacks and application-layer attacks), volumetric attacks con-tinue to be amongst the most common type of attack [1]. Theseattacks leverage the fact that the target’s location can be easilyidentified (e.g., through DNS lookup), allowing the attackersto directly reach the target. A possible approach for preventingan attacker from directly reaching a target is to introduceindirection layers between users and target services [3], [4].In this case, in order to access a protected service, users

This work was partially supported by the Army Research Office undergrants W911NF-13-1-0421 and W911NF-13-1-0317, and by the Office ofNaval Research under grant N00014-13-1-0703.

need to authenticate with an intermediate layer of systemsacting as proxies between the clients and the services, andrelay incoming requests to the servers. Additionally, protectedservices accept traffic only from designated systems in theindirection layer. Although these solutions do not requireInternet-wide adoption to mitigate DDoS threats to a givenenterprise, the indirection layer needs to be well-provisionedto effectively out-muscle the attacks. However, as we cannotindefinitely add resources to the indirection layer and keepadding proxies, we need to investigate how to increase thecomplexity for the attacker without further increasing thenumber of resources the defender has to deploy.

Before launching a DDoS attack, an attacker needs tocollect information about the entry points to the target system(e.g., the IP addresses of targets or proxies). Existing defensivemechanisms focus on curbing the persistence of an attackwhile making it relatively easy to discover these entry points.As a result, these techniques react to a DDoS attack by,for instance, filtering the attack traffic. Therefore, the attacksurface of the protected service remains static before the onsetof an attack. In order to introduce dynamism to the attacksurface and increase the overall effort for the attacker, MovingTarget Defense (MTD) techniques have emerged as a newcyber defense paradigm [5], [6]. These techniques providea principled approach to shift or change a system’s attacksurface so as to introduce uncertainty for the attackers, therebycompromising their ability to plan effective attacks.

Existing MTD-based architectures [7], [8], [9] leveragecloud platforms to host a small set of active proxies. Incomingconnection requests are validated by a well-provisioned lookupserver which then redirects each authorized user to one of thesecret active proxies to serve the user’s subsequent requests.When under attack, a central server instantiates new proxiesand clients associated with attacked proxies are moved tothese newly instantiated proxies. To weed out compromisedclients (assumed to be insiders), existing architectures shufflethe clients before assigning them to new proxies such thatthe insiders are eventually isolated from the innocent clients.Existing architectures assume that insiders persist in the systemduring an attack and hence, initiate the movement only afterthe attack has occurred. Such a reactive mechanism presentsweaknesses that can be exploited to diminish the protectionoffered by these architectures.

To illustrate current limitations, we first present a newtype of attack – the proxy harvesting attack – which canbe used to collect information about a possibly large numberof proxies before launching a massive DDoS attack againstall known proxies. We show that state-of-the-art solutionsare vulnerable to this attack. Next, we present a simpleattacker isolation technique, BIND-SPLIT, to counter proxyharvesting attacks. We prove that, under the described attackmodel, the number of users that are affected by a DDoSattack can be minimized when a system is utilizing BIND-SPLIT. One limitation of BIND-SPLIT is that it requires thelookup server to maintain a static mapping between clients andproxies, which may lead to an uneven load distribution acrossproxies, thereby adversely affecting a system’s performance.To address this issue, while simultaneously reducing the impactof DDoS attacks, we propose a lightweight defense technique,PROTAG, which proactively reconfigures the attack surfaceby periodically replacing one or more proxies and reassigningclients to new proxies. Finally, we show how BIND-SPLITand PROTAG can be combined in a hybrid approach whichintegrates proactive cyber defense and attacker isolation.

The paper is organized as follows. Section II discussesrelevant related work, whereas Section III describes the threatmodel we assume in our work. Section IV examines thelimitations of current approaches and introduces the proxyharvesting attack. We then present our solution to address theselimitations, by discussing BIND-SPLIT in Section V, PROTAGin Section VI, and the proposed insider isolation algorithmin Section VII. Finally, we present experimental results inSection VIII and give concluding remarks in Section IX.

II. BACKGROUND AND RELATED WORK

Since the first appearance of DDoS attacks in 2000 [10],several defense mechanisms based on filtering attack trafficor limiting a client’s bandwidth share have been proposed tomitigate attacks at the Internet scale [11]. For an in-depthsurvey of DDoS flooding attacks and existing approaches tomitigate them, we refer the reader to [12]. Unfortunately, inorder to be effective, these solutions rely on large-scale adop-tion and coordination among different network elements. Theselimitations promoted overlay-based defense approaches thathide the location of target servers behind a well-provisioned,distributed overlay network [13]. For instance, MOVE [14]protects services against attackers who control and disruptonly a subset of network elements. In MOVE, target servicesaccept traffic only from a subset of overlay nodes (the secretservlets) and when a DoS attack is detected, the target serviceis migrated to a new host to mitigate the impact of the attack.

Recently, Wang et al. [8] designed MOTAG to protect webservices by hiding the application server’s location behind alarge pool of proxy servers. Originally designed to supportservices that require client authentication and later extendedto support anonymous users [7], MOTAG leverages the on-demand availability of resources in a cloud environment tospawn new proxy servers when attacked. To limit the impactof an attack, MOTAG migrates clients to new proxies andshuffles the client-to-proxy assignment to isolate insiders whodivulge the location of the secret proxy servers. However,the shuffling process employed by MOTAG to isolate insidersdoes not consider the overhead associated with instantiating

and maintaining new proxies. To address this issue, Wood etal. [9] proposed DoSE, a cloud-based architecture that providesa cost-effective mechanism to isolate insiders and confine anattack to a few proxies. In DoSE, each client is associated witha risk value which captures the likelihood that the client willindulge in a DoS attack. Additionally, each proxy server has anupper bound on the risk that it can tolerate. During an attack,DoSE assigns clients to proxies based on the correspondingrisk parameters and updates the risk value of clients associatedwith attacked proxies. Similar to MOTAG, DoSE instantiatesnew proxies to reduce the impact of the attack and migratesvictims to new proxies based on their updated risk values. Bymaintaining a state for each client, DoSE limits the number ofproxies needed to identify insiders, thereby reducing the costto maintain such an architecture.

Besides overlay-based approaches, moving target defenseshave been employed to limit the impact of DoS attacks inother settings. For instance, Duan et al. [15] proposed aproactive technique to minimize packet loss due to DoS attacksby randomly choosing a routing path which has minimaloverlap with recently used routing paths. Similarly, Herzbergand Shulman [16] present a challenge-response mechanismto mitigate DNS-amplification DoS attack. In this scheme,the local resolver is challenged to resolve the domain namefrom a verifier whose IP address is chosen at random from anaddress block. The verifier resolves the domain name only if itreceives the request from the local resolver within a predefinedtime interval. Although these techniques are effective againstDDoS, they are limited by their assumptions on either theattackers capabilities or the employed attack vectors (e.g.,DNS amplification). In this paper, we consider a more generalthreat model and design a moving target defense architectureto mitigate bandwidth-based DDoS attacks under this model.

III. THREAT MODEL

In this section, we briefly describe the threat model weconsider in our work. We primarily focus on protecting Internetservices that require client authentication, such as onlinebanking and e-commerce portals. In our threat model, theattacker employs bandwidth-based or volumetric DoS attacks– such as SYN flood and DNS amplification – to disruptthe availability of target services. We assume a persistentattacker possessing sufficient capabilities (e.g., controlling awell-provisioned botnet) to simultaneously attack multipleproxies and any subsequent new proxy that may be spawnedto mitigate the impact of the attack. Such repeated attackbehavior using botnets is one of the emerging trends in DDoSattacks [1], [17]. In a typical attack, bots spoof the IP addressesof traffic generated to congest network links of the targetnetwork. However, we assume that the attacker does not havesufficient capabilities to congest backbone links such as ISPnetworks or cloud infrastructures. In addition to leveraging abotnet, attackers may compromise the credentials of legitimateclients or eavesdrop on legitimate client’s network connectionsand use them as insiders. They can then use this capability tolearn the location of secret proxies and feed this information tothe botnet in order to launch a DDoS attack. We assume thatthe number of such insiders is much smaller than the numberof legitimate clients served by the target system.

IV. LIMITATIONS OF CURRENT MTD ARCHITECTURES

Existing MTD architectures [7], [8], [9] hide the locationof an application server behind a layer of proxies. Theseproxies receive requests on behalf of the application server andforward requests (responses) from (to) the clients. Fig. 1 givesan overview of state-of-the-art MTD architectures. Essen-tially, they include three main components: a well-provisionedlookup server, proxy servers, and the application server. Adescription of each component is provided below.

Client Proxy

Server, P Well-Provisioned Lookup Server

Application Server

(1) Request Access

(2) Challenge

(3) Response

1.  Verify Response 2.  Redirect to a random

proxy server, P

(4) Proxy server, P

(5) Request (6) Forward Request

(7) Response

(8) Forward Response

Proxy Server, P’

Determine new proxy, P’ (9) Under Attack

(10) Redirect to P’

(11) Request (12) Forward Request

Fig. 1. Overview of MTD-based Architecture

Well-Provisioned Lookup Server: To communicate withthe application server, the client sends a request to a lookupserver (step 1). The lookup server responds to the client’srequest by issuing a challenge (step 2) such as user cre-dentials [8] or Proof-of-Work (PoW) [9]. These challenge-response mechanisms aim to filter out clients who are eitherunauthorized to use the system or impersonate a legitimateclient by IP spoofing. Upon solving this challenge (step 3),the client is redirected to a random active proxy server (step4) that relays requests from the client to the application server.To ensure that the lookup server (whose IP address is public)is not susceptible to DoS attacks, existing architectures employeither a well-provisioned server – such as Content DistributionNetworks [9] or a load-balancing DNS [7] – or leverageexisting PoW schemes to force clients to solve cryptographicpuzzles before they can consume the lookup server’s resources.

Proxy Servers: Existing architectures assume the avail-ability of a large pool of proxy servers – with only a smallnumber of them active at any point in time. The IP addresses ofactive proxy servers are kept secret, i.e., they are not disclosedto clients who are unable to solve the challenge issued instep 2. Authorized clients contact the corresponding proxyserver which in turn relays requests (responses) to (from)the application server (steps 5 through 8). As the location ofthe application server is known only to these proxy servers,the attack surface shifts from the application server to theactive proxies. Existing architectures assume that proxies areequipped with a detection mechanism that enables them todetect an attack. When attacked, the proxy servers first informthe lookup server (step 9). Then, the lookup server instantiatesnew proxy servers and redirects clients associated with theattacked proxies to the new proxies (step 10). Additionally, an

attack on a proxy implies that one of the clients connectedto the attacked proxy is an insider and is divulging theproxy address to the attacker. Therefore, before redirectingthe victims to new proxies, the lookup server uses a client-to-proxy shuffling strategy to segregate innocent clients frominsiders and allocates them to different proxies. As a result ofthis shuffling process, the number of innocent clients impactedduring subsequent flooding attacks is reduced.

Application Server: The application server hosts one ormore services and maintains a state for each client connected toit. As the application server stores all the session information,the proxies are lightweight and only implement a simple trafficindirection logic to relay requests/responses.

Existing MTD architectures are limited by their threatmodel, which assume that insiders (i.e., malicious clientsable to solve the challenge) persist in the network duringan attack. This assumption facilitates effective isolation ofinnocent clients from insiders. However, under a more generalthreat model, in which an insider’s behavior is unknown, weshow that it is possible to circumvent existing moving targetdefenses. To this end, we present a novel attack, the proxyharvesting attack, and propose a solution to counter this attack.

A. Proxy Harvesting Attack

In this section, we present the proxy harvesting attack.The attacker’s goal is to gather IP addresses of as manyproxy servers as possible before launching a coordinated attackagainst multiple proxies. We make no assumption regardingan insider’s behavior. In particular, we do not assume that theinsiders persist in the system during or after a DDoS attack.

In MOTAG, the proxy harvesting attack works as shownin Fig. 2(a). After an insider authenticates, the authenticationserver assigns it to one of the active proxies at random.Through this process, the insider learns the IP address of anactive proxy. Then the insider authenticates again with theauthentication server and learns a new IP address. Ideally, thisprocess is repeated until the IP addresses of all active proxiesare collected. For DoSE, the proxy harvesting attack can bemodified as shown in Fig. 2(b). An insider first collects a setof puzzles from the CDN. A benign client should choose oneof the puzzles at random and solve it. Upon submitting itssolution to the CDN, the client will be redirected to a secretproxy. However, an insider, after collecting the set of puzzles,can distribute them to other insiders and solve multiple puzzlesin parallel. The insider can then collect these solutions andsubmit them to learn the location of multiple secret proxies.

In both architectures, once all or a significant number ofactive proxies have been discovered, the insider can outsourcethis information to external attackers (e.g., botmasters) tolaunch a coordinated DDoS attack against all known activeproxies. As mentioned earlier, when proxies are under attack,the lookup server shuffles affected clients and moves themto new proxies. However, if the insider is not present in thesystem, the shuffling operation simply increases the overheadwithout providing any benefit in identifying the insiders.

B. Analysis of the Proxy Harvesting Attack

In this section we analyze the proxy harvesting attackagainst MOTAG. For the sake of brevity, we omit the analysis

Insider Authentication Server Request Access

User Credentials?

User Credentials

Random Proxy IP Address, IPh1

Request Access

User Credentials?

User Credentials

Random Proxy IP Address, IPh2

(a) Proxy Harvesting Attack against MOTAG

Insider Content Distribution Network Request Access

Set of puzzles

Puzzle Solution 1

Random Proxy IP Address, IPh1

Random Proxy IP Address, IPh2

1.  Distribute+puzzles+across+insiders+and+solve+them+in+parallel+

2.  Collect+puzzle+solu9ons+

Puzzle Solution 2

(b) Proxy Harvesting Attack against DoSE

Fig. 2. Proxy Harvesting Attack on existing moving target-based architectures

for DoSE, which, however, is straightforward to conductsimilarly to what we show below for MOTAG.

In MOTAG, the insider needs to interact only with thelookup server (here, authentication server) to harvest IP ad-dresses of active proxies. As the lookup server assigns theclients to proxies randomly, the insider may be assigned toa previously known proxy. The number of requests that mustbe made by an insider to discover all the IP addresses canbe modeled as a classical variation of the Coupon Collector’sProblem [18]. Hence, if there are N active proxies, the ex-pected number of requests the insider must make to the lookupserver is N · log(N)+γ ·N+o(1) where γ ≈ 0.5772156 is theEuler-Mascheroni constant and o(1) ≈ 0.5. Therefore, if thereare 50 active proxies, on average the insider needs to make225 requests to learn all the IP addresses. It should be notedthat, when multiple insiders collude to harvest IP addresses,the expected number of requests per insider decreases.

In practice, insiders may not know the exact number ofproxies that are active at a given time, but they may knowthe range of IP addresses used by active proxies. Additionally,if an insider makes a large number of requests to the lookupserver, an intrusion detection system may flag the situationas suspicious. Therefore, the attacker needs to determine theoptimal number of authentication requests to strive a balancebetween stealthiness and harvesting enough proxies. We canmodel this problem as an optimization problem with theobjective to maximize the number of active proxies discoveredwhile simultaneously minimizing the likelihood of detection.Using the dynamic programming formulation in [19], theBellman equation yielding the optimal stopping criterion is

A(r,n)=min{D(n+1),c+pr,n·A(r+1,n+1)+(1−pr,n)·A(r,n+1)} (1)

where,

• A(r, n) is the expected cost incurred by the insider tolearn r distinct IP addresses by making n requests;

• D(n) is the expected cost incurred by the insider whenthe attack is detected after making n requests;

• c is the cost of a single request to the lookup server;

• pr,n is the conditional probability of discovering anew IP address given that r distinct IP addresseswere discovered from n requests: from [19], pr,n =C(r+1,n+1)C(r,n) where C(r, n) =

∑∞j=0

(r+j)!j!(r+j)n

As the number of IP addresses harvested increases withthe number of requests to the lookup server, intuitively Eq. 1maximizes the number of requests, n, made by an insidersubject to the constraint that the total cost of making n requestsdoes not exceed the cost of detection, D(n). Therefore, basedon Eq. 1, the optimal probing strategy is as follows: if theinsider detection cost D(n) is less than the cost to discovernew proxies, then make new request, otherwise stop.

V. BIND-SPLIT STRATEGY

The proxy harvesting attack exploits the lookup server’srandom assignment scheme – i.e., an incoming client requestis randomly assigned to one of the active proxies – to dis-cover multiple proxies before launching an attack. One ofthe approaches to overcome the proxy harvesting attack isto maintain a predefined mapping of clients to proxies, thuslimiting the number of IP addresses that can be harvested byinsiders. In this section, we present BIND-SPLIT, a simple, yetefficient, client-to-proxy mapping strategy that can be used toisolate insiders even if they do not persist in the system.

In the BIND-SPLIT strategy, the lookup server is config-ured to maintain a static mapping between clients and activeproxies. Let N = Cp · P0 be the total number of clients witheach one of the P0 proxy servers initially serving Cp clients.Each client has a binding to a particular server, which persistseven if the client logs out and logs back in. Also, let I be thenumber of insiders, wherein each insider can only discover theIP address of the server to which it is currently assigned. If thegoal of the defender is to minimize the number of times anyserver can be attacked, the BIND-SPLIT strategy we proposeappears to be asymptotically optimal. We assume the defenderdoes not have sufficient server resources to preemptively assign

every client its own server, which clearly would minimizeattacks. Under the BIND-SPLIT strategy, clients remain boundto their assigned server until that server is attacked. When anyserver is attacked, the attacked server is shut down and two newservers are spawned in its place. The clients from the attackedserver are split into two equal-size groups and migrated to thenew servers. If the attacked server has only one client, thenthat client must be an insider.

We analyze BIND-SPLIT by considering a tree T . Eachvertex of T represents a proxy spawned by BIND-SPLIT.Initially T consists of a root note, with edges to each of theinitial P0 proxies. When an attack occurs on some proxy p,we augment T by creating two new nodes, corresponding tothe new proxies spawned by BIND-SPLIT. We make thesenodes descendants of the attacked proxy. Notice that a nodein T is a leaf node only if the proxy corresponding to it isnever attacked. Therefore, to bound the total number of proxiesattacked by I insiders, it suffices to bound the total number ofnon-leaf nodes in T . Now consider the proxies at some depthd > 0 in T . We argue that there can be only I non-leaf nodesat depth d. By definition of BIND-SPLIT, the clients servedby two different proxies at depth d must be disjoint. Thereforeat most I of the proxies at depth d can contain an insider, andso at most I proxies at depth d can have children. It is clearthat T can also have depth at most O(logCp), and thereforecontains at most O(I · logCp) non-leaf nodes.

The maximum number of proxies used by the BIND-SPLITstrategy is O(I · logCp). This is the same order of growth asthe number of attacks. The simple reason is that each timethere is an attack on a server, the server is retired and twonew servers spawned, increasing the server count by one. Notethat, if BIND-SPLIT uses too many proxies to be practicallyapplicable in some settings, it is possible to modify it to usefewer proxies. Specifically, the defender can merge proxies thathave not been attacked for a long time. This modification hasthe drawback of increasing the time to isolate an attacker onthe merged proxies, in case the merged proxies did contain aninsider and the new proxy is later attacked.

VI. PROACTIVE PROXY MIGRATION ARCHITECTURE

A limitation of BIND-SPLIT is the tight coupling ofclients to proxies which may lead to suboptimal load distribu-tion across proxies. Furthermore, the effectiveness of existingMTD-based architecture against DDoS attack degrades in thepresence of proxy harvesting attacks: moving and shufflingclients among proxies occur only after a DDoS attack has beendetected. To strike a balance between the performance andservice availability, we propose PROTAG (PROactive proxy-based moving TArGet architecture). Inspired by Fast-FluxService Networks (FFSN) – a popular network architectureused by botnets, phishers and spammers to provide highavailability for their services [20] – we periodically migrateclients to new proxies irrespective of whether an attack hasbeen detected. Such proactive movement would disrupt thereconnaissance efforts of insiders by invalidating all or part ofthe information they were able to gather. In fact, as impliedby our reasoning in Section IV-A, in order to remain stealthy,attackers will first gather IP addresses of multiple proxies overa possibly extended period of time, and only at a later stagethey will use that information to launch a DDoS attack. If,

in the meantime, many clients have been migrated to newproxies, the attack will be either disrupted or at least mitigated.Finally, after an attack, PROTAG harnesses the insider isolationprinciple of the BIND-SPLIT strategy to partition the clientsacross proxy pools and eventually isolate the insiders.

Within the existing MOTAG architecture, a proactive proxymovement strategy can be defined in terms of two primaryfactors: proxy selection and movement frequency. Proxy se-lection involves determining which proxies to replace, whereasa strategy’s movement frequency determines when to replacethe proxies. In this paper, we consider a simple, yet effective,strategy in which a subset of active proxies is chosen uniformlyat random for replacement. Effectiveness of this strategy isevaluated by computing the expected number of active proxiesthat can be discovered in comparison with existing architec-tures where no proactive action is implemented.

A. Proxy Movement

Let P = {P1, P2, ..., PK} be the set of all availableproxies. We assume that, at any time t ∈ T – where T is aset of discrete time points – only k (with k < K) proxies areactive, and we use Pt = {Pit1 , Pit2 , ..., Pitk} – where itj ∈ [1,K]for all j ∈ [1, k] and all t ∈ T – to denote the set of activeproxies at time t.

In PROTAG, the authentication server initiates the move-ment procedure every ∆t time units – we refer to ∆t as thereconfiguration period and to f = 1

∆t as the reconfigurationfrequency. At that time, the authentication server chooses asubset of m active proxies Pr ⊆ Pt, with |Pr| = m, uniformlyat random. Additionally, the authentication server chooses mavailable (but currently not active) proxy servers P ′r uniformlyat random from the set P\Pt. All the clients associated witha proxy in Pr are then migrated to a proxy in P ′r.

The authentication server maintains each client-proxy as-sociation for a period of time ∆t∗, which we refer to as theassociation period. If a client assigned to a proxy Pi closes theconnection with Pi and re-authenticates with the authenticationserver before ∆t∗ time units since it was originally assignedto Pi, then the authentication server assigns it to the sameproxy. This mechanism imposes an upper bound on the rateat which an insider may discover new proxies. In fact, theinsider may not discover more than 1

∆t∗ proxies per time unitby doing repeated authentication requests. The time interval∆t∗ is determined by the network administrator by takinginto account the desired load per proxy (in terms of numberof clients) and the expected arrival rate of clients, therebyensuring that proxies are not overloaded. The frequency withwhich the proxies are moved depends on the number of activeproxy addresses that an insider can learn in ∆t time units.In other words, if proxies are proactively moved using thisstrategy every ∆t time units, then an insider would havediscovered at most d ∆t

∆t∗ e proxies. Determining the value of ∆tis critical to ensure that the strategy is effective: the smaller thevalue of ∆t, the higher the insider’s effort to harvest proxies.To this end, we derive the expected number of active proxiesthat can be discovered by multiple insiders as a function ofthe number of authentication requests and the reconfigurationinterval ∆t.

B. Analysis of PROTAG

In this section, we model the problem as a game betweeninsiders and authentication server, such that, at each round, theinsiders send multiple independent probes to discover proxieswhile the authentication server moves multiple proxies. Let Ibe the number of insiders and m be the number of activeproxies moved by the authentication server at each roundof the game. For the sake of analysis, we assume that thereconfiguration period ∆t is a multiple of the associationperiod ∆t∗, that is ∆t = z ·∆t∗ where z ∈ Z+ is a positiveinteger. Therefore, at each round, the authentication server firstmoves m of the k active proxies – using the strategy describedearlier – followed by each insider making z authentications attimes that are multiple of ∆t∗. For the purpose of this analysis,we consider a finite number q ∈ Z+ of rounds. The defendermoves m proxies at times 0,∆t, 2 ·∆t, . . . , (q − 1) ·∆t, and,for each round r ∈ [1, q], each insider makes an authenticationrequest at times (r−1)·∆t, (r−1)·∆t+∆t∗, . . . , (r−1)·∆t+(z−1)·∆t∗. The total number of authentication requests madeby all the insiders during the q rounds is then ntot = q · z · I .As each probe at times (r− 1) ·∆t+ x ·∆t∗, x ∈ [0, z− 1] isassigned an active proxy uniformly at random – independentlyof the specific client – the expected number of distinct proxiesdiscovered by I insiders at the end of q rounds by making zprobes at each round is equal to the number of distinct proxiesdiscovered by an insider making z · I probes at each round.

An example of the timeline of an authentication server-insider game is shown in Fig. 3. In this example, q = 3, z = 3and I = 1. The insider makes a move every ∆t∗ = 2 timeunits while the authentication server makes a move every ∆t =z ·∆t∗ = 6 time units.

Time

Authentication Server

Insider

Round 1 Round 2 Round 3

41 2 3 5 6 7 8 9 10 11 12 13 14 15 16 17 180

Fig. 3. Example of authentication server-insider game

Let Xr be a random variable representing the number ofdistinct active proxy IP addresses discovered at the end ofround r ∈ [1, q]. The effectiveness of the strategy can beevaluated by computing the expected value of Xq , that is theexpected number of distinct proxies that the insider discoversby the end of the q-th round of the game. This can be computedas E[Xq] =

∑ki=1 (i · Pr[Xq = i]). For the first round, the

probability that the insider discovers x proxies out of k activeproxies after z ·I authentications, Pr[X1 = x], is given by thenumber of ways to arrange x distinct proxies from k activeproxies across z ·I authentications divided by the number kz·Iof possible outcomes. Therefore, the probability distributionfor X1 is given by

Pr[X1 =x] =P(k,x) · S

(x)(z·I)

kz·I, x ∈ [1,min(z · I, k)] (2)

where,

• S(r)n =

∑rj=1

(−1)r−jjn

j!(r−j)! is a Stirling number of thesecond kind, which is the number of ways to divide a

set of n objects into r nonempty subsets. Intuitively,this captures the notion that multiple authenticationrequests may yield the same IP address;

• P(k,x) is the number of ways to arrange x-elementsubsets from a k-element set.

Moving proxies invalidates knowledge acquired by the insider.Let Ar be a random variable which represents the number ofknown proxies that are removed when the authentication servermoves m proxies at round r. Also, let Dr be the maximumnumber of active proxies that the insider might have alreadydiscovered by the end of round r − 1. Such number cannotexceed the number x + Ar of proxies discovered at the endround r. Therefore, the value of Dr depends on the outcomeof Ar, that is

Dr(Ar = l) = min ((r − 1) · z, x+ l, k) (3)

Hence, for x ∈ [1,min (r · z · I, k)], the probability distribu-tion of Xr is given by

Pr[Xr=x] =

Dr(Ar=l)∑y=1

Pr[Xr = x|Xr−1 = y] ·Pr[Xr−1 = y] (4)

Then, combining Eq. 3 and Eq. 4, we can write

Pr[Xr = x] =

m∑l=0

Dr(Ar=l)∑y=max(l,1)

(Pr[Xr=x|Xr−1=y,Ar=l] ··Pr[Ar=l|Xr−1=y]·Pr[Xr−1=y]

)(5)

In Eq. 5, Pr[Ar = l|Xr−1 = y] =C(y,l)·C(k−y,m−l)

C(k,m) . If theinsider has discovered y and x proxies by the end of roundsr − 1 and r respectively, then during the z · I authenticationsat round r, the insider should have discovered x− (y− l) newproxies where l ∈ [0,m]. However, the insider may encounters already known proxies, where s ∈ [0, y− l]. Therefore, for agiven s, Pr[Xr = x|Xr−1 = y,Ar = l] is the number of waysof arranging x−(y−l) distinct proxies from k−(y−l) unknownactive proxies and s distinct proxies from y − l discoveredactive proxies across z · I authentications out of kz·I possibleoutcomes. Hence,

Pr[Xr = x|Xr−1 = y,Ar = l] =

=

y−l∑s=0

P(k−(y−l),x−(y−l))P(y−l,s)C(x−(y−l)+s,s)S(x−(y−l)+s)z·I

kz·I(6)

where,

• S(r)n is a Stirling number of the second kind

• P(n,r) is the number of ways of arranging r-elementsubsets of an n-set

• C(n,r) is the number of ways of choosing r objectsfrom a set of n objects

By substituting Eq. 6 in Eq. 5 and recursively solving forr = Q with Eq. 2 as the base case, we can derive Pr[Xq =x],∀x ∈ [1, k].

VII. INSIDER ISOLATION ALGORITHM

PROTAG aims at mitigating the impact of a DDoS attack,which can be defined as the average number of innocent clientswho suffer from degraded performance during the attack.In the proposed architecture, the impact of a DDoS attackon a given number of active proxies, on average, remainsconstant as all the clients are distributed uniformly at randomacross the same pool of active proxies. To reduce the impactof subsequent DDoS attacks, we propose a simple insiderisolation algorithm which incorporates the isolation principlesof the BIND-SPLIT strategy to partition clients into differentproxy pools and eventually, isolate insiders into proxy poolswith fewer innocent clients. In this algorithm, the lookup servermaintains a mapping for each client to a set of proxies. Beforethe onset of an attack, all the clients are associated with a singlepool of active proxies. After an attack, for each attacked proxypool P , the lookup server will first spawn two new proxy poolsP1 and P2 with the same size as the attacked proxy pool.Next, the server will randomly partition the clients associatedwith the attacked proxy pool into two groups C1, C2 and re-assign clients in Ci to proxy pool Pi, i = 1, 2. For subsequentconnection requests by any client in Ci, the lookup server willre-direct it to proxy pool Pi, i = 1, 2.

A. Analysis

We analyze the proposed insider isolation algorithm andprovide a theoretical upper bound on the number of attacksand the number of proxies necessary to completely isolate theinsiders. To analyze the algorithm, consider a tree T where thenodes of the tree {P, C} represent the identity of the proxypool P and the set of clients C associated with it. An edgefrom {P, C} to {P ′, C′} exists if and only if proxies in Pwere attacked and the lookup server spawned proxies in P ′ andassigned clients in C′ ⊂ C to proxies in P ′ where |C′| = |C|

2 .

It can be seen that at any depth d all sets of clients atdepth d are disjoint and hence, the resulting tree T has atotal depth of log(N), where N is the total number of clients.The depth of the tree provides an upper bound on the numberof DDoS attacks experienced by a client before isolating theinsiders. In other words, the number of attacks experienced byany user of the system is bounded by log(N). Furthermore, thenumber of proxies spawned by the algorithm can be calculatedby counting the number of leaf nodes in T . As a base case,consider a scenario where there is exactly one insider in thesystem among N ′ clients associated with a proxy pool P ′. Inthis case, the resulting tree T ′ will be a skewed binary treewith log(N ′) leaf nodes. When there are I insiders, then inthe worst case, after each attack, the insiders will be evenlydistributed across all the proxy pools. Consider the set F ofsubtrees rooted at nodes at depth log(I). The root of eachsubtree T ′ ∈ F represents a proxy pool with N

I innocentclients and one insider. As there are at most I such subtrees,the maximum number of proxies is log

(NI

)· I · |Pi| where

|Pi| is the number of proxies in the initial active proxy pool.

VIII. SIMULATION RESULTS

In this section, we study the proxy harvesting attack,validate the proactive movement and the insider isolation al-gorithm presented in the previous section through simulations.

0

20

40

60

80

100

120

140

0 20 40 60 80 100

Num

ber o

f Pro

bes

Detection Cost

Fig. 4. No. of probes by an insider for different detection costs

0

5

10

15

20

25

30

35

40

0 5 10 15 20 25 30 35 40N

o. o

f Act

ive

Prox

ies

Disc

over

edNumber of Active Proxies

Detection Cost = 50*Probe Cost

Detection Cost = 70*Probe Cost

Detection Cost = 90*Probe Cost

Detection Cost = 110*Probe Cost

Detection Cost = 130*Probe Cost

Detection Cost = 150*Probe Cost

Fig. 5. No. of discovered proxies vs. number of active proxies

A. Proxy Harvesting Attack

In order to illustrate the trade-off in the attacker’s actions inMOTAG-based architectures (whether to authenticate or not),we simulated Eq. 1 for various values of the detection costand number of active proxies. In the simulation, we assumed,D(n) = P (n)·d, where P (n) = (1−e−(α·n)) is the probabilitythat the attacker makes n probes and d is the cost for an insiderto be detected. Such exponential distributions have been usedto model the effort required by an attacker to successfullymount an attack [21]. In our simulations, we set α = 0.05.

The cost of detection, d, and the cost of probing, c, werenormalized by setting d = z · c, z ∈ Z+. In our simulations,we assumed c = 1. Fig. 4 shows the number of authenticationprobes as a function of the detection cost d. As expected, thenumber of authentication probes made by an insider decreasesas the detection cost increases. The rationale behind this trendis that, as the detection cost d increases, the expected cost ofinsider detection D(n) increases for every subsequent probe.This restricts the number of authentication probes for theinsider. As shown in Fig. 5, for lower detection costs, an insidercan discover at least 70% of the active proxies and hence, canlaunch a significant DDoS attack against known proxies.

B. PROTAG

To assess the performance of PROTAG, we simulatedEq. 5 for 40 active proxies with different numbers of insiders.In our simulation, the insiders made a total of 100 probes.As discussed earlier, the number of proxies discovered byan attacker using I insiders is equivalent to the number of

0.00

0.05

0.10

0.15

0.20

0.25

0 5 10 15 20 25 30 35 40

Prob

abili

ty

Number of Active Proxies

PROTAG I=1,m=1,z=1

PROTAG I=2,m=2,z=1

PROTAG I=4,m=4,z=1

No Proactive Movement

Fig. 6. Probability distribution of the number of discovered proxies whenauthentication server moves m = I proxies

0.00

0.05

0.10

0.15

0.20

0.25

0 5 10 15 20 25 30 35 40

Prob

abili

ty

Number of Active Proxies

PROTAG I=2,m=1,z=1PROTAG I=4,m=2,z=1PROTAG I=8,m=4,z=1No Proactive Movement

Fig. 7. Probability distribution of the number of discovered proxies whenauthentication server moves m = 0.5 · I proxies

proxies discovered by one insider sending I probes. Fig. 6and Fig. 7 depict the probability distribution of the numberof proxies discovered by multiple insiders with and withoutapplying PROTAG, where z is the number of authenticationsbetween consecutive proxy movements by the authenticationserver. As shown in the figures, when there is no proactivemovement, there is a high probability of discovering mostof the proxies with an expected value of 37. However, withproactive movement, the probability distribution shifts suchthat the probability of discovering more than 80% of theproxies reduces significantly. In particular, for proactive move-ment, the expected number of proxies discovered is 20 and26 respectively, reducing the number of discovered proxiesby 46% and 30% respectively. Furthermore, we observed thatby increasing the number of probes made by the insider, theprobability distribution of the number of proxies discoveredby an insider did not change.

On the other hand, if the authentication server movesmultiple proxies (m > 1), the expected number of discoveredproxies can be reduced. Fig. 6 and Fig. 7 depict the probabilitydistribution of discovered proxies when the authenticationserver moves m = I and m = 0.5 · I proxies, respectively.It can be seen that the expected number of discovered proxiescan be restricted to the case when the authentication servermoved only one proxy. These results also show that, if thecost of frequently moving a proxy is high, then the authen-tication server can move less frequently and compensate forthe additional information gained by an attacker by movingmultiple proxies (proportional to the number of probes) later.

0

10

20

30

40

50

60

70

80

0 2 4 6 8 10 12

Perc

enta

ge o

f Inn

ocen

t Vic

tims

Number of Attacks

No. of Insiders = 100No. of Insiders = 150No. of Insiders = 200No. of Insiders = 250No. of Insiders = 300No. of Insiders = 350No. of Insiders = 400No. of Insiders = 450No. of Insiders = 500

Fig. 8. Percentage of innocent users affected during a sequence of attacks

0

500

1,000

1,500

2,000

2,500

3,000

3,500

4,000

0 100 200 300 400 500Av

erag

e N

umbe

r of P

roxi

esNumber of Insiders

Fig. 9. Average number of proxies required to isolate 90% of innocent users

C. Insider Isolation Algorithm

To study the performance of the proposed insider isolationalgorithm, we considered a system serving 10,000 users witha varying number of insiders. In order to simulate the user’sbehavior, in our environment, after every hour, the users (ifnot connected) log into the system with a probability of 0.8and if connected, they disconnect with a probability of 0.5.These simulations were conducted for a period of 500 hours(∼ 3 weeks of uptime) starting with a proxy pool of 2 activeproxies. In our simulation, we assumed that the attacker’sobjective is to discover at least 50% of the active proxies beforelaunching the attack. Against such a threat model, we studiedthe performance of the proposed algorithm to save at least90% of innocent users with and without proactive movement.All simulations were repeated 30 times and the results wereaveraged over these independent trials.

As expected, the percentage of innocent users who areaffected due to repeated DDoS attacks decreases with everysubsequent attack (shown in Fig. 8). As described in sec-tion VII, the insider isolation algorithm spawns new proxiesand partitions clients across these proxies after an attack.As the number of insiders increases, the average number ofproxies instantiated also increases as depicted in Fig. 9. Whendeployed in a cloud environment such as Amazon EC2, thecost of on-demand instances to host the proxies (which is about$0.007 per hour for EC2 instances based on their spot pricing)would cost the enterprise less than $150 dollars (for 500insiders) to mitigate attacks lasting for 100 hours and protectmore than 90% of innocent users from subsequent attacks. Tounderstand the impact of initial proxy pool size, we repeated

0

2

4

6

8

10

12

14

0 100 200 300 400 500

Num

ber o

f Att

acks

Number of Insiders

Proactive Movement

No Proactive Movement

Fig. 10. Average number of attacks with and without proactive movement

30

35

40

45

50

55

60

3 4 5 6 7 8

% D

ecre

ase

in N

o. o

f Inn

ocen

t Vic

tims

Number of Attacks

No. of Insiders = 100 No. of Insiders = 150

No. of Insiders = 200 No. of Insiders = 250

No. of Insiders = 300 No. of Insiders = 350

No. of Insiders = 400 No. of Insiders = 450

No. of Insiders = 500

Fig. 11. Percentage decrease in number of innocent victims

the experiment with 10, 25 and 50 proxies and observed lessthan 5% decrease in the number of saved innocent users. Inaddition to the cost incurred from deploying the proxies, theusers of the application incur an overhead cost due to frequentredirection to new proxies. As studied in [7], the clients areexpected to experience less than 3 seconds overhead as a resultof the redirection operation.

We also studied the impact of coupling PROTAG with theinsider isolation algorithm. Here, we considered a movementstrategy in which, from each active proxy pool, an active proxywas replaced on an hourly basis. As illustrated in Fig. 10,PROTAG, on average, reduced the number of attacks observedduring an experiment’s lifetime by 4. As a result, it wasobserved that the average number of innocent users who areaffected due to an attack decreased by 40% in comparison tothe setting without PROTAG (shown in Fig. 11).

IX. CONCLUSIONS

In this paper, we first presented a new type of attack,the proxy harvesting attack, and showed that state-of-the art-solutions are vulnerable to this attack. Then, to overcome thelimitations of current approaches, we proposed a proactivestrategy to periodically replace one or more proxies and remapclients to proxies, with the goal of disrupting the attacker’sreconnaissance efforts, and an insider isolation approach tomitigate ongoing attacks. We validated our solution in asimulated environment, and simulation results confirmed thatthe proposed strategy is effective in reducing the number ofproxies an attacker can discover in a given amount of time aswell as the impact of attacks.

REFERENCES

[1] “Worldwide infrastructure security report,” Arbor Networks, Tech. Rep.Volume XI, November 2015.

[2] M. Goncharov, “Russian underground 101,” Trend Micro Incorporated,Tech. Rep., 2012.

[3] D. G. Andersen, “Mayday: Distributed filtering for internet services,”in Proceedings of the 4th USENIX Symposium on Internet Technologiesand Systems (USITS 2003), Seattle, WA, USA, March 2003, pp. 31–42.

[4] A. D. Keromytis, V. Misra, and D. Rubenstein, “SOS: Secure overlayservices,” in Proceedings of ACM SIGCOMM 2002, Pittsburgh, PA,USA, August 2002, pp. 61–72.

[5] S. Jajodia, A. K. Ghosh, V. S. Subrahmanian, V. Swarup, C. Wang,and X. S. Wang, Eds., Moving Target Defense II: Application of GameTheory and Adversarial Modeling, 1st ed., ser. Advances in InformationSecurity. Springer, 2013, vol. 100.

[6] S. Jajodia, A. K. Ghosh, V. Swarup, C. Wang, and X. S. Wang, Eds.,Moving Target Defense: Creating Asymmetric Uncertainty for CyberThreats, 1st ed., ser. Advances in Information Security. Springer, 2011,vol. 54.

[7] Q. Jia, H. Wang, D. Fleck, F. Li, A. Stavrou, and W. Powell, “Catchme if you can: A cloud-enabled DDoS defense,” in Proceedings ofthe 44th Annual IEEE/IFIP International Conference on DependableSystems and Networks (DSN 2014), Atlanta, GA, USA, June 2014, pp.264–275.

[8] H. Wang, Q. Jia, D. Fleck, W. Powell, F. Li, and A. Stavrou, “A movingtarget DDoS defense mechanism,” Computer Communications, vol. 46,pp. 10–21, June 2014.

[9] P. Wood, C. Gutierrez, and S. Bagchi, “Denial of service elusion(DoSE): Keeping clients connected for less,” in Proceedings of the 34thIEEE Symposium on Reliable Distributed Systems (SRDS 2015), 2015,pp. 94–103.

[10] L. Garber, “Denial-of-service attacks rip the Internet,” Computer,vol. 33, no. 4, pp. 12–17, April 2000.

[11] M. Geva, A. Herzberg, , and Y. Gev, “Bandwidth distributed denial ofservice: Attacks and defenses,” IEEE Security & Privacy, vol. 12, no. 1,pp. 54–61, January/February 2014.

[12] S. T. Zargar, J. Joshi, and D. Tipper, “A survey of defense mechanismsagainst distributed denial of service (DDoS) flooding attacks,” IEEECommunications Surveys & Tutorials, vol. 15, no. 4, pp. 2046–2069,Fourth Quarter 2013.

[13] A. Stavrou, Encyclopedia of Cryptography and Security, 2nd ed.Springer, 2011, ch. Overlay-Based DoS Defenses, pp. 891–897.

[14] A. Stavrou, A. D. Keromytis, J. Nieh, V. Misra, and D. Rubenstein,“MOVE: An end-to-end solution to network denial of service,” inProceedings of the Network and Distributed System Security Symposium(NDSS 2005), San Diego, CA, USA, February 2005, pp. 81–96.

[15] Q. Duan, E. Al-Shaer, and H. Jafarian, “Efficient random route mutationconsidering flow and network constraints,” in Proceedings of the IEEEConference on Communications and Network Security (IEEE CNS2013), Washington, DC, USA, October 2013, pp. 260–268.

[16] A. Herzberg and H. Shulman, “DNS authentication as a service:preventing amplification attacks,” in Proceedings of the 30th AnnualComputer Security Applications Conference (ACSAC 2014), 2014, pp.356–365.

[17] A. Wang, A. Mohaisen, W. Chang, and S. Chen, “Delving into internetDDoS attacks by botnets: characterization and analysis,” in Proceedingsof the 45th Annual IEEE/IFIP International Conference on DependableSystems and Networks (DSN 2015), 2015, pp. 379–390.

[18] R. Sedgewick and P. Flajolet, An Introduction to the Analysis ofAlgorithms. Addison-Wesley, January 2013.

[19] P. R. Freeman, “Sequential estimation of the size of a population,”Biometrika, vol. 59, no. 1, pp. 9–17, 1972.

[20] T. Holz, C. Gorecki, K. Rieck, and F. C. Freiling, “Measuring anddetecting fast-flux service networks,” in Proceedings of the 16th AnnualNetwork and Distributed System Security Symposium (NDSS), 2008.

[21] R. Ortalo, Y. Deswarte, and M. Kaaniche, “Experimenting with quan-titative evaluation tools for monitoring operational security,” IEEETransactions on Software Engineering, vol. 25, no. 5, pp. 633–650,1999.