We consider a cloud based multiserver system consisting of a set of replica application servers behind a set of proxy (indirection) servers which interact directly with clients over the Internet. We study a proactive moving-target defense to thwart a DDoS attacker's reconnaissance phase and consequently reduce the attack's impact. The defense is effectively a moving-target (motag) technique in which the proxies dynamically change. The system is evaluated using an AWS prototype of HTTP redirection and by numerical evaluations of an "adversarial" coupon-collector mathematical model, the latter allowing largerscale extrapolations.

We consider a moving-target defense of a proxied multiserver tenant of the cloud where the proxies dynamically change to defeat reconnaissance activity by a botnet planning a DDoS attack targeting the tenant. Unlike the system of [4] where all proxies change simultaneously at a fixed rate, we consider a more “responsive” system where the proxies may change more rapidly and selectively based on the current session request intensity, which is expected to be abnormally large during active reconnaissance. In this paper, we study a tractable “adversarial” coupon-collector model wherein proxies change after a random period of time from the latest request, i.e., asynchronously. In addition to determining the stationary mean number of proxies discovered by the attacker, we study the age of a proxy (coupon type) when it has been identified (requested) by the botnet. This gives us the rate at which proxies change (cost to the defender) when the nominal client request load is relatively negligible.

Application-layer DoS attacks are increasing as the number of cloud-deployed microservice applications is increasing. The attacker tries to exhaust computing resources and brings the nominal applications down by exploiting application-layer vulnerabilities. As traditional solutions for volumetric DoS attacks will not be able to handle these attacks, new approaches are required to detect and respond to application-layer attacks. In this work, we propose an unsupervised, non-intrusive and application-agnostic detection approach and fissioning based response mechanism. We built our prototype on Kubernetes, the state of the art container orchestrator for microservices, and show its effectiveness through experimental evaluation. Our preliminary results show that using our detection and defense mechanism, we are able to a) efficiently identify the attacks and b) reduce the effect of the attack on legitimate users by 3× compared to a case where there is no detection/defense in place.

We consider a cloud based multiserver system, that may be cloud based, consisting of a set of replica application servers behind a set of proxy (indirection) servers which interact directly with clients over the Internet. We address cloud-side proactive and reactive defenses to combat DDoS attacks that may target this system. DDoS attacks are endemic with some notable attacks occurring just this past fall. Volumetric attacks may target proxies while "low volume" attacks may target replicas. After reviewing existing and proposed defenses, such as changing proxy IP addresses (a "moving target" technique to combat the reconnaissance phase of the botnet) and fission of overloaded servers, we focus on evaluation of defenses based on shuffling client-to-server assignments that can be both proactive and reactive to a DDoS attack. Our evaluations are based on a binomial distribution model that well agrees with simulations and preliminary experiments on a prototype that is also described.

Multiserver applications deployed in the public cloud infrastructure continue to be plagued by significant threat of Distributed Denial of Service (DDoS) attacks by large scale botnets, including very notable attack instances just this past Fall. Previously, proposed cloud-based defenses have attempted to address different aspects of this problem including: a proactive moving target approach to combat the reconnaissance phase where the botnet ascertains the identities (IP addresses) of the proxy (indirection) servers, and client-to-proxy-server assignment shuffling to deal with volumetric attacks. In this paper, we describe a "fission" quarantine approach to deal with low-volume DoS attacks targeting the application servers. We then overview a developing attack-defense emulation platform. Finally, we give the results of a preliminary, model based numerical evaluation of the performance and cost of fission defense.

We consider a cloud based multiserver system consisting of a set of replica application servers behind a set of proxy (indirection) servers which interact directly with clients over the Internet. We study a proactive moving-target defense to thwart an attacker's reconnaissance phase and consequently decreases the success rate of the planned attack. The moving-target defense is a dynamic identity-changing technique for the indirection servers.

A proposed moving-target defense against DDoS attacks repeatedly shuffles client-to-server assignments to identify and eventually quarantine malicious clients.

We propose a novel method for predicting whether an image taken from a given location will match an existing set of images. This problem appears prominently in image based localization and augmented reality applications where new images are matched to an existing set to determine location or add virtual information into a scene. Our process generates a spatial coverage map showing the confidence that images taken at specific locations will match an existing image set. A new way to measure distortion between images using affine models is introduced. The distortion measure is combined with existing machine learning and structure from motion techniques to create a matching confidence predictor. The predictor is used to generate the spatial coverage map and also compute which images in the original set are redundant and can be removed. Results are presented showing the predictor is more accurate than previously published approaches.

This paper presents a new model fitting approach to classify tentative feature matches as inliers or outliers during wide baseline image matching. The results show this approach increases the efficiency over traditional approaches (e.g. RANSAC) and other recently published approaches. During wide baseline image matching a feature matching algorithm generates a set of tentative matches. Our approach then classifies matches as inliers or outliers by determining if the matches are consistent with an affine model. In image pairs related by an affine transformation the ratios of areas of corresponding shapes is invariant. Our approach uses this invariant by sampling matches in a local region. Triangles are then formed from the matches and the ratios of areas of corresponding triangles are computed. If the resulting ratios of areas are consistent, then the sampled matches are classified as inliers. The resulting reduced inlier set is then processed through a model fitting step to generate the final set of inliers. In this paper we present experimental results comparing our approach to traditional model fitting and other affine based approaches. The results show the new method maintains the accuracy of other approaches while significantly increasing the efficiency of wide baseline matching for planar scenes.

A method to classify tentative feature matches as inliers or outliers to a transformation model is presented. It is well known that ratios of areas of corresponding shapes are affine invariants [6]. Our algorithm uses consistency of ratios of areas in pairs of images to classify matches as inliers or outliers. The method selects four matches within a region, and generates all possible corresponding triangles. All matches are classified as inliers or outliers based on the variance among the ratio of areas of the triangles. The selected inliers are used to compute a homography transformation. We present experimental results showing significant improvements over the baseline RANSAC algorithm for pairs of images from the Zurich Building Database.

This paper presents a detailed evaluation of a new approach that uses affine invariants for wide baseline image matching. Previously published work presented a new approach to classify tentative feature matches as inliers or outliers during wide baseline image matching. After typical feature matching algorithms are run and tentative matches are created, the approach is used to classify matches as inliers or outliers to a transformation model. The approach uses the affine invariant property that ratios of areas of shapes are constant under an affine transformation. Thus, by randomly sampling corresponding shapes in the image pair a histogram of ratios of areas can be generated. The matches that contribute to the maximum histogram value are then candidate inliers. This paper evaluates the robustness of the approach under varying degrees of incorrect matches, localization error and perspective rotation often encountered during wide baseline matching. The evaluation shows the affine invariant approach provides similar accuracy as RANSAC under a wide range of conditions while maintaining an order of magnitude increase in efficiency.