The security attack experimentation framework: An approach to test network mitigation strategies in compliance

Distributed attacks are one of the major threats that can cause catastrophic events to network infrastructures. By misusing fundamental network technologies, an attacker can saturate resources on networks and services by using botnets or web based services like Booters [JS15], which offers DDoS-as-a-service for anyone. Often UDP-based protocols like NTP (Network Time Protocol) or DNSSEC (Domain Name System Security Extensions) are being misused. Sophisticated attackers use amplification and reflection techniques to achieve high bandwidth consumption on the target up to 500 Gbps, as seen in recent attack reports [KS16].
System operators of centralized services are challenged to verify their mitigation strategies to prevent damage that are caused by such attacks. Moreover, running reproducible tests in order to learn the effectiveness of countermeasures can be a difficult task, since the integration of existing tools often introduces different application runtime semantics and thus, do not work as a seamless system. Running such tests on an operative network infrastructure is not an easy task, since legal restrictions and enterprise policies can restrict or even forbid the use of security penetrating tools.
We introduce a work-in-progress framework that complies to an operator’s requirements and could help to understand the possible outcome of a distributed attack within a network as a controllable and reliable process: The Security attack experimentation framework (STORM) [JS16]. In our work we discuss about the fundamental problems in developing such a framework and how it could be integrated into existing network infrastructures.