Artifacts for ACSAC 2018

• The following files and workflows describe how to reproduce graphs in Figure 5:
  1. AS topology:
     • Location: topology folder.
     • Workflow: download AS relationships information from CAIDA and run convert_caida.pl script. Or to use the existing CAIDA topology from May 1, 2017 run run.sh
  2. Simulation code:
     • Location: figure5 folder holds all the scripts and data.
     • Simulation files: Three main simulation files are:
       1. topdeploy.pl, which simulates top deployment strategy, with uniform attackers and clients
       2. randomdeploy.pl, which simulates random deployment strategy, with uniform attackers and clients
       3. realdeploy.pl, which simulates top deployment strategy with realistic attackers and clients
       Each file takes three arguments - the type of simulated attack (sig, nosig, cross), the limit of how many deployment points to start with (usually 1, unless you are breaking the run into several sub-runs to parallelize it) and an optional argument alpha, which controlls the projected percentage of collateral damage and is betwen 0 and 100 (usually 5).
     • Considerations for running: The code for each subfigure is in a separate script, e.g., run5a.sh will produce data for the Figure 5a. It takes a long time to produce one figure, because the code is very CPU intensive. On a t2.2xlarge EC2 instance it takes about 5 days to complete run5a.sh. You can reduce this time if you sacrifice accuracy, i.e., if you run fewer trials. The parameter ENOUGH controls the min number of trials for each data point (currently 1,000) and the parameter PRECISION controls the max allowed change between means in consecutive runs for the same datapoint (currently 0.01). Making ENOUGH parameter smaller and PRECISION bigger will reduce the number of runs, but it will potentially produce less stable results.

       A good way to run the code is to run each script on a separate, high-CPU machine, and then transfer the results to one central place for processing. You can also break runs into sub-runs, which you can run on separate machines. This can be done by using e.g., limit 1 on one machine, and limit 200 on the second machine, with all the other parameters being the same. So:

       	  perl topdeploy.pl sig 1
       	

       runs all trials on one machine starting with 1 deployment point (and then trying 2, 5, 10, ... , 10000), and

       	  perl topdeploy.pl sig 200
       	

       runs all trials on one machine starting with 200 deployment points (and then trying 500, 1000, ... , 10000). By the time the second sub-run finishes the first one will be either hitting or surpassing 200 deployment points. You can then stop them both and concatenate their result files into a single file.
     • Workflow:
       1. Run run5.sh to run everything on one machine (not recommended) or run subfigure scripts, e.g., run5a.sh on separate machines and then transfer their outputs to one machine.
       2. Run process.sh to process the output data for graphs
       3. Run plot.gnu to produce graphs
  3. Our results: For comparison, our results are in ourresults folder.
• The following files and workflows describe how to reproduce the graph in Figure 7:
  1. Emulation code:
  • Location: figure7 holds all the setup code and data.
  • Workflow:
  • Initialise Experiment: Start an experiment on Deterlab, using the following topology file NS topology. The experiment would take anywhere between 10-15 minutes to start. If you don't have Deterlab login please create one. Then ask to join project SENSS, and we will approve you. You need to be project member to run the scripts.
  • Setup experiment: The setup.py script installs Openvswitches on nodes, starts the SENSS server and client. The setup would take approximately 10 minutes.

    				cd figure7/Setup; python setup.py ddos_with_sig
    			

    You can access the client user interface using the following link:

    				http://localhost:8181/SENSS/UI_client_server/Client/ddos_with_sig.php
    			

  • Start traffic: Run the following command to start legit and attack traffic from nodes. You can configure the rate of legit traffic, rate of attack traffic, duration of traffic, and the destination of traffic in the nodes_ddos_with_sig file.

    				python start_traffic_generator.py ddos_with_sig
    			

  • Monitor traffic using traffic_query: SENSS client can be used to monitor incoming traffic towards the client by using the client interface as shown below.

    
    

  • Stop attack traffic using traffic_filter: SENSS client can be used to stop the attack traffic as shown in the video below.

  • Graph. Run result_traffic.gnu to generate graph.
  2. Our results: For comparison, our results are in ourresults folder.