Real-time detection and localization of DoS attacks in NoC based SoC architectures
Various examples are provided related to software and hardware architectures that enable lightweight and real-time Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) attack detection. In one example, among others, a method for detection and localization of denial-of-service (DoS) attacks includes detecting, by a router of an intellectual property (IP) core in a network-on-chip (NoC) based system-on-chip (SoC) architecture, a compromised packet stream based at least in part upon a packet arrival curve (PAC) associated with the router; identifying, by the IP core, a candidate IP core in the NoC as a potential attacker based at least in part upon a destination packet latency curve (DLC) associated with the IP core; and transmitting, by the router, a notification message indicating that the candidate IP core is the potential attacker to a router of the candidate IP core.
1. A method for detection and localization of denial-of-service (DoS) attacks, comprising:
receiving, by a router of an intellectual property (IP) core in a network-on-chip (NoC) based system-on-chip (SoC) architecture, a packet stream;
detecting, by the router, that the packet stream is a compromised packet stream based at least in part upon a packet arrival curve (PAC) associated with the router, the PAC defining a maximum number of packets of the packet stream arriving at the router within a time interval;
identifying, by the IP core, a candidate IP core in the NoC as a potential attacker based at least in part upon a destination packet latency curve (DLC) associated with the IP core, the DLC indicating latency against hop count for packets of the packet stream arriving at the IP core; and
transmitting, by the router, a notification message indicating that the candidate IP core is the potential attacker to a router of the candidate IP core.
2. The method of claim 1 , further comprising:
in response to the notification message indicating that the candidate IP core is the potential attacker, updating a flag corresponding to a port in the router of the candidate IP core, the flag indicating that the candidate IP core is the potential attacker; and
after a predefined period of time, transmitting a verification message confirming that the candidate IP core is an attacker in response to the flag indicating that the candidate IP core is the potential attacker.
3. The method of claim 2 , further comprising:
updating the flag to indicate that another IP core is the potential attacker in response to receiving, during the predefined period of time, a second notification message indicating that the other IP core is the potential attacker.
4. The method of claim 2 , wherein the predefined period of time is based upon communication latency between the router of the IP core and routers along a path of the compromised packet stream.
5. The method of claim 1 , wherein the PAC comprises an upper bound for packet arrivals during a corresponding fixed time interval.
6. The method of claim 5 , wherein the compromised packet stream is detected based upon comparison of a current packet arrival count over the corresponding fixed time interval with the upper bound for the corresponding fixed time interval.
7. The method of claim 1 , wherein the DLC comprises mean and variance of latency distributions for different hop counts from the router.
8. The method of claim 7 , wherein the candidate IP core is identified as the potential attacker based upon a comparison of a current latency distribution with the mean and variance of the DLC.
9. A method for detection and localization of denial-of-service (DoS) attacks, comprising:
receiving, by a router of an intellectual property (IP) core in a network-on-chip (NoC) based system-on-chip (SoC) architecture, a notification message indicating that the IP core is a potential attacker of a compromised packet stream detected based at least in part upon a packet arrival curve (PAC) associated with a second router of a second IP core in the NoC, the PAC defining a maximum number of packets of a packet stream arriving at the second router within a time interval, where the IP core was identified as the potential attacker based at least in part upon a destination packet latency curve (DLC) indicating latency against hop count for packets of the compromised packet stream arriving at the second IP core;
in response to the notification message, updating by the router a flag corresponding to a port in the router, the flag indicating that the IP core is the potential attacker;
monitoring for additional notification messages for a predefined period of time, where the flag is updated by the router in response to the additional notification messages that are received during the predefined period of time; and
after the predefined period of time, transmitting by the router a verification message confirming that the IP core is an attacker in response to the flag indicating that the IP core is the potential attacker.
10. The method of claim 9 , further comprising:
updating the flag to indicate that another IP core is the potential attacker in response to receiving, during the predefined period of time, a second notification message indicating that the other IP core is the potential attacker.
11. The method of claim 9 , wherein the notification message is received from the second router.
12. The method of claim 11 , wherein the IP core is identified in response to the second router detecting the compromised packet stream.
13. The method of claim 12 , wherein the IP core is identified as the potential attacker by the second router.
14. The method of claim 9 , wherein the predefined period of time is based upon communication latency between the second router and routers along a path of the compromised packet stream.