arXiv subjects

Yehuda Afek

Publications and source records attributed to Yehuda Afek.

At least 19 recordsLinked to original sources

arXiv2025

LAPRAD: LLM-Assisted PRotocol Attack Discovery

With the goal of improving the security of Internet protocols, we seek faster, semi-automatic methods to discover new vulnerabilities in protocols such as DNS, BGP, and others. To this end, we introduce the LLM-Assisted Protocol Attack Discovery (LAPRAD) methodology, enabling security researchers with some DNS knowledge to efficiently uncover vulnerabilities that would otherwise be hard to detect. LAPRAD follows a three-stage process. In the first, we consult an LLM (GPT-o1) that has been trained on a broad corpus of DNS-related sources and previous DDoS attacks to identify potential exploits. In the second stage, a different LLM automatically constructs the corresponding attack configurations using the ReACT approach implemented via LangChain (DNS zone file generation). Finally, in the third stage, we validate the attack's functionality and effectiveness. Using LAPRAD, we uncovered three new DDoS attacks on the DNS protocol and rediscovered two recently reported ones that were not included in the LLM's training data. The first new attack employs a bait-and-switch technique to trick resolvers into caching large, bogus DNSSEC RRSIGs, reducing their serving capacity to as little as 6%. The second exploits large DNSSEC encryption algorithms (RSA-4096) with multiple keys, thereby bypassing a recently implemented default RRSet limit. The third leverages ANY-type responses to produce a similar effect. These variations of a cache-flushing DDoS attack, called SigCacheFlush, circumvent existing patches, severely degrade resolver query capacity, and impact the latest versions of major DNS resolver implementations.

cs.CR↗

arXiv2025

POPS: From History to Mitigation of DNS Cache Poisoning Attacks

We present a novel yet simple and comprehensive DNS cache POisoning Prevention System (POPS), designed to integrate as a module in Intrusion Prevention Systems (IPS). POPS addresses statistical DNS poisoning attacks, including those documented from 2002 to the present, and offers robust protection against similar future threats. It consists of two main components: a detection module that employs three simple rules, and a mitigation module that leverages the TC flag in the DNS header to enhance security. Once activated, the mitigation module has zero false positives or negatives, correcting any such errors on the side of the detection module. We first analyze POPS against historical DNS services and attacks, showing that it would have mitigated all network-based statistical poisoning attacks, yielding a success rate of only 0.0076% for the adversary. We then simulate POPS on traffic benchmarks (PCAPs) incorporating current potential network-based statistical poisoning attacks, and benign PCAPs; the simulated attacks still succeed with a probability of 0.0076%. This occurs because five malicious packets go through before POPS detects the attack and activates the mitigation module. In addition, POPS completes its task using only 20%-50% of the time required by other tools (e.g., Suricata or Snort), and after examining just 5%-10% as many packets. Furthermore, it successfully identifies DNS cache poisoning attacks-such as fragmentation attacks-that both Suricata and Snort fail to detect, underscoring its superiority in providing comprehensive DNS protection.

cs.CR↗

arXiv2024

Decoupling DNS Update Timing from TTL Values

A relatively simple safety-belt mechanism for improving DNS system availability and efficiency is proposed here. While it may seem ambitious, a careful examination shows it is both feasible and beneficial for the DNS system. The mechanism called "DNS Real-time Update" (DNSRU), a service that facilitates real-time and secure updates of cached domain records in DNS resolvers worldwide, even before the expiration of the corresponding Time To Live (TTL) values. This service allows Internet domain owners to quickly rectify any erroneous global IP address distribution, even if a long TTL value is associated with it. By addressing this critical DNS high availability issue, DNSRU eliminates the need for short TTL values and their associated drawbacks. Therefore, DNSRU DNSRU reduces the traffic load on authoritative servers while enhancing the system's fault tolerance. In this paper we show that our DNSRU design is backward compatible, supports gradual deployment, secure, efficient, and feasible.

cs.NI↗

arXiv2021

Distributed Computing With the Cloud

We investigate the effect of omnipresent cloud storage on distributed computing. We specify a network model with links of prescribed bandwidth that connect standard processing nodes, and, in addition, passive storage nodes. Each passive node represents a cloud storage system, such as Dropbox, Google Drive etc. We study a few tasks in this model, assuming a single cloud node connected to all other nodes, which are connected to each other arbitrarily. We give implementations for basic tasks of collaboratively writing to and reading from the cloud, and for more advanced applications such as matrix multiplication and federated learning. Our results show that utilizing node-cloud links as well as node-node links can considerably speed up computations, compared to the case where processors communicate either only through the cloud or only through the network links. We provide results for general directed graphs, and for graphs with ``fat'' links between processing nodes. For the general case, we provide optimal algorithms for uploading and downloading files using flow techniques. We use these primitives to derive algorithms for \emph{combining}, where every processor node has an input value and the task is to compute a combined value under some given associative operator. In the case of fat links, we assume that links between processors are bidirectional and have high bandwidth, and we give near-optimal algorithms for any commutative combining operator (such as vector addition). For the task of matrix multiplication (or other non-commutative combining operators), where the inputs are ordered, we present sharp results in the simple ``wheel'' network, where procesing nodes are arranged in a ring, and are all connected to a single cloud node.

cs.DC↗

arXiv2020

NXNSAttack: Recursive DNS Inefficiencies and Vulnerabilities

This paper exposes a new vulnerability and introduces a corresponding attack, the NoneXistent Name Server Attack (NXNSAttack), that disrupts and may paralyze the DNS system, making it difficult or impossible for Internet users to access websites, web e-mail, online video chats, or any other online resource. The NXNSAttack generates a storm of packets between DNS resolvers and DNS authoritative name servers. The storm is produced by the response of resolvers to unrestricted referral response messages of authoritative name servers. The attack is significantly more destructive than NXDomain attacks (e.g., the Mirai attack): i) It reaches an amplification factor of more than 1620x on the number of packets exchanged by the recursive resolver. ii) In addition to the negative cache, the attack also saturates the 'NS' section of the resolver caches. To mitigate the attack impact, we propose an enhancement to the recursive resolver algorithm, MaxFetch(k), that prevents unnecessary proactive fetches. We implemented the MaxFetch(1) mitigation enhancement on a BIND resolver and tested it on real-world DNS query datasets. Our results show that MaxFetch(1) degrades neither the recursive resolver throughput nor its latency. Following the discovery of the attack, a responsible disclosure procedure was carried out, and several DNS vendors and public providers have issued a CVE and patched their systems.

cs.CR↗

arXiv2020

Holdout SGD: Byzantine Tolerant Federated Learning

This work presents a new distributed Byzantine tolerant federated learning algorithm, HoldOut SGD, for Stochastic Gradient Descent (SGD) optimization. HoldOut SGD uses the well known machine learning technique of holdout estimation, in a distributed fashion, in order to select parameter updates that are likely to lead to models with low loss values. This makes it more effective at discarding Byzantine workers inputs than existing methods that eliminate outliers in the parameter-space of the learned model. HoldOut SGD first randomly selects a set of workers that use their private data in order to propose gradient updates. Next, a voting committee of workers is randomly selected, and each voter uses its private data as holdout data, in order to select the best proposals via a voting scheme. We propose two possible mechanisms for the coordination of workers in the distributed computation of HoldOut SGD. The first uses a truthful central server and corresponds to the typical setting of current federated learning. The second is fully distributed and requires no central server, paving the way to fully decentralized federated learning. The fully distributed version implements HoldOut SGD via ideas from the blockchain domain, and specifically the Algorand committee selection and consensus processes. We provide formal guarantees for the HoldOut SGD process in terms of its convergence to the optimal model, and its level of resilience to the fraction of Byzantine workers. Empirical evaluation shows that HoldOut SGD is Byzantine-resilient and efficiently converges to an effectual model for deep-learning tasks, as long as the total number of participating workers is large and the fraction of Byzantine workers is less than half (<1/3 for the fully distributed variant).

cs.DC↗

arXiv2019

NFV-based IoT Security for Home Networks using MUD

A new scalable ISP level system architecture to secure and protect all IoT devices in a large number of homes is presented. The system is based on whitelisting, as in the Manufacturer Usage Description (MUD) framework, implemented as a VNF. Unlike common MUD suggestions that place the whitelist application at the home/enterprise network, our approach is to place the enforcement upstream at the provider network, combining an NFV (Network Function Virtualization) with router/switching filtering capabilities, e.g., ACLs. The VNF monitors many home networks simultaneously, and therefore, is a highly-scalable managed service solution that provides both the end customers and the ISP with excellent visibility and security of the IoT devices at the customer premises. The system includes a mechanism to distinguish between flows of different devices at the ISP level despite the fact that most home networks (and their IoT devices) are behind a NAT and all the flows from the same home come out with the same source IP address. Moreover, the NFV system needs to receive only the first packet of each connection at the VNF, and rules space is proportional to the number of unique types of IoT devices rather than the number of IoT devices. The monitoring part of the solution is off the critical path and can also uniquely protect from incoming DDoS attacks. To cope with internal traffic, that is not visible outside the customer premise and often consists of P2P communication, we suggest a hybrid approach, where we deploy a lightweight component at the CPE, whose sole purpose is to monitor P2P communication. As current MUD solution does not provide a secure solution to P2P communication, we also extend the MUD protocol to deal also with peer-to-peer communicating devices. A PoC with a large national level ISP proves that our technology works as expected.

cs.NI↗

arXiv2019

A King in every two consecutive tournaments

We think of a tournament $T=([n], E)$ as a communication network where in each round of communication processor $P_i$ sends its information to $P_j$, for every directed edge $ij \in E(T)$. By Landau's theorem (1953) there is a King in $T$, i.e., a processor whose initial input reaches every other processor in two rounds or less. Namely, a processor $P_ν$ such that after two rounds of communication along $T$'s edges, the initial information of $P_ν$ reaches all other processors. Here we consider a more general scenario where an adversary selects an arbitrary series of tournaments $T_1, T_2,\ldots$, so that in each round $s=1, 2, \ldots$, communication is governed by the corresponding tournament $T_s$. We prove that for every series of tournaments that the adversary selects, it is still true that after two rounds of communication, the initial input of at least one processor reaches everyone. Concretely, we show that for every two tournaments $T_1, T_2$ there is a vertex in $[n]$ that can reach all vertices via (i) A step in $T_1$, or (ii) A step in $T_2$ or (iii) A step in $T_1$ followed by a step in $T_2$. }

math.CO↗

arXiv2019

The Role of A-priori Information in Networks of Rational Agents

Until now, distributed algorithms for rational agents have assumed a-priori knowledge of $n$, the size of the network. This assumption is challenged here by proving how much a-priori knowledge is necessary for equilibrium in different distributed computing problems. Duplication - pretending to be more than one agent - is the main tool used by agents to deviate and increase their utility when not enough knowledge about $n$ is given. The a-priori knowledge of $n$ is formalized as a Bayesian setting where at the beginning of the algorithm agents only know a prior $\sigma$, a distribution from which they know $n$ originates. We begin by providing new algorithms for the Knowledge Sharing and Coloring problems when $n$ is a-priori known to all agents. We then prove that when agents have no a-priori knowledge of $n$, i.e., the support for $\sigma$ is infinite, equilibrium is impossible for the Knowledge Sharing problem. Finally, we consider priors with finite support and find bounds on the necessary interval $[\alpha,\beta]$ that contains the support of $\sigma$, i.e., $\alpha \leq n \leq \beta$, for which we have an equilibrium. When possible, we extend these bounds to hold for any possible protocol.

cs.DC↗

arXiv2019

Eradicating Attacks on the Internal Network with Internal Network Policy

In this paper we present three attacks on private internal networks behind a NAT and a corresponding new protection mechanism, Internal Network Policy, to mitigate a wide range of attacks that penetrate internal networks behind a NAT. In the attack scenario, a victim is tricked to visit the attacker's website, which contains a malicious script that lets the attacker access the victim's internal network in different ways, including opening a port in the NAT or sending a sophisticated request to local devices. The first attack utilizes DNS Rebinding in a particular way, while the other two demonstrate different methods of attacking the network, based on application security vulnerabilities. Following the attacks, we provide a new browser security policy, Internal Network Policy (INP), which protects against these types of vulnerabilities and attacks. This policy is implemented in the browser just like Same Origin Policy (SOP) and prevents malicious access to internal resources by external entities.

cs.CR↗

arXiv2019

Consensus in Equilibrium: Can One Against All Decide Fairly?

Is there an equilibrium for distributed consensus when all agents except one collude to steer the decision value towards their preference? If an equilibrium exists, then an $n-1$ size coalition cannot do better by deviating from the algorithm, even if it prefers a different decision value. We show that an equilibrium exists under this condition only if the number of agents in the network is odd and the decision is binary (among two possible input values). That is, in this framework we provide a separation between binary and multi-valued consensus. Moreover, the input and output distribution must be uniform, regardless of the communication model (synchronous or asynchronous). Furthermore, we define a new problem - Resilient Input Sharing (RIS), and use it to find an {\em iff} condition for the $(n-1)$-resilient equilibrium for deterministic binary consensus, essentially showing that an equilibrium for deterministic consensus is equivalent to each agent learning all the other inputs in some strong sense. Finally, we note that $(n-2)$-resilient equilibrium for binary consensus is possible for any $n$. The case of $(n-2)$-resilient equilibrium for \emph{multi-valued} consensus is left open.

cs.DC↗

arXiv2018

Selecting a Leader in a Network of Finite State Machines

This paper studies a variant of the \emph{leader election} problem under the \emph{stone age} model (Emek and Wattenhofer, PODC 2013) that considers a network of $n$ randomized finite automata with very weak communication capabilities (a multi-frequency asynchronous generalization of the \emph{beeping} model's communication scheme). Since solving the classic leader election problem is impossible even in more powerful models, we consider a relaxed variant, referred to as \emph{$k$-leader selection}, in which a leader should be selected out of at most $k$ initial candidates. Our main contribution is an algorithm that solves $k$-leader selection for bounded $k$ in the aforementioned stone age model. On (general topology) graphs of diameter $D$, this algorithm runs in $\tilde{O}(D)$ time and succeeds with high probability. The assumption that $k$ is bounded turns out to be unavoidable: we prove that if $k = ω(1)$, then no algorithm in this model can solve $k$-leader selection with a (positive) constant probability.

cs.DC↗

arXiv2018

Cheating by Duplication: Equilibrium Requires Global Knowledge

The question of what global information must distributed rational agents a-priori know about the network in order for equilibrium to be possible is researched here. Until now, distributed algorithms with rational agents have assumed that $n$, the size of the network, is a-priori known to the participants. We investigate the above question, considering different distributed computing problems and showing how much each agent must a-priori know about $n$ in order for distributed algorithms to be equilibria. The main tool considered throughout the paper is the advantage an agent may gain by duplication- pretending to be more than one agent. We start by proving that when no bound on $n$ is given equilibrium for Coloring and Knowledge Sharing is impossible. %We prove that when agents have no a-priori knowledge on $n$, or even a known bound, equilibrium for both Knowledge Sharing and Coloring is impossible. We provide new algorithms for both problems when $n$ \emph{is} a-priori known to all agents, thus showing that there are algorithms in which the only way for an agent to gain an advantage is duplication. We further show that for each distributed problem there is an a-priori known range, an upper and a lower bound on $n$, such that if the actual $n$ is guaranteed to lay in that range, equilibrium is possible. By providing equilibria for a specific range, and impossibility results for any larger range, we prove the tight range necessary for equilibrium in: Leader Election, Knowledge Sharing, Coloring, Partition and Orientation.

cs.DC↗

arXiv2017

The Life in 1-Consensus

This paper introduces the atomic Write and Read Next ($\text{WRN}_{k}$) deterministic shared memory object, that for any $k\ge3$, is stronger than read-write registers, but is unable to implement $2$-processor consensus. In particular, it refutes the conjecture claiming that every deterministic object of consensus number $1$ is computationally equivalent to read-write registers.

cs.DC↗

arXiv2017

Detecting Heavy Flows in the SDN Match and Action Model

Efficient algorithms and techniques to detect and identify large flows in a high throughput traffic stream in the SDN match-and-action model are presented. This is in contrast to previous work that either deviated from the match and action model by requiring additional switch level capabilities or did not exploit the SDN data plane. Our construction has two parts; (a) how to sample in an SDN match and action model, (b) how to detect large flows efficiently and in a scalable way, in the SDN model. Our large flow detection methods provide high accuracy and present a good and practical tradeoff between switch - controller traffic, and the number of entries required in the switch flow table. Based on different parameters, we differentiate between heavy flows, elephant flows and bulky flows and present efficient algorithms to detect flows of the different types. Additionally, as part of our heavy flow detection scheme, we present sampling methods to sample packets with arbitrary probability $p$ per packet or per byte that traverses an SDN switch. Finally, we show how our algorithms can be adapted to a distributed monitoring SDN setting with multiple switches, and easily scale with the number of monitoring switches.

cs.NI↗

arXiv2016

Efficient Distinct Heavy Hitters for DNS DDoS Attack Detection

Motivated by a recent new type of randomized Distributed Denial of Service (DDoS) attacks on the Domain Name Service (DNS), we develop novel and efficient distinct heavy hitters algorithms and build an attack identification system that uses our algorithms. Heavy hitter detection in streams is a fundamental problem with many applications, including detecting certain DDoS attacks and anomalies. A (classic) heavy hitter (HH) in a stream of elements is a key (e.g., the domain of a query) which appears in many elements (e.g., requests). When stream elements consist of a pairs, ( ) a distinct heavy hitter (dhh) is a key that is paired with a large number of different subkeys. Our dHH algorithms are considerably more practical than previous algorithms. Specifically the new fixed-size algorithms are simple to code and with asymptotically optimal space accuracy tradeoffs. In addition we introduce a new measure, a combined heavy hitter (cHH), which is a key with a large combination of distinct and classic weights. Efficient algorithms are also presented for cHH detection. Finally, we perform extensive experimental evaluation on real DNS attack traces, demonstrating the effectiveness of both our algorithms and our DNS malicious queries identification system.

cs.CR↗

arXiv2016

Idle Ants Have a Role

Using elementary distributed computing techniques we suggest an explanation for two unexplained phenomena in regards to ant colonies, (a) a substantial amount of ants in an ant colony are idle, and (b) the observed low survivability of new ant colonies in nature. Ant colonies employ task allocation, in which ants progress from one task to the other, to meet changing demands introduced by the environment. Extending the biological task allocation model given in [Pacala, Gordon and Godfray 1996] we present a distributed algorithm which mimics the mechanism ants use to solve task allocation efficiently in nature. Analyzing the time complexity of the algorithm reveals an exponential gap on the time it takes an ant colony to satisfy a certain work demand with and without idle ants. We provide an $O(\ln n)$ upper bound when a constant fraction of the colony are idle ants, and a contrasting lower bound of $Ω(n)$ when there are no idle ants, where $n$ is the total number of ants in the colony.

cs.DC↗

arXiv2015

Optimal and Resilient Pheromone Utilization in Ant Foraging

Pheromones are a chemical substance produced and released by ants as means of communication. In this work we present the minimum amount of pheromones necessary and sufficient for a colony of ants (identical mobile agents) to deterministically find a food source (treasure), assuming that each ant has the computational capabilities of either a Finite State Machine (FSM) or a Turing Machine (TM). In addition, we provide pheromone-based foraging algorithms capable of handling fail-stop faults. In more detail, we consider the case where $k$ identical ants, initially located at the center (nest) of an infinite two-dimensional grid and communicate only through pheromones, perform a collaborative search for an adversarially hidden treasure placed at an unknown distance $D$. We begin by proving a tight lower bound of $Ω(D)$ on the amount of pheromones required by any number of FSM based ants to complete the search, and continue to reduce the lower bound to $Ω(k)$ for the stronger ants modeled as TM. We provide algorithms which match the aforementioned lower bounds, and still terminate in optimal $\mathcal{O}(D + D^2 / k)$ time, under both the synchronous and asynchronous models. Furthermore, we consider a more realistic setting, where an unknown number $f < k$ of ants may fail-stop at any time; we provide fault-tolerant FSM algorithms (synchronous and asynchronous), that terminate in $\mathcal{O}(D + D^2/(k-f) + Df)$ rounds and emit no more than the same asymptotic minimum number of $\mathcal{O}(D)$ pheromones overall.

cs.DC↗