Cybersecurity: Denial-of-Service Attack

Background Information for Teachers

If you follow the news, you have probably read about cyber-attacks or hacks against individuals, companies, and governments. The results vary widely, ranging from leaks of embarrassing personal photos to identity theft or leaking of top secret information. The backgrounds and motives of perpetrators are also diverse, ranging from teenagers who just want to cause some disruption to serious criminals. One type of cyber-attack is the denial-of-service (DoS) attack. A DoS attack typically floods a server with so much traffic that it is overwhelmed and unable to respond to legitimate users. To regular visitors, the site appears very slow or not functional at all. Unlike other types of cyber-attacks, the goal of a DoS attack is not to steal confidential information. DoS attacks may be used by activists to damage the target organization's reputation or limit its visibility at a critical time; or by criminals who demand a ransom payment to allow a website to come back up.

Before you can explore how DoS cyber-attacks work, you need a basic understanding of how information travels from the client (the computer or program you use to connect to the Internet) to a server (a machine that hosts a website). The server processes requests from the client. For example, when you click a button in a web browser to load a new page, your computer (the client) sends a request to the server for the files needed to load and view that new page. A posted request passes firewalls and routers as it travels through the Internet. A router sends the request to the correct server. There, it is placed in a queue to be processed when the server has a chance. For this activity, the process will be simplified to the process shown in Figure 1.

Image Credit: Sabine De Brabandere, Science Buddies / Science Buddies
Figure 1. In its simplest form, requests posted by a client travel over the Internet to a server, which then processes the requests.

One way to launch a DoS attack is to send the target server many (fake) requests in a short time span (for example, requesting to load the same page over and over again). This floods the server with requests so it is unable to process them in a timely way. This type of DoS attack is a good example because it is simple, identifying it is easy (requests from a particular client come at an abnormally high rate), and intercepting it could be straightforward (disregard all requests from the attacking client). Once this is understood, more sophisticated types of DoS attacks, which might be harder to detect, can be explored.

The task of cybersecurity staff is to safeguard their employer's Information technology (IT) network and its related data. This includes protecting services against DoS attacks. The ideal defense mechanisms let all legitimate traffic through, while blocking illegitimate requests without slowing down the process. In real life, compromises are often necessary. Several protection mechanisms are used. Implementing a good firewall, which can identify and disregard illegitimate requests, is often the first step. Another tactic is to increase the capacity of the network to handle requests. Although this might not intercept attacks, it makes the service less vulnerable, as it is able to handle the additional load of illegitimate requests.

In this lesson, students act out the network shown in Figure 1 without using computers or the Internet. Some students will act as clients, writing colored cards representing "requests" or information to be sent to the server. Other students will serve as the Internet, collecting and transporting these cards (requests) to the server. One student acting as the server will receive the requests and process them. A student (the guard) will initially oversee the process and can later be used to represent a firewall. One student will serve as attacker and flood the system with requests to simulate a DoS attack. Although this greatly simplifies the information flow happening in real life, it is an easy way to show how a successful DoS attack can be launched, how it affects the network, and ways cybersecurity professionals can counter the attack. Let your students be the cybersecurity personnel, identify cyber-attacks, and find creative ways to protect the service against the attacks.

Additional Background Links

• Cybersecurity, Science Buddies
• Cyber Attack Statistics, HACKMAGEDDON
• Twitter Crippled by Denial-of-Service Attack., CNet
• Google Removes 300 Apps Used to Launch DDoS Attacks From Play Store, Gizmodo

Prep Work (10-20 minutes)

Divide the number of students into groups of 9–12. For each group:

1. Prepare the materials:
   1. Write "Dropped" on one box and "Processed" on the other box.
   2. Cut the construction paper in 1 ½ by 2 inch cards so you have at least 350 cards of one color and 140 cards per color of all other colors. This template can help you cut faster. To find the number of colors you need for a group, subtract 4 from the number of students in the group. Note, if you have colorblind students in your class, you can use cards of different shapes instead of cards of different colors.
   3. Tape or glue the three pages of the Server Queue printout together.
   4. Cut one paper card of each color into small pieces and tape or glue one piece at the top of a column on each processing paper.
   5. The results should look like Figure 2.

Image Credit: Sabine De Brabandere, Science Buddies / Science Buddies
Figure 2. Materials ready to begin this DoS cybersecurity science activity.

2. Arrange the desks and materials:
   1. Arrange the desks so the Internet students can easily walk between all the clients and the server. A setup as depicted in Figure 3 works well. Note: Three students in each group (one representing the guard and two representing the Internet ) do not need a desk for the activity, but might still like to use a desk to fill in their worksheet.
   2. Arrange the materials on the desks, as listed in Table 1.
   3. Keep the additional server queue and processing papers to yourself; they will be needed later in the activity.
   4. You can place a worksheet on each desk or pass out the worksheets later.

Image Credit: Sabine De Brabandere, Science Buddies / Science Buddies

Seven student desks each have a chair, stack of cards, and pen. They represent clients on a network. A larger single desk has the list for the server queue, processing paper, a pen, and two boxes for dropped and processed papers.

Figure 3. Small-group setup diagram.

Swipe left to see more

Role
Clients  ( 5–8 )	Image Credit: Sabine De Brabandere, Science Buddies / Science Buddies	Each client has: A stack of cards (350 for one client and 140 for all other clients), a different color for each client. A pen or pencil
Server ( 1 )	Image Credit: Sabine De Brabandere, Science Buddies / Science Buddies	The server has: An assembled server queue Empty "Dropped" box next to the queue A prepared processing paper "Processed" box next to the processing paper Pen or Pencil

Table 1. Cybersecurity DoS activity setup checklist for each small group of students.

Engage (5 minutes)

1. Use following questions to connect to students' personal experiences not being able to access websites, games, or online services.

   Can you remember when you last connected to the Internet (other than at school)?

   Probably, most students will have connected to the Internet recently.

   Can you remember a time where you wanted to, but were not able to connect to the Internet or a certain website? How did it feel?

   Probably most students had this experience and felt deprived, irritated or frustrated.

   What website would you miss most if it was unavailable for a few hours?

   Students might come up with a variety of services they would miss. Social media, YouTube and games might make it to the top of their list.

2. Make students aware of the potential consequences of a website being offline for a company or organization. Following questions can help.

   You clearly think you are suffering when the Internet or a website is out. How long would you wait for a site like Netflix or Wikipedia to become available before giving up or going somewhere else? What happens if MILLIONS of people all get tired of waiting and go to a different website? What impact do you think this has on the company? How would they suffer if their website is temporarily unavailable or malfunctioning? (Note: Feel free to replace Netflix and Wikipedia with any website you think your students use frequently, but be sure it is a site that has alternatives available.)

   Students might mention a variety of answers. Financial loss, decreased customer satisfaction, loss of trust might make it to the top of their list.

3. Introduce the job of cybersecurity personnel. Explain that, as part of safeguarding their employer's information technology (IT) networks and data, it is the cybersecurity personnel's job to prevent a company's website from being unavailable or slow. A company's IT network could include their public websites, the internal computer network they use, and any stored data about customers, employees, and products, etc. This is not an easy job and they sometimes fail.

   Has anyone heard of a cybersecurity breach or "hack" in the news?

   Some students will probably remember a cybersecurity breach that made it in the news. These might not be denial-of-service attacks, so we advise not to go into details here.

4. Introduce the denial-of-service attack as a type of attack which has as its goal, bringing a website down or limiting its services. To do this, the attacker usually floods the targeted system with useless traffic. As a result, the computer serving the attacked site is overloaded and the website appears slow or unavailable.

   Why do you think someone would launch a denial-of-service attack? Think of how these attacks can damage a company, a governmental site, or a political organization?

   Students might provide possible motives including demanding a ransom to restore the website, political activism, harming an organization's reputation, etc.

   How do you think organizations protect themselves against denial-of-service attacks?

   Students might provide ideas. Either briefly write them down or invite them to remember their ideas as they will be useful later in the lesson. It is fine if they do not have any ideas now, the first part of the activity might spark their imagination.

5. Tell the students they will act out a denial-of-service attack and then take the role of cybersecurity personnel with the task of finding and implementing ways to protect the network against the attack.

Explore (40 minutes)

The Activity: Preparation

Walk your students through the following steps:

1. Divide them into groups of 9–12 students. Each group should have the items listed in Table 1 ready. Adjustments for smaller or larger groups are listed in the Materials section.
2. Explain that first, they will explore a way to act out a client sending data (e.g. a request to open a web page) to a website (server) via the Internet. In a second stage, they will add a denial-of-service attack into the model and see its effect. In the third stage, they will invent cybersecurity protection measures and test them using the model.
3. Go over the model and its information technology (IT) analogy. The slideshow can help you convey the information.

   In the IT world, clients (e.g. you at your computer) issue requests like asking to open a web page. That request travels via the Internet to a server (the computer that hosts the web page). The server then processes the requests and generally, a response finds its way back to the client. The web page is loaded and displayed on your computer.

   The figure included in the worksheet and slide 3 of the slideshow displays how requests —modeled by cards—move around in the activity. It starts with a client issuing a request. In the model, a person acting as a client writes his or her name on a colored card. The person acting as the Internet then picks up the colored card and delivers it to the server by placing the colored card in the server queue. The card sits in the queue until the person acting as the server processes the card. For this activity, we do not model the response sent back to the client from the server.

   Once the students understand the global model, you can introduce the following details. If your class is IT savvy, you can ask if they know what these parts of the model represent.

   • Occasionally, the server queue is full and requests never get processed. You might receive the message "The server at [website] is taking too long to respond." on your computer. In the model, colored cards will land in a "Dropped" box when the server queue is full.
   • In the real world, requests will usually pass a firewall scanning for any malicious requests before allowing requests to enter the server queue. In the activity, the person modeling the Guard will oversee the process, but will not scan the requests until (possibly) Stage 3.

Image Credit: Sabine De Brabandere, Science Buddies / Science Buddies
Figure 4. Illustration of how the Internet moves requests (colored cards) issued by a client to the server.

4. For each small group, assign one student to the server role, one student to the guard role, two students to the Internet role, and the remaining students to the client role. Be sure to adjust the materials in case the student with the server role is color-blind. See the Prepare Work section for ideas on how to adjust the materials.
5. Go over the tasks assigned to each role in the activity, as listed in Table 2.

Swipe left to see more

Role		Tasks
Clients  ( 5–8 )	Image Credit: Sabine De Brabandere, Science Buddies / Science Buddies	Takes a card from their stack, writes their full name on the card, and places the card on the corner of their desk where the Internet person will pick them up.
Internet  ( 2 )	Image Credit: Sabine De Brabandere, Science Buddies / Science Buddies Image Credit: Sabine De Brabandere, Science Buddies / Science Buddies	Picks up request cards from the clients (top picture in this row); picks up all cards that a client has ready and picks up from a maximum of three clients before delivering. Delivers request cards to the server by placing them on the next free slot(s) in the server queue (bottom picture in this row). When all slots are full, counts to 10, places request cards in slots that became available while counting, and drops the remaining request cards in the "Dropped" box. Returns to pick up new requests. Note: Second Internet person starts when the first Internet person arrives at the server queue.
Guard  ( 1 )		Observes how the activity is going. Stops the activity when the teacher indicates it is time to stop, and does the following: Instantly stops the Internet from delivering any more requests. Asks the clients to stop writing requests. Counts to 10. Asks the server to stop processing requests.
Server  ( 1 )	Image Credit: Sabine De Brabandere, Science Buddies / Science Buddies	Takes requests, one by one, in order, from the server queue. Writes a checkmark in the column corresponding to the color of the request card on the processing paper. Starting from the top line, one checkmark per line. Places the card in the "Processed" box.

Table 2. The roles and tasks in the DoS cyber-attack activity.

The Activity: Stage 1

1. Let the Internet people agree who will start and who will wait until the first Internet person arrives at the server queue.
2. Optional: If some students in your class might not remember the actions assigned to their role the first time they play their part, perform a short practice run now. Remember to reset everything (cards move back to the clients, any marks made on the server processing paper are removed) before moving on.
3. Start the activity and the timer.
4. Let the guard stop the activity after 2 minutes.
5. Once the guard stops the activity (and completes the 4 steps in his role), lead a short discussion on how the system runs under normal conditions and let the students write down their findings on their worksheet.

   Was the IT system running smoothly? How could you see this?

   The system probably ran smoothly. Some likely observations are listed on the last column of Table 3.

Can we translate these observations into quantitative variables that measure how well the system runs?

A list of quantitative variables is provided in Table 3. Note that in itself, the number of processed requests does not provide much information. It is however, a valuable measure in comparison to other variables like the total number of requests reaching the server. If students only provide directly measurable variables (the first four rows in the table), prompt them to think of how combining several of these variables might provide a better indication of how well the system runs. The efficiency, defined as the percentage of requests arriving at the server that have been processed, might be the best single variable indicating how well the system functions. It can be calculated by taking 100 times the fraction of processed requests to the total number of requests that made it to the server (or to the number of processed, dropped, and waiting requests added together).

The Activity: Stage 2

Introduce the second part of the activity in which the group will simulate a denial-of-service attack by making the following changes:

1. The client with the biggest stack of request cards acts as the attacker and can now deliver up to 10 requests at a time to the Internet. The attacker does not need to write his or her full name on the requests. (Note: This is different from real IT systems, where requests from attackers look just the same as other requests.) This will flood the system with fake requests, just like what happens in most denial-of-service attacks.
2. Give the students a minute to hypothesize what will happen.

   What do you think will happen, how do you expect the variables we discussed to change?

   Listen to their answers and reasoning, but do not give away the "correct" answer (the server will be overwhelmed and not able to process requests fast enough).

3. Empty the "Processed" and "Dropped" boxes and put these cards aside. (You might need these in case some clients run out.) Hand out a new processing paper to the server.
4. Start the activity and the timer.
5. Ask the guard to stop the activity after 2 minutes.
6. Once the guard stops the activity, lead a short discussion on how the denial-of-service attack affected the process and let the students write down their observations on their worksheet.

   Was the IT system running smoothly when under attack? How could you see this?

   The system probably did not run smoothly. Some likely observations are listed in the last column of Table 4.

How do these observations translate in the quantitative variables we established? If students count all requests (including those from the attacker) in the evaluation, ask them if they are really interested in the requests issued by the attacker. These are fake requests, issued to bring the network down. We can discard these when evaluating the network's efficiency.

Probable changes in the measured quantities compared to those measured in Stage 1 are listed in the second column of Table 4.

The Activity: Stage 3

1. Tell the students they will now be cybersecurity personnel that need to safeguard the network. Use the following questions to help them understand and define the problem.

   As cybersecurity personnel, what would you state as the problem with the network under attack, and how is it different from an ideal network?

   The network under attack is not able to serve the clients efficiently. Students might state the individual problems, like a server temporarily not being available, legitimate requests being dropped, or legitimate requests not being handled in a timely matter, etc. The ideal network handles all legitimate requests swiftly. It never drops a legitimate request, while blocking illegitimate requests without slowing down the process.

   How would this be reflected in the quantitative variables we defined earlier?

   Table 5 shows what the quantitative variables look like for the ideal network and a network under stress.

   Swipe left to see more

   System	Processed legitimate requests	Dropped legitimate requests	Legitimate requests waiting in the queue	Fraction processed
   Ideal network	High	0	0	100%
   Network under stress	Significantly lower than in the ideal case.	High *	High *	Low *

   * You might fill in the measured variables of the network under stress.
   Table 5. Quantitative variables for the ideal network and a network under stress.

   Reaching the ideal situation might be difficult. What can we set as acceptable values for these variables? How will we evaluate if our solution is successful?

   Together with the students, agree on a set of design solution criteria. These might include, but are not limited to, the following: Number of legitimate requests processed ≥ Processed Fraction × Number of legitimate requests reaching the server Number of legitimate requests dropped ≤ Dropped Fraction × Number of legitimate requests reaching the server Number of requests in the queue ≤ Cut off value for requests in the queue Number of requests in stacks on clients' desks ≤ Cut off value for requests in stacks on clients' desks Efficiency ≥ Cut off value for efficiency The underlined parameters are values that need to be agreed upon with your class. Fractions should be values between 0 and 1. Check if the chosen criteria point to a situation between the ideal network and the network under stress measured in Stage 2.

2. The goal is now to design a solution that meets the design solution criteria. Let the students brainstorm solutions. You can organize the class into smaller groups or lead a group discussion. The following questions walk the students through the process.

   How would you protect the network against a denial-of-service attack? How can we solve each of the problem areas? (Remind the students about the ideas they had about how organizations might protect themselves against denial-of-service attacks. Are these ideas applicable here?)

   Brainstorm solutions for the problems listed. Guide them into being specific in their solutions. Table 6 shows some possibilities. Here are some additional rules you should follow to keep the simulation more realistic and prevent trivial or "cheating" solutions: Each test run should take 2 minutes. This ensures you can compare the quantitative results. No pre-known information (before the 2-minute period starts) may be used in the solution. Students might be tempted to say "Discard the blue color requests" because they know the attacker has blue cards. This is not acceptable because in real life you never know who the attacker is before he starts the attack. On the other hand, blocking requests from a user that issues requests at a very high rate is totally fine, since that information is gathered during the 2-minute period. It is also fine to block any request from that user for an extended period (e.g. all the time left of this 2-minute test run.) In real life, users identified as malicious end up on "black lists" and can be denied access to a service for extended time periods. It is not acceptable to use the fact that the name is not written on the attacker's requests, as in real life, the requests from attackers do not look any different from requests from legitimate users.

   Swipe left to see more

   Possible Solutions	How Does It Protect the Network?
   Add a second server to handle requests.	Two servers can handle more requests in a specified time than one. If the attacker does not send too many requests, the increased number of requests do no harm.
   Ask the guard to systematically sift through the incoming requests and remove any that seem suspicious based on a rule. Example: If an Internet delivery contains more than five requests from the same client, remove them.	Removing illegitimate requests (requests that come from an attacker) allows the network to focus on serving its real clients.
   Add a second server queue	A bigger queue can hold more requests, so the network can handle sudden bursts of requests that may have been issued by an attacker without hindering other users.

   Table 6. Table listing interventions that can protect a network against a DoS attack.
   
   
   
3. Let each group of 9–12 students select a proposed solution to act out. Let them identify how the setup needs to be changed to implement the solution. Note that one student may need to switch from being a client to being the additional server.
4. Perform the activity as indicated in Stage 2, steps 2-6.
5. Let the students evaluate if the solution was successful.

   Was the altered IT network running smoothly when under attack? Did it feel like there was an improvement? How can we verify this quantitatively?

   Students will most probably be able to evaluate the network and measure the quantitative variables without your assistance.

   How can we, as cybersecurity personnel, know if the network improved? How can we see if the solution meets the solution criteria?

   As cybersecurity personnel, you can objectively show if there was improvement by comparing the efficiency of the network in Stage 3 to the efficiency in Stage 2 of this activity. You can see if the solution meets the criteria by plugging in the measured variables to the design solution criteria. If some criteria were not met, ask the students what they think cybersecurity personnel would do to improve the implemented solution.

6. If time allows, act out several solutions (stage 3, steps 3–12).

Reflect (10 minutes)

If more groups tested solutions or if different solutions were tested, let the group(s) share their results. Does one solution stand out as being significantly better, or do all solutions have their advantages and disadvantages? What evidence do we have to support this conclusion? Could the solutions be combined?

The answers to this question will largely depend on the student's results. In the real world, several measures are often combined to protect a network. An example could be including a firewall and adding another server queue.

With the experience you gained in this activity, do you think protecting IT networks from attacks is an easy or a difficult task? Why?

Attackers are clever and they continuously present cybersecurity personnel with new challenges keeping them on their toes. Cyber-attacks exist in all forms and new types are continuously being invented. In this activity, the attack was launched from one single client. Explain that sometimes, hackers use a network of devices or a botnet to launch a denial-of-service attack. This type of attack is called a distributed-denial-of-service (DDoS) attack. The attackers do not necessarily own the devices from which they launch the attack. They maliciously gain a certain amount of control over devices that are connected to the Internet, and use them to launch the attack. You might be wondering who would ever allow someone to use their device to launch a distributed-denial-of-service attack from their machine. The sad truth is that you might not know your computer, phone, or other Internet-connected device is being used!

How do you think we can help fight cyber-attacks and make it harder for attackers to use our devices in an attack?

Protecting all Internet-connected devices from illegitimate use makes it harder for attackers to use them in an attack. Below some practical ways. Do not click on links, or download and/or run programs from untrusted sources (websites, emails, social media, etc.). Malware creators use the lure of "free" stuff, to get you to download and run a program that has their malware attached. Once the malware gets installed on your computer, it can do anything (in the worst case, the malware creator can remotely control your computer). Always have an anti-virus program running, have it automatically scan all downloaded content, and set it to scan your device regularly. Use passwords that are long, a little hard to remember and have nothing to do with your hobbies, likes, friends' names, pets, etc. Sites are available that generate random pronounceable passwords. Because you can say them out loud they're easier to remember than completely random ones. warpconduit password generator and random password generator are two such sites. Have them generate a few and look for one that you can say and that makes you giggle. That's one you can remember.

Assess

You can use this quiz to assess student learning after the activity:

• Online quiz, assignable in any LMS
• Quiz (pdf) and answer key (PDF)

Make Career Connections

Discussing or reading about these careers can help students make important connections between the in-class lesson and STEM job opportunities in the real world.

Security Incident Responder

Add Favorite Remove Favorite More Menu

• Read More

Career Profile

A security incident responder is the first responder in the cyber world. In the case of a cyber-attack, they are the first to assess the situation and eliminate any immediate dangers. After the attack has been stopped, they may switch to more of a "detective" role, to figure out exactly what happened, how it happened, and how future attacks can be prevented. Read more

Computer Network Architect

Add Favorite Remove Favorite More Menu

• Read More

Career Profile

Computer networks are continually sharing information. The role of the computer network architect is to design, model, and evaluate computer networks so that they work seamlessly together. Read more

Lesson Plan Variations

• Students can act out several defense mechanisms, as well as combined mechanisms, and study how they score with respect to the design criteria. They can compare and contrast the different options.
• Different attack scenarios can be introduced. Some suggestions are listed in Table 7. These scenarios are simplified versions of attack strategies used in the real world.