Abstract Detecting DDoS Attacks on ISP Networks

Most past solutions for detecting denial of service attacks (and identifying the perpetrators) have targeted end-node victims. However, little attention has been given to this problem from an ISP perspective. This paper explores the key challenges involved

DetectingDDoSAttacksonISPNetworks

AdityaAkella

AshwinBharambe

MikeReiter

SrinivasanSeshan

CarnegieMellonUniversity

Abstract

Mostpastsolutionsfordetectingdenialofserviceattacks(andiden-tifyingtheperpetrators)havetargetedend-nodevictims.However,littleattentionhasbeengiventothisproblemfromanISPperspec-tive.ThispaperexploresthekeychallengesinvolvedinhelpinganISPnetworkdetectattacksonitselforattacksonexternalsiteswhichusetheISPnetwork.Weproposeadetectionmechanismwhereeachrouterdetectstraf canamoliesusingpro lesofnormaltraf cconstructedusingstreamsamplingalgorithms.Inaddition,anISP’sroutersexchangeinformationwitheachothertoincreasecon denceintheirdetectiondecisions.Ourinitialresultsshowthatinpidualrouterpro lescapturekeycharacteristicsofthetraf ceffectivelyandhelpidentifyanomalieswithlowfalsepositiveandfalsenegativerates.Webelievethatpro leconstructioncanbeex-tremelyef cient,supportingevenmulti-gigabitspeeds.Wealsobe-lievethatincrementaldeploymentofsuchtechniquesispossible,althoughitmaysign cantlyimpacttheeffectivenessofthedis-tributedreinforceddecisionmaking.

1Introduction

DistributedDenialofService(DDoS)attackshavebecomeanin-creasinglyfrequentdisturbanceintoday’sInternet.Manyrecentre-searcheffortshaveexploreddesigningmechanismsfordetectingsuchattacksandidentifyingtheperpetrators.However,alltheseso-lutionsareaimedataidingend-nodevictimsunderattack.Inthiswork,welookattheproblemfromthepointofviewofanInternetServiceProvider(ISP).Speci cally,wedesignmechanismsthatal-lowISPstoquicklyandef cientlyanswerthefollowingquestions:(1)IstheISPbackboneitselfunderaDDoSattack?(2)IstheISPnetworkcarryingmuch“useless”1traf c?(3)Whichtraf cisma-liciousandwhatshouldbedonetosuchtraf c?

Intoday’sBGP-drivenInternet,largeASespeerwithotherASesatmultiplePoPs(PointsofPresence).Ifapacket’sdestinationisnotwithinitself,anAShandsoverthepackettootherASesassoonaspossible.Thishotpotatoroutingmaynotusetheshortestroutetothedestination.Duetothesefactors,packetsgoingtothesamedestinationcantraverseperseanddisjointpathsthroughanAS.This“dispersion”makesithardtodetectDDoStraf catanysinglepoint,necessitatingadistributedapproachtotheproblem.OurapproachtothisproblemreliesonrouterswithintheISPiden-tifyingtraf cpatternviolationsthemselves.Thisisachievedbybuildingtraf cpro lesusingstreamsamplingalgorithmswhichhaveanextremelysmallmemoryfootprint.Bysamplingoverrela-tivelylongtimewindows,normaltraf cpro lesarecreatedwhilecurrenttraf cpro lesareconstructedbyusingsmallertimewin-dows.Wheneverthecurrentpro ledoesnotcorroboratewiththe

Most past solutions for detecting denial of service attacks (and identifying the perpetrators) have targeted end-node victims. However, little attention has been given to this problem from an ISP perspective. This paper explores the key challenges involved

Forvariousvalueof,thenumberof/pre xessourcingtraf- ctothedestination.Themotivationisthatthissetof n-gerprintscharacterizessource-subnetdistributionandwouldcatchrandomsourcespoo ngbyanattacker.

Anapproximationtothe ow-lengthdistributionoftraf ctothedestination.Wesamplespeci cpointsonthe ow-lengthdistributionbykeepingtrackofthenumberofsourceIPad-dressesthatsendmorethanfractionofthetotaltraf ctothedestination,forvariousvaluesof.

suchamessage,theneighborsdiscardduplicates,computetheag-ofthevaluesreceivedperdestinationandfor-gregate,

wardnon-duplicatesalongtotheirneighbors.If,foranydestina-tion,exceedsapre-de nedthreshold,therouterconcludesthatthedestinationisunderattack.This“consensus”stagehelpsreducetheerrorsinidenti cationofattacksevenfurther.Thesemessagescouldbesentusingspeciallow-bandwidthout-of-bandICMPmessagesbetweenrouters.Thesemessagesbetweenneigh-borscanbeauthenticatedwiththeuseofaTTLof255,asin[3]andaretimedoutperiodically(everyminute)unlessrefreshed.

Weusesample-and-hold[2]andzeroethmoment()computation

[4,1]algorithmsforcomputingthese ngerprints.Eachstatisticiscomputedbysamplingoverasmallintervaloftime,aboutaminute.Tore ectthetypicalday-of-weekandhour-of-daytraf cpatterns,routersconstructper-hour,per-weekdaynormaltraf cpro lesbyaveragingthestatisticsoverhourlyperiods.

AlgorithmatEachRouter.Withthesestatisticsinhand,eachrouterusesthefollowingalgorithmforapopulardestination:

1.Letbethenumberofbytestothedestinationinthebase-pro leandbethesamestatisticincurrentsamplinginterval.

,continuetonextstep.Otherwise,stop.If

2.Foreach ngerprint,letdenotethevaluecomputedin

thecurrentsamplinginterval.Letanddenotethemeanandstandarddeviationvaluesforthis ngerprint.2If

,then,else.is

aparametertothealgorithm.

denotethecon dencewithwhichtheroutersus-3.Let

pectsanattack.Weset.as-signs“weights”toa ngerprint,dependingontheextenttowhichthat ngerprintcontributestoerrors(false-positiveornegatives):

PreliminaryResults.Weprovideabriefsetofresultsregardinglo-calpro leconstructionandattackdetectionfunctionalitydescribed

above.Weusetraf cgeneratedbypopularattacktoolslikeTFNandTrin00alongwithtraf ctracesfromAbilenebackboneroutersinNS-2,varyingthenumberofspoofedbytesinsourceIPsandtheat-tackrateagainstdestinationsofdifferentlevelsofpopularity.Ourresultsshowthatthepro lesgeneratedbyoursamplingschemesareverystableandaccurateacrosstimeoveronehourperiods.The ngerprintingschemesalsohaveaverylowfalsepositiverate(weuse)ofabout2%forunpopulardestinationsandabout6%forpopulardestinations.Inaddition,forunpopulardestinations,irrespectiveofthenumberofspoofedoctetsortherate(“reason-ably”high)ofattacktraf c,thefalsenegativerateisclosetozero.Forpopulardestinations,thefalsenegativerateisabout20%forlow-rate,yetsigni cant,attacksbutimprovesrapidlyastherateoft …… 此处隐藏：6752字，全部文档内容请下载后查看。喜欢就下载吧 ……