Defense4All: Anti-DoS for OpenDaylight. July 18, 2013

Transcription

1 Defense4All: Anti-DoS for OpenDaylight July 18, 2013

2 Introducing Defense4All Defense4All offers DDoS attack detection engine and a traffic diversion mechanism based solely on the programmable characteristics of SDN enabled elements. The SDN application that programs your network for DoS security Slide 2

3 Defense4All in Action Program Security service provisioning Collect Programmable Probes Analyze & Decide Detection Defense4All Anti-DoS App SDN Controller Create and distribute traffic counters vswitch Radware DefensePro or equivalent Scrubbing Center Slide 3

4 Defense4All in Action Program Security service provisioning Collect Programmable Probes Analyze & Decide Detection Control Flow diversion and Mitigation Optionally, configure mitigation device/service Defense4All Anti-DoS App SDN Controller Anomaly detected!!! Divert suspicious traffic to scrubbing center vswitch Radware DefensePro or equivalent Scrubbing Center Slide 4

5 Defense4All in Action Program Security service provisioning Collect Programmable Probes Analyze & Decide Detection Control Flow diversion and Mitigation Defense4All Anti-DoS App SDN Controller vswitch Radware DefensePro or equivalent Scrubbing Center Slide 5

6 Defense4All (D4A) position within OpenDaylLight Slide 6

7 Defense4All Architecture Statistics Service addcounter(selector) readcounter() removecounter() resetcounter() Defense4All Detector Plugin Anomaly Detector Statistics Service API Defense4All API Mitigator Driver Mitigation Manager TrafficRedirection Service API Statistics Service TrafficRedirection Service Mitigation Device(s) Slide 7

8 Statistcs Service Counter Smart Placement ODF: addcounter(tcp-traffic-for-x) Adding a counter adding flow entries in subset of switches that capture all the traffic destined to a protected object (PO) OF Switching Fabric Option 1: at the network edge Option 2: at the server edge PO 8

9 Defense4All Architecture Redirection Service redirecttraffic(selector, waypoints[]) External Traffic mirrortraffic(selector, waypoints[]) OF Controlled Network External Traffic OF Controlled Network Defense4All Detector Plugin Anomaly Detector Statistics Service API Defense4All API Mitigator Driver Mitigation Manager TrafficRedirection Service API Statistics Service TrafficRedirection Service WP1 WP2 WP3 (or Sink) Target Sink Target (a) Redirection (b) - Mirroring Waypoint ID == [DPID+PortIn, DPID+PortOut] or [DPID+PortIn] (for a sink device) or Address (IP or MAC) Mitigation Device(s) Leverage Service Chaining Service? Slide 9

10 Example: Traffic redirection for attack mitigation ODF: Redirect(tcp-traffic-for-x, toscrubbing-device) Diversion set directing flow entries in all switches along the way OF Switching Fabric PO 10

11 Defense4All Architecture Anomaly Detector Builds peace time (normal) traffic baselines Identifies deviations from normal traffic baselines Pluggable system to support: Multiple vendors Different detection techniques Extensibility (detect new attacks) etc. Defense4All Detector Plugin Anomaly Detector Statistics Service API Statistics Service Defense4All API Mitigator Driver Mitigation Manager TrafficRedirection Service API TrafficRedirection Service Mitigation Device(s) Slide 11

12 Defense4All Architecture Mitigation Manager Configuring the network such that the suspicious traffic (and only the suspicious traffic) is diverted to scrubbing center After attacks, restores the network to original configuration Configures external mitigation device(s) e.g., pass to device baselines to expedite detection Monitoring of external mitigation device(s) e.g,. attack ended Vendor independent Interested vendors/service providers can connect to the system by written a Mitigator Driver (think device drivers in OS) Defense4All Detector Plugin Anomaly Detector Statistics Service API Statistics Service Defense4All API Mitigator Driver Mitigation Manager TrafficRedirection Service API TrafficRedirection Service MaaS 1 Provider X Mitigation Device(s) 1 MaaS Mitigation as a Service Slide 12

13 Defense4All Unique Value Proposition Per-tenant abstracted provisioning of security services Scalable, precise and fast attack/anomaly detection Utilize native SDN programming for attack traffic diversion Lower solution costs Statistical collection without costly specialized hardware detectors Simple attack diversion (no need to use BGP injection, GRE tunnel) Centralized control allows efficient management of mitigation resources, monitoring and reporting Extensible Add detection algorithms Add mitigation devices/services Slide 13

14 Thank You

15 About Radware Global Leader of Application Delivery - and Application Security Solutions SLB Acceleration Anti-DoS IPS WAF ADC Solutions L4-L7 Server Load Balancing Application Acceleration SSL Offloading Attack Mitigation System DDoS attacks Protection Intrusion Prevention Web Application Protection Over 10,000 Customers Global Technology Partners Slide 15

16 About Radware Global Leader of Application Delivery - and Application Security Solutions SLB Acceleration Anti-DoS IPS WAF Leverage SDN to create: ADC Solutions Attack Mitigation System L4-L7 Server More Load intelligent Balancing application delivery and DDoS security attacks deployments Protection Application Acceleration Simpler implementations Intrusion Prevention SSL Offloading Web Application Protection Lower solution costs Over 10,000 Higher Customers scalability Easier and abstracted operation Global Technology Partners Enabling a smarter network. Slide 16

17 Radware s SDN Application Architectural View Ecosystems NorthBound API User Interface Radware SDN Applications ElasticScale App DefenseFlow App AvailabilityFlow App SDN Drivers L4-7 Drivers Data Collection + Programming Data Collection + Programming NB API Network Controller ADC & Security Services Slide 17

18 Ponemon Research 2012: DDoS Attacks are Mainstream 65% of organizations had an average of 3 DDoS attacks in the past 12 months 54 Minutes average downtime during one DDoS attack $22,000 Average cost per minute of downtime $3,000,000 Average annual cost of DDoS attacks Slide 18

19 December 7 th 2010, WikiLeaks DoS & DDoS attacks (group Anonymous), on businesses including MasterCard, Visa, PayPal and others March 6 th 2011, DoS & DDoS attack on Korean e-commerce and government institutions Financial August 2011, DoS & DDoS attack on Hong Kong stock exchange October 2011, DoS & ecommerce DDoS attacks on New York stock exchange... Jan-Feb 2012, DoS & DDoS attacks on Israel government, Israeli stock exchange, Israeli Banks,... More Organization Are Threatened by DoS March 2012, DoS & DDoS attacks on the Vatican Site September 2012, Operation Ababil attacks on US banks Low egaming ISP 19