Detection of DDoS Attack Scheme

Transcription

1 Chapter 4 Detection of DDoS Attac Scheme In IEEE low rate wireless personal area networ, a distributed denial of service attac can be launched by one of three adversary types, namely, jamming attac, exhaustion attac and collision attac, as described in Chapter 2. These malicious nodes participating in the attac, exploit the lac of a single entry point in a wireless networ, and generate large volumes of malicious traffic, from multiple-ends of the networ, towards a set of victim nodes. The purpose of such attacs is to overwhelm the limited energy resources of target nodes, disturb the wireless communication by emitting interference signal, weaen or zero availability of the system, quicly battery depletions, creates collision, tries to consume or waste away resources of other nodes, targeted battery power and bandwidth. For distributed attac detection, there exists a need for an efficient and accurate mechanism in place, to successfully recognize patterns of DDoS attacs. A centralized approach towards attac detection in such scenarios will incur significant delays, associated with constant monitoring of attac traffic by a single designated node, and will thus reduce the effectiveness of the outcomes of the detection process. In this chapter, we designed a fuzzy system to detect the DDoS attacs in IEEE MAC layer. It operates in a distributed manner and 60

2 distinguishes attac scenarios from the impact of traffic load on the networ behavior. The attac detection is done from the base station on the input values of detection metrics received by it s from the respective node. The base station uses the value of BPR and SNR as input to the fuzzy systems to get the level of attac (LOA) as the output of the system. The levels of attacs are categories into No (No attac), Low (jamming attac), Medium (exhaustion) and High (either exhaustion or collision attacs). Confirmation of attac detection using FCM, which can decide the lower cut-off value of LOA to conclude that all nodes whose LOAs are greater than lower cut-off values are malicious node, while other nodes are normal nodes. Power consumption model for LRWPAN, which is self organized cluster using FCM. A self-reconfiguring topology is proposed to manage the mobility and recursively update the networ topology and minimize the total energy of the system and to improve the performance of the networ. It helps to reduce the overall energy computation rates incurred by the DDoS attacs detection scheme. 4.1 Description We now propose a fuzzy system for detection of DDoS attacs in IEEE low rate wireless personal area networ, which follows a centralized approach, wherein the attac detection is done by the base station based on the input values of the detection metrics received by it from the respective nodes. There are three inputs required to be sent by the nodes to the base station: 1) the number of total 61

3 pacets received by it during a specified time period, 2) the number of pacets dropped by it during the period, and 3) the received signal strength (RSS). The third metric, RSS has to be additionally sent to the base station in our scheme. This can be preferably sent pacaged with the former two parameters, or else, sent independently. The base station computes the power received by the node from the attacer or jammer, if any, by finding the difference between the current RSS and normal RSS values. Thereafter, the base station computes the PDPT and SNR from these values, as discussed in the chapter 3. Then the base station uses the values of PDPT and SNR as inputs to a fuzzy inference system (Mamdani s Fuzzy Inference System ) to get Level of Attac (LOA) or Jamming Index (JI) as output of the system. The LOA/JI value varies from 0 to 100, signifying No attacs or DDoS attacs (may be jamming or exhaustion or collision) respectively. In this way, the base station is able to grade the intensity of DDoS being experienced by each node through the JI parameter, and thus build an overall picture. The base station, through the overall picture that it has, is now able to do a confirmatory chec through neighborhood study of any node to ascertain the correctness of the JI grade allotted to that node, as compared to the JI allotted to its neighbor nodes. This is done in our method through an algorithm called Fuzzy Cluster Means (FCM). The elegance of the method lies in doing away with the requirement of communicating with the neighbor nodes for neighborhood chec. This enhances the survivality of the system during attacs present in the networ. 62

4 Now, depending upon the overall picture we can decide the lower cut-off value of JI to conclude that all nodes whose JIs are greater than the lower cut-off value are malicious nodes while the others are normal nodes presents in the networ. 4.2 Detection of DDoS Attacs using Fuzzy Systems The purpose of DDoS attac detection is met in its entirety if the detection rate is close to 100%. It is achieved through fuzzy system. The fuzzy system is appropriate attac detection for the following two scenarios. First, attac detection involves various statistical measures as well numeric values of collected nodes information. Second, security that itself includes fuzziness as the boundary limit among the normal and malicious not definite. Hence our technique considers the fuzzy logic technique for estimating the level of attac. Fuzzy logic is capable of maing real-time decisions, even with incomplete information. Fuzzy logic systems which can manipulate the linguistic rules in a natural way are hence suitable in this respect. Fuzzy logic uses fuzzy set theory, in which a variable is a member of one or more sets, with a specified degree of membership. Fuzzy logic allow us to emulate the human reasoning process in computers, quantify imprecise information, mae decision based on vague and incomplete data, yet by applying a defuzzification process, arrive at definite conclusions. The FLS mainly consists of four blocs namely fuzzifier, fuzzy rule, fuzzy inference and defuzzifier as shown in the figure

5 4.2.1 Fuzzy Sets and Membership functions If X is a collection of objects, called the universe of discourse denoted generically by q, then a fuzzy set A in X is defined as a set of ordered pairs: A { ( q, A( q)) : qq } (4.1) Where, A(q) is called the membership function (MF) for the fuzzy set A. The MF maps each element of Q to a membership grade (or membership value) between 0 and 1. RULES INPUT SNR,PDPT FUZZIFIER INFERENCE DEFUZZIFIER OUTPUT LOA Figure 4.1: Fuzzy System for detection of attacs with respect to the input SNR and PDPT In simple terms, fuzzy means one which cannot be quantified crisply, e.g., the set Tall defined over the universe of discourse, Height (measurable in cm), may mean different things for different people. Some may consider persons of height 180 cm or more to be tall, while for others a person of height 175 cm may also be tall. Therefore, the set Tall is a fuzzy set. It must be noted that while the set Tall defined over universe of discourse Height ( which may generically be 64

6 denoted by h), is fuzzy, the universe of discourse Height is a crisp set because its members will assume crisp quantifiable values in cm. Fuzzy logic is a computational paradigm that provides a mathematical tool for representing and manipulating information in a way that resembles human communication and reasoning process [52],[53].We defines three fuzzy sets each over the two universes of discourse for input namely, SNR and PDPT; the values are LOW, MEDIUM, and HIGH. For output, four fuzzy sets are defined over the universe of discourse, LOA: the values are NO, LOW, MEDIUM, and HIGH. We use Mamdani model [54], where SNR and PDPT are the crisp inputs to the system and JI/LOA is the crisp output obtained from the system after defuzzification using the centroid method Fuzzification Fuzzification is the process of mapping the real valued point to a fuzzy set. It converts obtained inputs into fuzzy linguistic variable inputs. The two parameters are taen into account for determining the level of attac. Fuzzification of the two crisp inputs SNR and PDPT are determining the degree to which these inputs belong to each of the appropriate fuzzy sets, as generated through NS2 simulations ( the simulation setup will be describe in the section 6) which are mapped into fuzzy membership functions. To define the fuzzy membership function, trapezoid shape has been chosen in this detection method because of two reasons: first, it can be mathematically manipulated to be very close to the most 65

7 natural function, the Gaussian or Bell function, and second, it can be easily manipulated to be an unsymmetrical function where the same cannot be done so easily with the Gaussian or Bell functions. We define the membership function below: ( q) A q b 1, d d 0, a, a q, c a q b b q c c q d otherwise (4.2) Where the different values of the variables are as given in table 4.1: The graphical representation of these trapezoidal functions in respect of SNR, PDPT and JI are shown in figures 4.2, 4.3 and 4.4 respectively. Table 4.1: Values of variables used in definitions of membership functions Universe of Discourse (q ) A Set a b c d LOW SNR MEDIUM HIGH LOW PDPT MEDIUM HIGH NO LOA LOW MEDIUM HIGH

8 LOW MEDIUM HIGH 1.0 Degree of membership SNR Figure 4.2: Graphical representation of the trapezoidal function for the input signal - to - noise ratio (SNR) 1.0 LOW MEDIUM HIGH Degree of membership PDPT Figure 4.3: Graphical representation of the trapezoidal function for the input bad pacet ratio (BPR) or pacets dropped per terminal (PDPT) 67

9 NO LOW MEDIUM HIGH 1.0 Degree of membership LOA/JI Figure 4.4: Graphical representation of the trapezoidal function for output, Level of Attac (LOA) or Jamming Index (JI) Fuzzy Inference When an input is applied to a FLS, the inference engine computes the output set corresponding to each rule. The behavior of the control surface which relates the inputs (SNR, PDPT) and output (LOA) variables of the system is governed by a set of rules. A typical rule would be if x is A (SNR) then y is B (PDPT), when a set of input variables are read each of the rule that has any degree of truth in its premise is fired and contributes to the forming of the control surface by approximately modifying it. When all the rules are fired, the resulting control surface is expressed as a fuzzy set to represent the constraint output. Based on the lingusitic variables, nine rules are framed that represent the membership 68

10 functions. Relations obtained from the rule base are interpreted using the minimum operator AND. The outputs obtained from the rule base are interpreted using maximum operator OR. The fuzzy rule for the input SNR, PDPT and the output JI/LOA are given in table 1. Table 4.2: Fuzzy inference rule for the input SNR, PDPT and the output JI/LOA Sl.No SNR PDPT JI/LOA 1 LOW LOW HIGH 2 LOW MEDIUM HIGH 3 LOW HIGH HIGH 4 MEDIUM LOW LOW 5 MEDIUM MEDIUM MEDIUM 6 MEDIUM HIGH HIGH 7 HIGH LOW NO 8 HIGH MEDIUM LOW 9 HIGH HIGH MEDIUM Defuzzification The output of the inference mechanism is fuzzy output variables. Defuzzification is the process of conversion of fuzzy output variables into crisp values. The defuzzifier computes a crisp output from these rule output sets. It can be 69

11 performed in different methods. We have chosen the centroid of region gravity (COG). In this method, the centroid of each membership function for each rule is first evaluated. The final output LOA, which is equal to COG, is then calculated as the average of the individual centroid weighted by their membership values as follows: LOA COG ( b qa ( q) * q) b qa A ( q) A (4.3) Where LOA/COG is the output of the defuzzification, A(q) and q are the input variables of the membership function A. The complete process of calculating the crisp values of the LOA from the input values SNR and PDPT for every node is done through NS-2 stimulation. This approach reduces the processing load in the nodes, transferring most of the necessary calculations to the PAN coordinators. This model is able to detect unfair nodes in the MAC layer, so that it can be used to hinder attacs. 4.3 Confirmation of DDoS Attac on a Node using Fuzzy Clustering Means (FCM) The base station, through the overall picture that it has, is now able to do a confirmatory chec through neighborhood study of any node to ascertain the correctness of the JI grade allotted to that node, as compared to the JI allotted to its neighbor nodes. This is done in our method through an algorithm called Fuzzy 70

12 Cluster Means (FCM). The elegance of the method lies in doing away with the requirement of communicating with the neighbor nodes for neighborhood chec. This enhances the survivability of the system during attacer present in the networ. Now, depending upon the overall picture can decide the lower cut-off value of JI to conclude that all nodes whose JIs are greater than the lower cut-off value are malicious nodes while the others are normal nodes and then deletes the malicious nodes from the MAC layer. After each node has been assigned a crisp jamming index (JI) as per its SNR and PDPT values by the base station through the aforesaid method, the base station now confirms whether a node can be declared malicious (jammed) or not malicious by looing at the jamming indices of neighboring nodes. This is done by the base station as follows: 1. Depending upon the collision, it decides the lower cut-off value of JI, LC for declaring all nodes with JI LC, as jammed nodes, i.e., DDoS attacs detected at these nodes. 2. It maes a list of all jammed nodes, i.e., of nodes having JI LC and finds the number, t of such nodes. 3. For each of the t jammed nodes, it does the following: (i) Identifies and counts the number of one-hop neighbors, n. (ii) Out of the n neighbors, it identifies those neighbors who are in the list of jammed nodes and counts their number, nj and names the group of these nodes as jammed neighbors cluster. 71

13 (iii) Out of the n neighbors, it identifies those neighbors who are not in the list of jammed nodes and counts their number (n- nj) and names the group of these nodes as non-jammed neighbors cluster. We thus have a total of n nodes divided into two clusters in neighborhood of a node under consideration. Therefore, the deciding figure is n/2. If the number of nodes (nj) in the jammed neighbors cluster is more than n/2 then majority of the neighbors are jammed and hence it is confirmed that the node under consideration is also jammed. If nj is less than or equal to n/2, further examination is required for taing any decision. The subsequent steps of the algorithm proceed accordingly. (iv) If nj > n/2, then it confirms that the node is jammed. (v) If nj n/2, then it does the following: (a) Find the mean jamming index of jammed neighbor s cluster, jij using the formula: jij nj 1 ji nj (4.4) (b)finds the mean jamming index of non-jammed neighbors cluster, jinj using the formula: jinj n nj 1 ji n nj (4.5) 72

14 (c) Find the centroid X and Y coordinates of jammed neighbor s, using the formula: x j nj 1 nj 1 ji. x ji, y j nj 1 nj 1 ji. y ji (4.6) (d) Find the centroid X and Y coordinates of non- jammed neighbor s, using the formula: x j nnj 1 nnj 1 ji. x ji, y j nnj 1 nnj 1 ji. y ji (4.7) (e) Finds the square of the distance, d j of the node under consideration from the centroid of the jammed neighbors cluster using the formula: d j = (x - x j ) 2 + (y - y j ) 2 (4.8) (f) Finds the square of the distance, d nj of the node under consideration from the centroid of the jammed neighbors cluster using the formula: d nj = (x - x nj ) 2 + (y - y nj ) 2 (4.9) 73

15 (g) If: ( jij / d 2 j ) jinj / d 2 nj ) (4.10) then it declare malicious nodes otherwise it declares the others are normal nodes and then deletes the malicious nodes in the networ from the MAC layer. 4.4 Energy Consumption Model for LRWPAN There are three energy consumption models are often used for wireless communications: energy loss (power exhaustion), large-scale variations, and small-scale variations [55]. Similar to minimum power energy for wireless sensor networ[56], we concentrate only on energy loss that has distance dependence which is well modelled by 1/d p, where d denotes the distance between the PAN coordinator (transmitter) and other clusters (receiver), and the exponent p is determined by the field measurements for the particular system at hand, for example, p = 2 for free space, p = 1.6 to 1.8 for in building line-of-sight, and p = 4 to 6 for obstructed in building. Suppose there are c clusters in the LRWPAN, and m i is the nodes in the i th cluster, we use the following cost function to minimize the power consumption. J c m i i1 1 p ( di ) (4.11) Where d i is the degree of membership of x, p is a constant for a fixed 74

16 environment, and d i (4.12) x vi Where. is the Euclidean distance between one node (x ) and its cluster center (v i ), where x and v i can be 2-D or 3-D geography information. We partition the networ to clusters via minimizing the total power consumption using an unsupervised fuzzy c-means (FCM) Networ Partition Using an Unsupervised Clustering in FCM FCM clustering is a data clustering technique where each data point belongs to a cluster to a degree specified by a membership grade. This technique was originally introduced by Bezde [57] as an improvement on earlier clustering methods. Here we apply FCM clustering to LRWPAN partition. Our objective is to partition n nodes to c clusters which will consume minimum power. Fuzzy c- partition for LRWPAN: Let X =x 1, x 2,, x n be n nodes, V cn be the set of real c n matrices, where 2 c < n. The Fuzzy c-partition space for X is the set M fc UV u [0,1] i, ; (4.13) cn i where 75

17 c i1 u i 1 and 0 u n 1 i n i The row i of matrix U M fc contains values of the i th membership function, u i, in the fuzzy c-partition U of X. We modify equation (4.11) to c n 2 p J( U, v) ( u i ) ( d i ) (4.14) i1 1 Where u M fc is a fuzzy c- partition of X; (v=v 1, v2,...v c ) where v i is the cluster center of prototype u i, 1 i c; and, u i is the membership of x in fuzzy cluster u i. J (U, v) represents the distance from any given data point to a cluster weighted by that point s membership grade. The solution of min U J, v ( U, v) (4.15) M fc are least-squared error stationary points of J. The fuzzy clustering algorithm is obtained using the necessary conditions for solutions of equation (4.15), as summarized in the following: In equation (4.12) Assume. to be an inner product induced norm, let X have at least c < n distinct points, and define the sets ( ) I { i i c; d x v 0} (4.16) i i ~ I {1,2,..., c} I (4.17) 76

18 Then (U, v) is globally minimal for J only if ( denotes an empty sets) I c d i p ui 1/ ( ) (4.18) j1 d j or I u i ~ 0i I and ui 0 (4.19) i I and v i n n 2 ui ) x / ( ( u ) i (4.20) i The following iterative method is used to minimize J(U, v): 1. Initialize U ( 0) M fc (e.g., choose its elements randomly from the values between 0 and 1). Then at step l (l = 1, 2...) 2. Calculate the c fuzzy cluster centers 3. Update 4. Compare (l) U using (4.18) or (4.19). (l) U to (l) vi using (4.20) and (l) U ( l1) ( l) ( l1) U using a convenient matrix norm, i.e., if U U ε L stop; otherwise, return to step Each node has c membership degrees with respect to the c clusters. Determine which cluster this node belongs to based on the maximum membership. By 77

19 this means, every node is classified to one cluster and the networ is partitioned to c clusters. The PAN coordinator for each cluster can be selected based on the centroid (center) of each cluster v i (i = 1, 2,, c), and the remaining power of each node (a PAN Coordinator needs more power than a regular node). An ideal PAN coordinator should be very close to the cluster centroid and has very high remaining battery capacity. But generally both conditions are not satisfied at the same time. To compromise this, we apply a fuzzy logic system to PAN coordinator selection with the help of the PDPT and SNR from these values, as discussed in the chapter 3. The detailed experimental results are discussed in chapter Self-Reconfiguring Topology for Energy Consumption in LRWPAN A Networ protocol that can update its lins to maintain strong connectivity with the nodes is said to be self reconfiguring. There exist different mobility patterns in a LRWPAN. 1. Nodes are moving in different directions with different speeds. 2. Some nodes die out while others are mobile. 3. New nodes join in while others are mobile. 4. Some nodes die out and some new nodes join in while other nodes are mobile. 78

20 In case 1, the total number of nodes doesn t change and in cases 2-4, the number of nodes may change. Without loss of generality, we assume that the number of nodes and their locations may change from time to time. We dynamically and recursively update the partition of clusters based on the assumption that the number of clusters is constant. This approach is possible because our approach is an iterative optimization method. We summarize the procedures for updating the connectivity among nodes: 1. Collect the status of each node including its geography information and its remaining battery capacity. 2. For every new node, randomly choose its membership degree to each c cluster u i i and u 1. If a node dies out or leaves the networ, delete its membership. i1 3. Update the total number of nodes n. Keep the existing c cluster centers as the initial values for the next iteration. 4. Calculate the c fuzzy cluster centers 5. Update (l) u using (8) or (9). (l) v i using (10)and (l) u (l) v i 6. Compare (l) ( l1) u tou using a convenient matrix norm, i.e., if ( ) ( 1) u l u l ) L stop; otherwise, return to step Each node has c membership degrees with respect to the c clusters. Determine which cluster this node belongs to based on the maximum 79

21 membership. By this means, every node is classified to one cluster and the networ is partitioned to c clusters. 8. Select the PAN coordinator for each cluster based on the scheme presented in section Setup the star topology based on the partitioned clusters and selected PAN coordinator for each cluster. The above procedure can be used by a networ periodically for every short period of time since every node is mobile and its remaining battery capacity is time varying. 4.5 Conclusions The critical nature of applications of IEEE MAC Layer demand the need for their protection against malicious attacs that may be launched against sensory resources by the adversary-class. Several attacs such as: Jamming attac, exhaustion attac and collision attac have been modeled and analyzed in the literature survey as described in chapter 2. All the techniques are detecting the attacs by individual nodes, there is no communication with their neighbors, so that possible for more malicious nodes are present in the networ. An improved version of an attac against the availability of sensory resources is the distributed denial of service attac by using fuzzy system to detect the DDoS attacs in the IEEE MAC layer which is able to communicate with all the neighbors present in the networ. The attac detection is done by the base station on the 80

22 input values of detection metrics received by it, from the respective node. The base station uses the value of BPR and SNR as input to the fuzzy systems to get the level of attac (LOA) as the output of the system. The levels of attacs are categories into No (No attac), Low (jamming attac), Medium (exhaustion) and High (exhaustion and collision attacs). Confirmation of attac detection using FCM, which can decide the lower cut-off value of LOA to conclude that all nodes whose LOAs are greater than lower cut-off values are malicious node, while other are normal nodes. Next the power consumption model for LRWPAN, which is self organized to clusters using FCM. The FCM is applied to PAN coordinator selection for each cluster. A self-reconfiguring topology is proposed to manage the mobility and recursively update the networ topology and to minimize the total energy of the system and improve the performance of the networ. It helps to reduce the overall energy computation rates incurred by the DDoS attacs detection scheme. All the detailed experimental results and performance analysis are discussed in the chapter 6. The next chapter explains the proposed mechanism for prediction of attac and also able to prediction the type of DDoS attac using fuzzy systems. 81