A Covariance Analysis Model for DDoS Attack Detection*

Transcription

1 A Covarace Aayss Mode or DDoS Attac Detecto* Shuyua J Deartmet o Comutg HogKog Poytechc Uversty HogKog Cha cssy@com.oyu.edu.h Dae S. Yeug Deartmet o Comutg HogKog Poytechc Uversty HogKog Cha csdae@et.oyu.edu.h Abstract Ths aer dscusses the eects o mutvarate correato aayss o the DDoS detecto ad rooses a exame a covarace aayss mode or detectg oodg attacs. The smuato resuts show that ths method s hghy accurate detectg macous etwor trac DDoS attacs o deret testes. Ths method ca eectvey deretate betwee orma ad attac trac. Ideed ths method ca detect eve very subte attacs oy sghty deret rom orma behavors. The ear comexty o the method maes ts rea tme detecto ractca. The covarace mode ths aer to some extet veres the eectveess o mutvarate correato aayss or DDoS detecto. Some oe ssues st exst ths mode or urther research. I. INTRODUCTION Dstrbuted Dea o Servce (DDoS) attacs whch am at overwhemg a target server wth a mmese voume o useess trac rom dstrbuted ad coordated attac sources are a maor threat to the stabty o the Iteret []. But or our reasos t s dcut to detect a ogog DDoS attac: Frsty because a DDoS attac has to be detected o-e there s tte tme to detect ad corm a ogog DDoS attac. Normay the system admstrators or securty exerts have to ascerta the attacs or trace bac the attacers ess tha oe hour. Secody some Iteret worms roagato may aso drecty resut DDoS whch maes DDoS detecto much more comex. Thrdy orma deese measures such as ratemtg acet-terg tweag sotware arameters or equg more servers are a useu but mted ther caabtes. Fay the exact dstcto betwee DDoS attacs ad ash crowds remas a oe ssue. [2] has roosed a taxoomy but t s based oy o HTTP rotoco ad web evets. It s esseta that we be abe to detect DDoS attacs ast accuratey ad rea tme. DDoS attacs exhaust host resources or the etwor badwdth. It s cosequety mortat to detect resource usage chages ad reduce the detecto tme. Such aborma chages coud be detected statstcay. For exame the etroy method [3] uses requecy-sorted dstrbutos o seected acet attrbutes a tme wdow to comute etroy ad use the etroy chages to dcate the aomaes. I [4] the Ch-Square statstcs aroach s used to dety the aomaes. [5] Demostrates how Aderso-Darg statstca method s used to detect etwor trac chages. The adatve sequeta ad batchsequeta methods [6] emoy statstca aayss o data rom mute ayers o etwor rotocos to detect very subte trac chages. The robem wth statstcs-based detecto methods s that t s ot ossbe to determe wth certaty the orma etwor acet dstrbuto. Rather t ca oy be smuated as a uorm dstrbuto. Some aers suggest the usage o custerg methodoogy to ormuate the orma atters. For exame [7] ho-cout ormato erred rom Tme To Lve (TTL) vaue the IP header s used to custer the orma address rexes. [2] uses a etwor aware custerg method to dstgush betwee the HTTP-based ash evets ad DDoS attacs. Oe o the advatages o custerg methods over statstcs-based methods s that they do ot rey o ay ror ow data dstrbuto. There exst may varabes that ca be used to dety orma etwor atters: cet characterstcs such as the source IP address or Roud-Tr Tme (RTT) etwor trac atters such as the deret rotoco dstrbuto acet rate ad ow terva ad server atters such as the umber o cets ad ther dstrbuto er-cet request rate ad request e dstrbutos. The choce o whch varabes seected as a adequate custerg crtero remas a oe robem. Modeg detecto robems to cotro theory [8] ad matera ow [9] cotro robems may aso rovde ove ersectves o the DDoS detecto. The covarace aayss method roosed ths aer s aso a statstcs-based method but ue the wors [4] [5] ad [6] t does ot rey uo ay resumtos o the orma etwor acets dstrbutos. Ths method s eectve because t accuratey detects DDoS attacs o deret testes ad because the method s sme t ca be memeted o-e. Ths aer cams three ma cotrbutos: Ths aer ams at dscussg the eect o mutvarate correato aayss o the detecto o DDoS attacs. Athough the exermets we oy use a ags the cotro ed o TCP header as raw data ad oy use covarace matrces to detect oodg attacs t may ot obstruct the mortace ad geerazato o our roosed aroach. I [] t was show that oodg attacs coud aso be detected usg the o-arametrc Cumuatve Sum (CUSUM) method. The derece betwee these two * Ths research wor s suorted by a Hog Kog RGC roect research grat umber B-Q57 IEEE Commucatos Socety /4/$2. (c) 24 IEEE

2 aers es that we am at roosg a geerc correato method to detect DDoS attacs ad the teto o exermets o detectg oodg attacs oy see to exemy ths dea. Ths attemt w be heu the research o eature seecto or detectg DDoS attacs. I act may arameters were used detectg DDoS such as source IP address ad RTT [2 7 ad ]. But o systematc way o choosg these arameters has bee roosed. [] resets a eature rag ad seecto or IDS ad [6] dscusses a ove eature reducto techque. Ther exermets are based o datasets descrbed [2]. They dd ot dscuss some other arameters such as ow ter-arrva tme or acet rate. Nor dd t cosder the eect o ay correato coecets o detecto. Ths aer rooses a eectve o-e detecto method based o covarace aayss. The method coud ot oy deretate betwee the orma ad attac trac oodg stuatos but aso detect the subte attacs that exose ew aaret dereces rom orma behavors. It s we ow that The most dcut art or deedg agast DDoS attacs s that t s very hard to deretate betwee orma trac ad attac trac. Ths s the udameta robems o the Iteret [5]. Besdes the ear comexty o our method maes DDoS rea-tme detecto ecet ad ractca. The rest o ths aer s orgazed as oows: Secto II descrbes the covarace aayss detecto methodoogy used DDoS detecto. Secto III vadates the covarace detecto method smuatos ad exermets o detectg oodg attacs. Secto IV aayzes the method s eectveess. Fay cocusos ad dscussos are roosed Secto V. II. OVERVIEW OF COVARIANCE ANALYSIS METHOD The ma dea s that the characterstcs o a ormato system coud be descrbed by the correatos amog ts eatures. Rag ad seectg the ow arameters as eatures coud he to dety the atters o the Iteret whe the correatos amog the eatures may rovde addtoa esseta ormato. The correatos are exected to be sestve eough to ag some chages. I terms o correato the orma atters w be deret rom the aborma atters. I ths sese the correato may be seected as a chage dcator ad ay chages or aborma actvtes w detey chage the correato coecets o these eatures gotte the orma stuatos. So detectg the correato chages coud determe the occurrece o the chage. I statstcs theory the eectveess o ths chage detecto method s obvous ad ts ececy s determed by the sutabe data voume we coud gather a mted observato wdow. The detas o the method are descrbed as beow: Assume there are eatures... whch comose a radom vector X = (... ). Let x... x are the observed vectors x = (... ) s the th observed vectors. s the vaue o the th observato durg the th tme terva T. We dee a ew varabe y ad the covarace matrx M to characterze the varabe y as oows: y = () M = y (2)... 2 We dee varabe z as the dstace betwee two matrces M y ad the mea o M y or EM ( ) y : z = M E( M ) y y (3) where z measures the chage or the aomay. To smy the robem descrto the oowg dstace ucto o two matrces s used: 2 M M2 = ( a b ) a M b M2 (4) I the orma stuato oe ca d a ot c ad a costat a or z equato (3) whch satsy z c < a Ζ. The costat a s seected as the uer threshod o the..d z c. So or the observed data gathered durg the th tme terva we cacuate the corresodg z z c > a the aborma behavors coud be determed. III. FLOODING SIMULATIONS AND DETECTION We seect a the ags cotro ed o TCP header as eatures the covarace mode. Each ag occues oy bt the TCP header. As [3] a bre descrto o each bt s gve the oowg tabe: TABLE DESCRIPTION OF FLAGS IN THE CONTROL FIELD OF TCP HEADER Fag PSH Descrto The vaue o urget oter ed s vad The vaue o acowedgemet ed s vad Push the data The coecto must be reset Sychroze sequece umbers durg coecto Termate the coecto As we ow oodg attacs the umbers o ad do ot match. Our method tres to use the covarace o each ar o the above sx ags to detect the oodg attacs. The dataset we use are descrbed tabe 2. Each o these two traces cotas a hour's worth o a wde-area trac betwee Dgta Equmet Cororato ad the rest o the word. The traces were gathered at Dgta's rmary IEEE Commucatos Socety /4/$2. (c) 24 IEEE

3 Iteret access ot whch s a Etheret DMZ etwor oerated by Dgta's Pao Ato research grous. TABLE 2 THE TCP TRACE DESCRIPTION Trace Start Tme TCP Pacets dec-t- 22: Wed March 8th mo dec-t-2 2: Thu March 9th mo I the smuato these two traces rereset orma trac. We arse the two traces ad extract the cotro ed vaue o each acet the traces. We seect 2 secods as a tme terva. Fgures (a) ad (b) rereset the characterstcs o deret ds o acet umber uder orma oeratos. These two gures gve a geera descrto o two traces the seected tme terva terms o deret acet tyes. Pacet Number every 2 secods PUSH Tme (Secods) Pacet Number every 2 secods PUSH Tme (Secods) (a) dec-t- (b) dec-t-2 Fgure Norma Pacet Number accordg to deret ags 2 secod terva Accordg to equato (2) we cacuate a matrces Ms 2 secods the trace dec-t- ad dec-t-2 searatey. The we d the corresodg z s deed by equato (3) accordg to the dstace deto gve (4). The resut s descrbed gures 2 (a) ad (b) whch ustrate the dstace betwee the covarace matrx ad the mea o a covarace matrces uder orma stuatos. Dstace betwee Covarace Matrx ad Mea Matrx Dstace betwee Covarace Matrx ad Mea Matrx Tme (Secods) (b) dec-t-2 Fgure 2 Covarace Matrx Dstace uder Norma Oeratos The aborma trac s smuated the same way as descrbed []. I a DDoS attac the severe eect o the vctm comes rom the aggregate oodg rate rather tha rom oy oe sge attac source. So the sestvty eeds or attacer-earest-router ocated ad vctm-earest-router ocated DDoS detecto are deret. The attacer-earestrouter ocated DDoS detecto ocuses o revetg the outut o tera macous trac to the Iteret whch corresods to the ow attac acet rate detecto. Vctm-earest-router ocated DDoS detecto may ocuses o rotectg the vctms whch corresods to the hgh attac acet rate detecto. To attac a rotected server the aggregate oodg acet rate shoud be arger tha 4 []. I order to detect our method s sestvty both asects we smuate two stuatos: 5 acets er secod to the vctm-earestrouter ocated detecto ad 35 acets er secod to the attacer-earest-router ocated detecto. Each s the mma attac acet rate each case. I order to show the treds o the eects o deret attac acet rates o the covarace matrces dstace betwee the orma ad the aborma oe we aso smuate the stuato o a attac rate o 8 acets er secod. From gure 3 we ca see that ths covarace matrx dstace method erorms we detectg ot oy arge oodg DDoS attacs but aso subte DDoS attacs eve the attac rate s 35 acets every secod (gures 3 (a) ad (b)) where at east 4 stub etwors wth ths attac rate woud be eeded to mae a successu DDoS attac. So the sestvty o ths method s obvousy hgh. It w have a % detecto rate the threshod o dstace s set as.. The resuts showed that uder very subte attacs the method coud st detect them eve they exosed very smar behavors to the orma oes. The resuts aso showed the detecto accuracy treds whe attac rate creased. It s cear that creasg the attac rate w greaty earge the ga betwee the dstace uder orma oeratos ( gure 2) ad that uder aborma oeratos ( gure 3) Tme (Secods) (a) dec-t- IEEE Commucatos Socety /4/$2. (c) 24 IEEE

4 Dstace betwee Covarace Matrx ad Mea Matrx Dstace betwee Covarace Matrx ad Mea Matrx Dstace betwee Covarace Matrx ad Mea Matrx Tme (Secods) a) dec-t Tme (Secods).5 (c) dec-t Tme (Secods).5 (e) dec-t Dstace betwee Covarace Matrx ad Mea Matrx Dstace betwee Covarace Matrx ad Mea Matrx Dstace betwee Covarace Matrx ad Mea Matrx Tme (Secods) (b) dec-t Tme (Secods) (d) dec-t Tme (Secods) () dec-t-2 Fgure 3 Sestvty o Covarace Matrx Dstace Method uder Deret Attac Rates. (a)& (b) (c) & (d) ad (e) & () show the attac rates o 35 8 ad 5 acets er secod resectvey. IV. METHOD EFFECTIVENESS ANALYSIS The eectveess o the roosed method s show by the agorthm s comexty aayss. Assume the tme terva T vectors are observed. For each eature we obta vaues. For 2 exame we get = (... ) ad 2 = (... ). The the covarace coecet γ ( ) o ad coud be rereseted as: COV ( ) γ ( ) = (5) D( ) D( ) where COV ( ) = E( ) E( ) E( ) 2 2 D( ) = E( ) ( E( )) m= m m m Sce {} we have 2 ( ) = {}. So the cacuato o γ ( ) coud be smed as: COV ( ) m PQ γ ( ) = = 2 2 (6) D( ) D( ) ( P P )( Q Q ) where P = E( ) = ~ ( ) O = Q = E = O ( ) ~ = ( ) Ad m s the occurrece umber o = = gotte by comarso oeratos. The vaue o each etry the covarace matrx coud be cacuated smy by the summato ad comarso oeratos. The comexty o the method s thereore ear whch maes the o-e detecto ractca V. CONCLUSIONS AND DISCUSSIONS Ths aer dscusses the eects o mutvarate correato aayss o the detecto o DDoS attacs. I terms o correato the orma atters w be deret rom the aborma atters. I ths sese detectg the correato chages amog deret eatures coud determe the occurrece o the aomaes. A two varabes covarace mode s reseted ths aer as a ossbe aroach to detectg the DDoS attacs. Oe coud exore the three or more varabes correato mode uture research. Comared wth exstg statstca methods used DDoS detecto [4 5 ad 6] the covarace aayss method roosed ths aer oers the advatage o deedece rom acet dstrbuto assumto. IEEE Commucatos Socety /4/$2. (c) 24 IEEE

5 I ths aer a ags the cotro ed o the TCP header are used as eatures the covarace aayss mode. The smuato resuts showed that ths method s hghy accurate detectg oodg attacs DDoS. Ths method coud aso eectvey deretate betwee orma ad attac trac. What s more t coud detect attacs o very subte testy exosg ear-to-orma behavors. The resuts o hgh detecto accuracy the exermets ad rea-tme eectveess aayss revea some macts o the mutvarate correato aayss o the detecto o the DDoS attacs. However our reset method has three maor mtatos. Frst there s o guaratee that the 6 ags are vad or sucet eatures used the covarace aayss mode or DDoS detecto. Secod o theoretca ustcato s rovded or the hgh detecto rate as demostrated the exermets. Thrd how to seect the arorate observed tme terva s st a oe robem. REFERENCES [] Emergecy Resose Team. Resut o the Dstrbuted-Systems Iruder Toos Worsho. htt:// November 999. [2] J. Jug B. Krshamurthy M. Rabovch. Fash Crowds ad Dea o Servce Attacs: Characterzato ad Imcatos or CDNs ad Web Stes. The Eeveth Iteratoa Word Wde Web Coerece Hoouu Hawa May 22. [3] L. Feste D. Schaceberg. DDoS Toerat Networ. Proceedgs o the DARPA Iormato Survvabty Coerece ad Exosto(DISCEX 3) Ar 23. [4] L. Feste D. Schaceberg. Statstca Aroaches to DDoS Attac Detecto ad Resose. Proceedgs o the DARPA Iormato Survvabty Coerece ad Exosto(DISCEX 3) Ar 23. [5] C. Maoouos S. Paavassou. Networ Itruso ad Faut Detecto: A Statstca Aomay Aroach. IEEE Commucatos Magaze October 22. [6] R. B. Baze H. Km B. Rozovs A. Tartaovsy. A Nove Aroach to Detecto o Dea-o-Servce Attacs Va Adatve Sequeta ad Batch-Sequeta Chage-Pot Detecto Methods. Worsho o Statstca ad Mache Learg Techques Comuter Itruso Detecto Jue 22. [7] C. J H. Wag K. G. Sh. Ho-Cout Fterg: A Eectve Deese Agast Sooed Trac. ACM Coerece o Comuter ad Commucatos Securty (CCS 23) October 23. [8] Y. Xog S. Lu P. Su. O the Deese o the Dstrbuted Dea o Servce Attacs: A O-O Feedbac Cotro Aroach. IEEE Trasactos o System Ma ad Cyberetcs---Part A: System ad Humas Juy 2. [9] J. Kog M. Mrza J. Shu C. Yoedhaa M. Gera S. Lu. Radom Fow Networ Modeg ad Smuatos or DDoS Attac Mtgato. IEEE 23 Iteratoa Coerece o Commucatos May 23. [] H. Wag D. Zhag K. G. Sh. Detectg Foodg Attacs. The Twety-Frst Aua Jot Coerece o IEEE Comuter ad Commucatos Socetes INFOCOM May 22. [] S. Muamaa A. H. Sug. Feature Rag ad Seecto or Itruso Detecto usg Suort Vector Maches. Presetatos Worsho o Statstca ad Mache Learg Techques Comuter Itruso Detecto Jue 22. [2] KDD Cu 999 Data or Itruso Detecto. htt://dd.cs.uc.edu/databases/ddcu99/ddcu.ames. UCI Kowedge Dscovery Databases Archve. [3] B. A. Forouza. TCP/IP Protoco Sute Secod Edto. McGraw H 23. [4] P. Porra A. Vades. Lve Trac Aayss o TCP/IP gateways. I the roceedg o ISOC sym. o Networ ad Dstrbuted System Securty(NDSS 98) March 998. [5] T. Peg C.Lece L.Ramamohaarao. Protecto rom Dstrbuted Dea o Servce Attacs Usg Hstory-based IP Fterg. IEEE 23 Iteratoa Coerece o Commucatos May 23. [6] W. W. Y. Ng R. K.C. Chag D.S. Yeug Dmesoaty Reducto or Dea o Servce Detecto Probems Usg RBFNN Outut Sestvty to aear Proceedgs o Iteratoa Coerece o Mache Learg ad Cyberetcs Xa Cha November 23 APPENDIX I equato (2) Secto II the detos o varabe ad varabe µ are as oows: µ = E( ) = = ( )( ) = µ µ = where s the umber o eatures. s the umber o observatos durg T ad s the umber o tme tervas. I Secto IV equato (5) ca be reduced to equato (6). Sce {} we have 2 ( ) = {} E E O 2 2 ( ) = ( ) = = ( )~ ( ) = = D E E E E O ( ) = ( ) ( ( )) = ( ) ( ( )) ~ ( ) Ceary D( )~ O( ) m E( ) = ~ ( ) = O = Here m s the occurrece umber o = =. The vaue o the varabe m coud be obtaed by sme comarso oeratos. No cacuatos are eeded whe or s equa to. Oy whe the two varabes are equa to m w be creased by. IEEE Commucatos Socety /4/$2. (c) 24 IEEE