A Living Example of DDoS Mitigation

Transcription

1 A Living Example of DDoS Mitigation Stop DDoS before they stop you! James Braunegg (Micron 21) Maolin Gu (NSFOCUS)

2 The creation of Micron21 Datacentre Removing resellers and middle men Working directly with the end customer Total control over the physical security Continuous power, continuous cooling and continuous network access 24 hour IT service and support

3

4 Micron21 DDoS Protection Over Time

5 Micron21 First Network

6 DDoS Attack - Blind

7 Micron21 Netflow

8 DDoS Attack - Netflow Over Load

9 Juniper SRX 3400 Cluster

10 DDoS Attack Firewall Over Load

11 Five Brocade MLXe XMR Routers Upgrade from 2gbit to 1.92 Tbps Capacity 960x Increase in capacity from Cisco Upgrade from 2 Million PPS to 1.19 Billion PPS 600x Increase in capacity from Cisco Upgrade port speed from 1gbit to a 100 GbE 100x Increase in capacity from Cisco Other Features per MLXe Triple switch fabrics Dual routing engines Four power supplies Segmented the Micron21 Network Shared Firewall customers Dedicated firewall customers No security customers

12

13 Manual Mitigation

14

15 Automatic DDos Mitigtatoin

16 Micron21 DDoS Mitigation Ok so I couldn't build Star Ship Enterprise. But.

17 Inside Micron21

18

19 And We Installed this Weapon!!

20 Micron21 DDoS Mitigation Cannon

21 Micron21 DDoS Mitigation Scenario USA DDoS Attack Traffic Cleaned Traffic Cogent IP Transit Direct Peering Direct Peering HE IP Transit nlayer IP Transit DDoS Portal ADS 6020 ADS-M Mgt. Southern Cross To M21 DC

22 Micron21 DDoS Mitigation Scenario AUST DDoS Attack Traffic M1 DC Vocus DC Primus DC Cleaned Traffic CBD Location M21 DC ADS / NTA M21 DC Kilsyth Location ADS-M Mgt. DDoS Portal Micron21 Segmented Internal Network

23 Thousands of Attacks per day Mitigated

24 Micron21 DDoS Customer Portal

25 A living 17G DDoS attack mitigation example

26 So How Does NSFOCUS work How Does the ADS Clean Traffic

27 ADS -- Multilayer Cleaning Attacker Internet Traffic Cleaning Center Protocol Analysis Access Control List Reputation List Layer 4 Flood Mitigation Layer 7 Flood Mitigation 6 Rate Limit 1. Protocol Analysis Protocol Validation by RFC Check 2. Access Control List Layer 4 ACL Conn-Exhaustion ACL URL ACL 3. Reputation List White/Black List Dynamic Prioritizing 4. Layer 4 Flood Mitigation Source/destination IP address check/verification Various mitigation algorithms 5. Layer 7 Flood Mitigation Various mitigation algorithms Pattern Matching 6: Rate Limit Restricts traffic and ensures the critical business.

28 So What NSFOCUS really look like Show Me the Magic.

29 The Magic Box

30 Scale and Cluster as you Grow Collapsar Attack Mitigation 流 量 清 洗 系 列 ADS ADS 2010 (2G) ADS 2020 (4G) ADS 4020(2-10G) ADS 6020 (12-20G) 1,488,000 pps 2,976,000 pps 8,928,000 pps 14,880,000 pps

31 24/7 Automatic DDoS Engineer

32 DDoS Trends in 2013 H1 DDoS Attack Frequency 5% 1% 1% % 29% 43% Bank Government Enterprise NPO ISP Other 0 Jan Feb Mar Apr May Jun Figure 2 DDoS Attacks Monitored by NSFOCUS Figure 5 Targets of Major DDoS Attacks TCP_FLOOD 38,7% The combination of Hybrid DDoS Attacks HTTP_FLOOD DNS_FLOOD 13,1% 37,2% 9,8% 10,8% HYBRID_FLOOD UDP_FLOOD OTHER ICMP_FLOOD 4,1% 3,5% 3,0% 0,3% 10,2% 18,5% 50,6% ICMP+TCP+UDP ICMP+TCP+UDP+DNS ICMP+TCP TCP HYBRID Other 0,0% 5,0% 10,0% 15,0% 20,0% 25,0% 30,0% 35,0% 40,0% Figure 8 Methods of DDOS Attacks -- Source: NSFOCUS Mid-Year DDoS Threat Report 2013

33 Findings of DDoS Trends Findings from NSFOCUS Mid-year DDoS Threat Report 2013 : One major DDoS news event happened every two days and one common DDoS attack happened every two minutes; DDoS motives - Hacktivism tops the list; DDoS victims Most likely targets were banks, governments and enterprises; More than 68 percent of victims are suffering multiple attacks; TCP Flood and HTTP Flood remain the most popular attack methods; Most DDoS attacks are short, over 90% less than 30mins Most attacks are not very big, over 90% less than 2Gbps and 69% less than 0.2 Mpps Hybrid attacks are becoming more prevailing 91,1% 2,2% 2,2% 4,4% Hacktivism Business Crime Cyber War Other Figure 3 Causes for Major DDoS Attacks -- Source: NSFOCUS Mid-Year DDoS Threat Report 2013

34 The thought of DDoS mitigation from box mitigation to value-added service Mgt. & Operation NTA Multi-layered collaboration Internet Attack Mitigation Anti-DDOS Solution Traffic Monitoring 100G 10G to 40G ISP1 Data Center /MSSP ADS ADS ADS 1-10G Hosting ADS/WAF ADS 2010/2020 ADS 4020 ADS 6020 Traffic monitoring + DDoS mitigation; Out-of-path traffic diversion; CPE Web security (WAF) + Cloud cleaning service; Enable Web hosting provider become MSSP;

35 About NSFOCUS Regional HQ and Offices: Beijing, CN Santa Clara, US Tokyo, Japan London, UK KL, Malaysia R&D Centers Beijing Chengdu Xian Wuhan Microsoft Active Protections Program (MAPP) Partner

36 THANKS! Please come and talk at our booth!