Two-Phase Traceback of DDoS Attacks with Overlay Network

Transcription

1 4th Internatonal Conference on Sensors, Measureent and Intellgent Materals (ICSMIM 205) Two-Phase Traceback of DDoS Attacks wth Overlay Network Zahong Zhou, a, Jang Wang2, b and X Chen3, c -2 School of nforaton Engneerng, GuangDong Medcal Unversty, Dongguan , Chna 3 Kunng Unversty of Scence and Technology,Kunng , Chna a Correspondng author, eal: [email protected], beal: [email protected],ceal: [email protected] Keywords: Network Securty; DDoS Attacks; Oveylay Network; Adaptve CUSUM; Two-phase traceback. Abstract. An overlay network based traceback schee aganst DDoS attacks s proposed n ths paper. A CAT server s set n each ISP doan, and receves the alert packets fro routers n the doan. Accordng to the alert packets, the ntra-doan attack tree s constructed. An alert wll be sent to the vct once an ntra-doan attack tree s fored. The nter-doan attack tree s constructed at the CAT server of the vct end accordng to the receved alert packets fro upstrea doans. The traceback request s sent to each CAT server of the nter-doan attack tree once the DDoS attacks are detected. Havng receved the request, the CAT server wll fnd the attack source along the ntra-doan attack tree, and take easures to stop DDoS attacks. The proposed schee pleents two-phase traceback of DDoS attacks effectvely and fast. Introducton DDoS attacks are the crtcal threat to the nternet. However the dynac, stateless and anonyous nature of the nternet akes t extreely hard to trace back the source of these attacks. A nuber of traceback approaches are proposed, but ost of the adopt packet arkng and loggng or the hybrd of the two ethods. There are two ajor ethods for packet arkng, the probablstc packet arkng (PPM) and the deternstc packet arkng (DPM). Savage et al frst ntroduced the probablty-based packet arkng ethod and proposed the FMS schee []. It splts each router s IP address and redundancy nforaton nto eght fragents and probablstcally arks the IP packet wth one of the eght fragents. But t doesn t work well n case of DDoS attacks. Another shortcong of the FMS s that the packet arkng could be forged. To solve ths proble, Song et al proposed advanced and authentcated arkng schee-ams [2]. AMS authentcates the arkng nforaton wth essage authentcate code- MAC functon. But the dstrbuton of the secret key s dffcult. Goodrch uses the 25 bts of the IP header to store the arkng nforaton wth lnk essage. Only the fragents wth the sae lnk are reassebled nto the IP address [3]. It greatly reduces the nuber of cobnatons of the fragents and accelerates the path reconstructon. It also reduces the false postves resulted fro cobnatons of the fragents. But t does not ark the dstances fro the source to the current router. So t can not prevent the attackers fro njectng the spoofed nforaton. The nuber of packets requred for path reconstructon s large and the reconstructon te s long n PPM. Ang at the shortcong of PPM, Belenky et al proposed the deternstc packet arkng (DPM)[4]. It arks a packet at the edge ngress router. The IP address of each edge ngress router s dvded nto two fragents. The router wll select one of the fragents randoly and wrte nto a packet passng through t. But the false postves are very hgh n case of DDoS attacks. Ang at the shortcong n DPM, Lee et al proposed a deternstc packet arkng schee for tracng ultple nternet attackers- DPM-AD [5], but both DPM-AD and DPM ark each packet passng through the router whch akes the coputaton overhead very hgh when the DDoS attacks occur. Xang et al proposed flexble deternstc packet arkng-fdpm [6]. It can adjust the length of the arkng nforaton accordng to the network protocol and adjust the arkng speed accordng to the router s overload. Thus, t can pleent traceback n large-scale DDoS attacks The authors - Publshed by Atlants Press 49

2 PPM and DPM suffer a nuber of serous drawbacks: lack of scalablty; vulnerablty to packet polluton fro hackers and so on. Loggng s another approach to traceback even after the attack has copleted. Partal packet nforaton wll be stored n routers for the traversed packets and ths nforaton provdes a tral of the attack path. Full attack path can be reconstructed by applyng soe data extracton ethods. The advantage of ths approach s that t does not ncrease traffc flow, but t ncreases the storage requreent of the partcpatng routers. Ang at the drawbacks of the packet arkng and loggng ethods, a two- phase traceback schee wth overlay network s proposed. The Overlay Network Constructon The ISP doan s treated as the unt of traceback n our proposed schee. A change aggregaton tree (CAT) server s set n each ISP doan and t aggregates the attack nforaton fro the routers n the ISP doan. The overlay network s conssted of the CAT servers fro all ISP doans. Adaptve CUSUM algorth s adopted to detect abnorty at each router n the ISP doan. Once an abnorty s found, an alert packet wll be sent to the CAT server n the local ISP doan. Havng constructed the ntra-doan attack tree wth traffc weght accordng to the receved alert packets at the CAT servers, another alert packet carryng wth weght and doan nae s sent to the CAT server at the vct. Accordng to the receved alert packets, the CAT server at the vct constructs the nter-doan attack tree wth weght and coputes the weght of the constructed nter-doan attack tree. If the weght s greater than a detecton threshold, t s consdered that the DDoS attacks aroused. Two- phase traceback of DDoS Attacks The proposed traceback schee of DDoS attacks s based on the detecton of DDoS attacks. Havng detected DDoS attack at the vct, the vct CAT server wll send traceback request to each CAT server of the nter-doan attack tree. The CAT server traceback to the attack sources accordng to the constructed ntra-doan attack tree and take easures to stop the DDoS attacks. Adaptve CUSUM based Abnorty Detecton. We consder the traffc to port p of the router n the t th ontorng cycle as observaton sequence, and denote t as X(t, p ). In order to apply nonparaetrc CUSUM, a transforaton s ade to XT(t, p ) as follows. XT(t,p )= X(t,p )-XX p () To attan accurate XX p, we adopt estaton of ean and varance based adaptve CUSUM algorth to generate the paraeter.to the ean μ and varance σ, we adopt equaton (2) and equaton (3) to estate onlne durng each ontorng cycle to adjust the XXp adaptvely. X t, p = X t j, p j= = ( ) X t, p + X t, p (2) 2 2 σ t, p = X ( X t, j, ), (,, ) j p X t p = σ t p + X t p X t p j= (3) Accordng to the estaton value of ean and varance onlne, paraeter XXp can be adjusted adaptvely accordng to equaton (4). XXp = X t, p σ +2 t, p X (4) 492

3 We defne Z n (t,p ) as the accuulaton of stochastc varable XT(t,p ) Z n(t,p )=ax{0,z n (t -,p )+X(t,p )- XX p } (5) In order to reflect the change ore accurately, we defne RD n (t,p ) (Relatve Devaton) as an ndcator of attack. RD n (t,p )= Z n (t,p )/ X t, p (6) If RD n (t,p ) > β, here, β s the threshold of the router, then the DDoS attacks are declared at the router. Whether attack traffc s aggregatve or not, t can be deterned by the rato of the ncong traffc devaton and the outgong traffc devaton at the port p. We defne Y(t,p ) as the outgong traffc fro port p n the t th ontorng cycle and ake a transforaton to t as follows. YT(t,p )= Y(t,p )-YYp (7) YY p s a paraeter of the outgong traffc to port p of the router. To attan accurate YY p, we also adopt estaton of ean and varance based adaptve CUSUM algorth to generate the paraeter. We defne Z out (t,p ) as the accuulaton of stochastc varable YT(t,p ) Z out (t,p )=ax{0,z out(t -,p )+ Y(t,p )- YYp } (8) Then the rato DR of I/O traffc devaton s, DR= Z out (t,p )/Z n (t,p ) (9) If DR>=, then the attack s aggregatve at the router. So, an alert packet s sent to the local CAT server. The Intra-Doan Attack Tree Constructon.The ntra-doan attack tree s constructed accordng to the antaned network topology and the alert packets fro all routers at the local CAT server n a ontorng cycle. Denote G as the copy of the local network topology. The router s the node n G. It contans the followng essages :{ R_ID, Weght, UP_NUM, UP_R, UP_R 2,, UP_R up_nu, DN_R}, where R_ID s the router ID. Weght s the edge weght between current router and downstrea router, UP_NUM s the nuber of upstrea routers, UP_R up_nu s the address of upstrea routers, and DN_R s the address of downstrea routers respectvely. The alert packet contans {R_ID, FLOW_ID, AttackTraffc}. They are the router ID - R_ID, flow ID - FLOW_ID, the attack traffc respectvely. Denote the address of the root n G as R 0, the beng processed node as R, the next beng processed node as Q, alert packet as P. CAT server starts the process fro the root R 0 n G. If current node s not a leaf, the chldren s essage s saved. A scannng for the alert packets s done to get whether any alert packets are fro the current router. If not found, the current node wll be reoved. Otherwse, the AttackTraffc n the alert packet s assgned to the feld Weght of current router. Repeatng the process to all the chldren nodes of R 0 tll the chld s leaf. The Inter-Doan Attack Tree Constructon. Havng constructed the ntra-doan attack tree at the CAT server of the nteredate network, the weght W of each ntra-doan attack tree s calculated at the CAT server to reduce the storage and coputaton overhead at the vct end, here, w( R, Rj) W=. An alert packet s sent to the CAT server at the vct end. The alert packet s a 4-tuple {AS_ID,UP_AS_ID,DN_AS_ID,W}, where AS_ID s the ID of current AS, UP_AS_ID s the 493

4 ID of upstrea AS, DN_AS_ID s the ID of downstrea AS, and W s the weght of ntra-doan attack tree. The nter-doan attack tree s constructed accordng to the alert packets fro upstrea CAT server of the vct end. Startng fro the AS of the vct end, f an AS s DN_AS_ID s equal to the vct s ID, the AS s added to the vct s chld. Then, startng fro the chld, all ASs wll be the chld s chldren f DN_AS_ID s equal to the chld s ID, and so on, tll all ASs nodes are dsposed. The weght W (AS, AS j ) of the edge between doan nodes AS and AS j s the weght of ntra-doan attack tree n AS doan. Havng constructed nter-doan attack tree at the vct end, the weght of the doan tree s calculated, whch s the su of the weght W of all edges. The su of weght W ndcates the attack traffc fro all routers. If W > γ, t s deterned that the vct end s suffered fro DDoS attacks. Then the vct end wll traceback dstrbutedly accordng to the nter-doan attack tree and the ntra-doan attack tree. Experental Results The proposed traceback schee s based on the detecton of DDoS attacks usng adaptve CUSUM at the router. Once the DDoS attacks are detected, the alert packet wll be sent, and then the attack tree s constructed, and the DDoS attacks source s found. An accurate coparson s done between the ID of current node and the DN_AS_ID of the chld node to deterne whether the current node adds nto the tree whle the nter-doan attack tree s constructed. So the constructon algorth wll not result n false postves. The constructon of the ntra-doan attack tree s based on the network topology. The router node wll be deleted f t ddn t send any alert packet. Whether the alert packet wll be arse at the router s deterned by the detecton rate of the adaptve CUSUM algorth and whether the false postves fro alert packet wll be arse s deterned by the false postves of the adaptve CUSUM algorth. So we test the detecton rate and false-postve rate of the adaptve CUSUM algorth at the router to evaluate the effectveness of the traceback schee. We use NS2 sulator and adopt real ISP topology downloaded fro the Rocketfuel project webste n Unversty of Washngton. Havng attaned and set all paraeters n our detecton schee A_CUSUM, we easure the detecton rate of UDP attacks and TCP attacks n, 2, 4,8,6 ISPs when the attack sources are dstrbuted randoly. We also study the trade-off between detecton rate and false-postve rate of UDP attacks. The detected results are shown as Fg., Fg. 2 and Fg. 3. Conclusons In ths paper, we proposed an overlay network based traceback schee aganst DDoS attacks. It doesn t need to probablstcally ark the packets or deternstcally ark the packets, so t avods the drawbacks: lack of scalablty; vulnerablty to packet polluton fro hackers and extraordnary challenge on storage space at vct or nteredate routers. Once the DDoS attacks are detected at the vct, the traceback request wll be sent to each CAT server of the nter-doan attack tree. Havng receved the traceback request, The CAT server begns to fnd the attack sources accordng to the ntra-doan attack tree and take easures to stop the DDoS attacks. Our schee pleents two-phase traceback aganst DDoS attacks. It s fast copared wth other schees whch traceback the attackers hop by hop. But the traceback te t costs needs to be easured further. In addton, our schee can not dstngush the DDoS attacks and flash crowds. These are needed to be solved n the future. 494

5 Fg. The Detecton Rate of UDP attacks Fg.2 The Detecton Rate of TCP attacks Fg.3 The Detecton Rate and False-Postve Rate of A_CUSUM Acknowledgeents Ths work was supported n part by the Doctoral Fund of Guangdong Medcal College wth Grant No. B and B202057, and the Zhanjang Muncpal Scence and Technology Bureau(Grant No.203B0089 and Grant No.203B0093)and by the Natonal Natural Scence Foundaton of chna under (Grant: ), the appled basc research projects of Yunnan Provnce under (Grant: KKSY , KKS ). References []Savage S, Wetherall D, Karln A, et al. Network Support for IP traceback. ACM/IEEE Transactons on Networkng, 9(3): (200) [2]Song D X, Perrg A. Advanced and Authentcated Markng Schees for IP Traceback. In: Proceedngs of 20th Annual Jont Conference on Coputer Councatons (INFOCOMM 200). Anchorage, Alaska,USA:IEEE Press, 2: (200) [3]Goodrch M T. Probablstc Packet Markng for Large-Scale IP Traceback. IEEE/ACM Transacton Network, 6(): 5-24.(2008) [4]Belenky A, Ansar N. IP Traceback wth Deternstc Packet Markng. IEEE Councatons Letters,7(4):62-64.(2003) [5]Lee T H, Huang T Y W, Ln I. A Deternstc Packet Markng Schee for Tracng Multple Internet Attackers IEEE Internatonal Conference on Councatons, 2005(ICC 2005). Seoul Korea:IEEE Press, (2005) [6] Xang Y, Zhou W L, Guo M Y. Flexble Deternstc Packet Markng: An IP Traceback Syste to Fnd the Real Source of Attacks. IEEE Transactons on Parallel and Dstrbuted Systes, 20(4): (2009) 495