Network Security Situation Evaluation Method for Distributed Denial of Service

Transcription

1 Network Securty Stuaton Evaluaton Method for Dstrbuted Denal of Servce Jn Q,2, Cu YMn,2, Huang MnHuan,2, Kuang XaoHu,2, TangHong,2 ) Scence and Technology on Informaton System Securty Laboratory, Bejng, Chna 2) Bejng Insttute of System and Engneerng, Bejng, Chna kngkey@sohu.com Abstract: -The measurement of network congeston and degradaton of qualty of servce durng dstrbuted denal of servce attacks remaned an elusve goal. Ths paper analyzes the mpacts that all congested lnks cause on attack vctm and network archtecture, ntroduces the mn-cut set and presents a new method to assess the network securty stuaton under DDoS attacks, whch computes the nfluence value that attacks cause on network securty stuaton accordng to the dstance between the congested lnk and vctm and whether the lnk s n the mn-cut set, and ths value s used for quanttatve stuaton assessment. The applcablty of ths method s verfed by smulated experments wth the network smulaton tool. Keywords:-DDoS attack securty stuaton lnk congeston degree metrc Introducton Dstrbuted Denal of servce (DDoS) s a major threat today. Its ntended effect s to prevent legtmate users from dong routne busness wth the vctm, by exhaustng some lmted resource va a packet flood or by sendng malformed packets that cause network elements to crash. Servce denal s experenced by users as a severe slowdown, servce qualty degradaton or a complete dsrupton of communcaton wth the vctm. There are many evaluaton methods have been researched, n order to analyze the securty stuaton under DDos attacks, and gude securty engneers to adopt effectve countermeasures. For example, there are the Vulnerablty Evaluaton Method, the Analyze of Survvablty, and the Securty Stuaton Evaluaton Method, etc. The Securty Stuaton Evaluaton Method s capable of descrbng the overall stuaton of the network, analyzng the development of securty stuaton, support to make patchng measurement, and consequently becomng a hotspot n network securty research area. In [] [2], the authors propose a Jont Drector of Laboratores Data Fusng Model, for appercevng network securty stuaton. They deploy many sensors n the testbed, use data fusng and data mnng to dentfy the adversary and the vctm, evaluate the network securty stuaton. In [3], the authors propose a Securty Stuaton Assessment and Response Evaluaton method base on the Bayes Network Model and Symbolc Probablstc Inference Algorthm. The algorthm can detect ongong large-scales network ntruson, dsplay the stuaton evaluaton result, and make effcent reacton. Current DoS measurement approaches are concerned for the partal of the target network or capture traffc measurement from the low level of the network. The performance data need to be expressed n terms of extractng from the raw data. And several factors must be syntheszed, and then deduce the entre network securty stuaton. The amount of data need to be captured and extracted s very large. It s a challenge to dsplay network securty stuaton n real tme. Other researchers frequently choose one DDoS mpact, whch they feel s the most relevant. Ths causes the results to be ncomplete, as each dsplays the aspect of the servce denal unlaterally. We propose an effectve approach to DDoS mpact measurement that reles on easy computng network traffcs. It deal wth large scale network, can dsplay the securty stuaton of the entre network. We present several metrcs that comprehensvely capture the DDoS mpact n a varety of test scenaros, n testbed expermentaton or n smulaton. And we experment on NS2[4] testbed under several DDoS attacks to valdate our prncples and algorthms. After experment, the prncples and algorthms are proved to be applcable for DDoS mpact evaluaton. 2 Securty stuaton nfluence analyss based on lnk congeston ISBN:

2 DDoS attacks work by usng a large number of compromsed hosts to drect a smultaneous attack on targets. Fgure. shows the typcal process of a DDoS attack. The attack scenaro provdes two mportant nformatons. Frst, the closer to the target, the fewer the number of the lnks there s, whch can be selected by the floodng packets. Second, the closer to the target, the more serous congeston the lnks are. adversary Master Nodes The followng two prncples s focus on these two factors. 2. Take Prorty of the Adjacent Lnk The lnks whch are adjacent to the vctms make greater mpact on the degradaton of qualty of servce durng DDos attacks. Frst, when the lnks adjacent to the server are congested, t s lkely that the DDoS attack s aganst the server. Second, the more lnks adjacent to the servce are congested; the more legtmate users are nfluenced from usng the servce. Daemon Nodes Network Target Server Daemon Nodes 2.2 Take Prorty of the Lnks n the Mn-cut Set The lnks whch are n the mn-cut set make greater mpact on the degradaton of qualty of servce than whch are not n the mn-cut set. Based on graph algorthms, when the lnk n the cut-set s congested, t makes the probablty of network parttonng even greater. So the lnk n the mn-cut set s more mportant than the lnks are not. Fg. A typcal DDoS attack scenaro Network can be mapped nto a connected graph, whch regards the router as the vertex, the physcal connecton between the routers as the edge. Assume that each applcaton server has a drect physcal connecton only wth one router. It s shown n Fgure 2. The graph s a drected graph, but some places are usng a non-drected graph approach for the convenence of presentaton. 3 The stuaton assessment for DDoS attacks Based on the securty stuaton analyss and prorty prncples of the lnk congeston, the securty stuaton model should be establshed usng graph algorthms, and then proposed the stuaton evaluaton algorthms based on the lnk congeston. The calculaton methods of the key evaluaton parameters should be descrbed subsequently. Fg 2. Network mappng relatonshp The purpose of DDoS attack s to consume the net bandwdth or servce resources, whch prevents legtmate users from dong routne busness. There are two mpacts on the network securty stuaton caused by the congested lnks. One s the mpact on the applcaton server, the other s the mpact on the network structure. 3. The Stuaton Model based on Graph Algorthms The parameters of network securty stuaton evaluaton are formally defned here. Frst, we defne the concept the Level of router and lnk. Defnton : The Router Level. It s the length of the shortest path between two routers. For example, n Fgure.2, the level of Router C relatve to Router A s 2, whle Router C relatve to Router B s. Defnton 2: The Lnk Level. It s the level of the lnk s ntal node. For example, the level of lnk <E,A>s equal to the level of Router E relatve to Router A, whch s 2. ISBN:

3 The parameters of network securty stuaton can be grouped nto two categores: the network statc structure NA and the network congeston stuaton N C. 3.. The Network Statc Characterstcs The Network Statc Characterstcs: N A. It contans the network dagram, mportant node set and the mn-cut set. N A s denoted by the trple-form N A =(G,V I,E C ). The statc characterstcs wll be recalculated only when the network structure changes. The network dagram: G= (V, E). Where V s the set of vertexes, E s the set of edges. The mportant vertexes set: V I. It ndcates the routers whch connect to the servers. The mn-cut set: E C. BFS algorthm [6] s mplemented by usng each server as a startng pont durng the changng of network structure, and the other nodes the shortest dstance wll be stored. In stuaton evaluaton, the lev(e,v j ) can be gotten through calculate the level of congested lnk e s startng router relatve to the server v The Stuaton Montorng Algorthm Assume that each router has the mechansm that can detect the congeston happens and calculate the degree of congeston. Once the degree of congeston on a partcular lnk exceeds the threshold ρ MAX, the montorng system wll report to the evaluaton center. When the number of congested lnks exceed the threshold ρ MIN, the network stuaton wll be recalculated. The algorthm s defned n Fgure The Network Congeston Stuaton The Network Congeston Stuaton N C. Manly refers to the congested lnks set and related functons. It s denoted by the fve-form: N C =(E J,lev(e,vj),ρ(e),δ(e,vj),λ(e)). N C s changed based on real-tme network congeston stutaon. The congested lnks set: E J. The functon about level: lev(e,v j ): e E J, v j V I. It descrbes the level of lnk e relatve to the node v j. The lnk congeston degree metrc: ρ(e) : e E J. It descrbes the congeston degree of lnk e. The dstance metrc: δ(e,v j ): e E J, v j V I.. It descrbes the nfluence of congeston lnk e on node v j. The structure metrc: λ(e): e E J. It descrbes the degree of the nfluence of congested lnk e on network structure. 3.2 The Evaluaton Algorthm based on Lnk Congeston Evaluaton algorthm based on lnk congeston s dvded nto three steps: ntal constructon, stuaton montorng and stuaton assessment The Intal Constructon Algorthm The statc characterstcs of the network are constructed n the ntal constructon phase. The network dagram constructon and the mportant node dentfcaton requre human nvolvement, and the mn-cut set s calculated usng the Stoer-Wagner algorthm [5]. The Input: raw network montorng data Output: the stuaton curve BEGIN DO every tme slot 2 IF some lnks e fulfll ρ(e) >ρmax and e not n EJ 3 Add each e n EJ 4 IF some lnks e fulfll ρ(e) ρmax and e n EJ 5 Delete each e from EJ 6 IF EJ >ρmax 7 Get current stuaton value S by callng algorthm 2 8 Append S to the stuaton curve END Fg 3. Montorng the network stuaton and calculatng the stuaton curve The Stuaton Evaluaton Algorthm As mentoned above, the nfluence of securty stuaton ncluded the degradaton of qualty of servce and the congeston of the network, whch wll be descrbed as follows. The lnk congeston nfluence on the degradaton of qualty of servce: S S. The dstance metrc can be calculated accordng to the dstance of a congested lnk to a server, and then multpled wth the degree of lnk congeston; at last the degree of the congested lnk nfluence on the server can be obtaned. It can be calculated usng (): s = δ ( e, v ) ρ( e ) () s e E J v j V I The lnk congeston nfluence on the network structure: S N. Accordng to whether a congested lnk s n the mn-cut set, the dfferent structure coeffcents multply wth the degree of lnk j ISBN:

4 congeston, then the degree of nfluence of the congested lnk on the network structure can be obtaned. It can be calculated usng (2): Input: network graph G, mport node set V I, edge cut set E C, congeston lnk set E J Output: stuaton value of the network BEGIN set ntal network stuaton S=0 2 FOR each e n E J 3 FOR each mportant v j n V I 4 compute the coeffcent e to v j :δ(e,v j ) 5 S=S+δ(e,v j ) ρ(e ) 6 compute the coeffcent e to network structure λ(e ) 7 S=S+λ(e ) ρ(e ) 8 RETURN S END s = λ( e ) ρ( e ) N e E J The overall network securty stuaton status can be calculated usng: S=S S +S N. The algorthm s shown n Fgure 4. (2) Fg 5. The abstracton of the router protocols In transacton duraton, we can capture all packets transferred from the router RA to lnk D, whch s denoted by λ n. Second, we can get the maxmum packets the router can transfers by checkng the user manual of the router, whch s denoted by λ max. Fnally, we get the value of the lnk congeston metrc ρ(d)=λ n / λ max The Dstance Metrc Ideally, DDos data floodng s generated from daemon nodes, congregated at the vctm n the last. Ths procedure can be descrbed as fgure 6. From the fgure, we can deduce that the nearer the data are transferred to the vctm, the fewer router paths that there are. In deally DDos data floodng scenaro, the number of router paths s depend on two parameters. One s the dstance; the other s the node attack degree. X Fg 4. Quanttatvely analyzng the stuaton value of the network The mpact of network securty stuaton caused by network congeston s the negatve ncome of stuaton. Therefore, the larger S value s, the worse the network securty stuaton s, whereas the stuaton s better. 3.3 DDoS Metrcs In the algorthm mentoned above, the lnk congeston degree, the dstance and the network structure are three mportant DDoS mpact metrcs n the securty stuaton evaluaton The Lnk Congeston Degree Metrc The lnk congeston degree metrc s defned as the bytes transferred nto the router dvde the maxmum bytes the router can transfers. Let s abstract the router protocol usng the method descrbed n the fgure 5. A, B and C are three nput lnks of the router RA. Packets transferred from A and B wll route to the output lnk D, arrve at the router RB. The other output lnks of RA s denoted by X. Fg 6. DDos data floodng scenaro n deally The node attack degree s dfferng from the concept orgn from the graph algorthms. It only contans the nodes that have processed malcous traffc. So, we only take care of the paths that the malcous data are transferred. From the node attack degree, we can compute the average node attack degree, whch s denoted by Avgdeg ddos. For the frst layer of routers n network topology, when data are arrved, the number of the routes that the data can be transferred s Avgdeg ddos -. In the same way, we get (3). ISBN:

5 δ ( e, v j ) = (3) lev( e, ) ( deg ) v Avg j Now, we need to know how to calculate the average node attack degree: Avgdeg ddos. Approxmately, the congested router s consdered as the paths that the malcous data are transferred. In hypothess, there are exsted some proporton of malcous data around the congested routers, the proporton of malcous data s denoted by k. We can use the followng method to calculate the average node attack degree. The average node attack degree of the entre congested routers s denoted by Avgdeg. The number of the congested routers that have been calculated s denoted by num. When there s new router has been congested, we can get the degree of ths router. And then, we calculate the average attack degree of ths router, whch s denoted by deg. After some tme statstc, we get the average node degree under DDos attack. And then we calculate the average attack degree usng (4). Avg deg num+ deg Avg deg = k Avg deg= k (4) ddos num The Structure Metrc We have defned the mn-cut set before, and denoted by E C. If the lnk n the mn-cut set s congested, the value whch expresses the contrbuton that the congested path wll cut the entre network nto two subnets s / E C. The contrbuton value s the parameter that congested lnks exst n the mn-cut set. When a congested lnk exsts n more than one mn-cut set, we choose the bggest value of the / E C. The number of all graph edges s denoted by E. When a congested lnk does not exst n the mn-cut set, we use / E expresses the contrbuton that the path mpact on the network structure. Then we get (5). e E j EC EC λ( e ) = { e E j EC E (5) 4 Experment Analyze 4. Descrpton of Experment In ths secton, we descrbe the topology and traffc scenaros n the NS2 testbed that we employ to llustrate our algorthm. The expermental topology s shown n Fgure 7. It conssts of three clent networks and each network s nterconnected va two routers. Each clent ddos network has four routers. The vctm servers are connected to router F and G. The label on the edge n the topology s the maxmum data process rate of the path. In Fgure 7, we only consder the edges that exst n mncut set E C = {(C,I),(H,J)}.We get the average node degree s /3, and use ths value as the average attack degree. The lnk congeston metrc ρ s. 4.2 Experment Result Fg 7. Expermental topology 4.2. Experment : Valdate the Prncple that Take Prorty of the Adjacent Lnk DDos attack scenaro : The floodng data s generated by node A. The data wll be processed by node B and D. And the node G s the target. At the same tme, the floodng data s generated by node L. The data wll be processed by node I. And the node F s the target. The data transfer rate s 2.8Mb/s, whch cause the forane lnks congeston. DDos attack scenaro 2: The floodng data s generated by node E. And the node G s the target. The data transfer rate s 4.5Mb/s, whch cause the adjacent lnks congested. Table. Lnk VALIDATE THE PRIORITY PRINCIPLE OF THE ADJACENT LINK Level on Qos F G on structure <A,D> <A,B> <L,I> Gener al <E,G> After experment,we get that for the lnks whch have the same congeston metrcs, the lnks whch far ISBN:

6 away from the vctm make less mpact on the degradaton of qualty of servce durng DDos attacks Experment 2: Valdate the Prncple that Take Prorty of the Lnks n the Mn-cut Set. DDos attack scenaro 3: The floodng data s generated by node B. The data wll be processed by node E. And the node G s the target. The data transfer rate s 5.6Mb/s, whch cause the lnks whch are not n the mncut set congeston. DDos attack scenaro 4: The floodng data s generated by node J. The data wll be processed by node H. And the node F s the target. The data transfer rate s 5.6Mb/s, whch cause the lnks whch are n the mn-cut set congested. Table 2. Lnk VALIDATE THE PRIORITY PRINCIPLE OF THE LINKS IN THE MIN-CUT SET Level on Qos F G on structure <B,E> <E,G> <J,H> Gener al.68 2 <H,F> After experment 2,we get that for the lnks whch have the same dstance to the vctm, the lnks whch are n the mn-cut set, make greater mpact on the degradaton of qualty of servce durng DDos attacks than the lnks whch are not n the mn-cut set. 5 CONCLUSION Ultmately, DDoS attacks are about create network congeston and denyng end user servce. We propose the network securty stuaton evaluaton method for DDos measurement. The method bulds network model ntroduces graph algorthms, base on the prncples that the lnks whch are adjacent to the vctm and n the mncut set have more mpact on the degradaton of qualty of servce durng DDos attacks, and can get the lnks congeston mpact on the degradaton degree of securty stuaton. It can work out large-scale network securty stuaton and reduce the data processng tme. At last, we use NS2 testbed valdate the theores and algorthms mentoned n the paper. We beleve there s much more work to be done n developng effectve methods for DDoS technology evaluaton. We wll research how to use the Analytc Herarchy Process [7] base on ths method n the future. References [] Bass T, Muhsensor data fuson for next generaton dstrbuted ntruson detecton systems, 999 IRIS Natonal Symposum on Sensor and Data Fuson, Laurel, 999. [2] Bass T, Intruson detecton systems and multsensor data fuson: Creatng cyberspace stuatonal awareness, Communcatons of the ACM, 2000, 43(4): [3] D Ambroso B, Takkawa M, and Upper D, et a. Securty Stuaton Assessment and Response Evaluaton(SSARE), DARPA Informaton Survvablty Conference & Exposton II [4] The network smulator-ns2, [5] Stoer M, Wagner F, A smple mn-cut algorthm, Journal of the ACM, 997, 44(4): [6] Robert Sedgewck, and Kevn Wayne, Algorthms FOURTH EDITION, Addson-Wesley, US: Prnceton Unversty, 20. [7] Satty T L, How to Make a Decson:The Analytc Herarchy Process, European Journal of Operatonal Research, 990, (48):9-26. ISBN: