Active Internet Traffic Filtering to Denial of Service Attacks from Flash Crowds

Active Internet Traffic Filtering to Denial of Service Attacks from Flash Crowds S.Saranya Devi 1, K.Kanimozhi 2 1 Assistant professor, Department of Computer Science and Engineering, Vivekanandha Institute of Engineering and Technology for Women,Namakkal. e-mail: saranyadev27@gmail.com 2 Assistant professor, Department of Computer Science and Engineering, Vivekanandha Institute of Engineering and Technology for Women, Namakkal. e-mail: kanisabitha@gmail.com Abstract Network security is a specialized field in the computer networking that involves securing a computer networks infrastructure. Network security consists of the provisions made in an underlying computer network infrastructure, policies adopted by the network administrator to protect the network and the network-accessible resources from unauthorized access, and consistent and continuous monitoring and measurement of its effectiveness combined together. In recent survey a major challenge in network security is Distributed Denial of Service attacks. DDoS poses a critical threat to the internet. To discriminate this DDos attacks from flash crowds attacks is a tough problem for researchers because the similarity between the attack flows and traffic flows are very close to each other. Hence we propose a similarity based detection method to differentiate between the DDoS attack flows and the genuine traffic flows. In this paper detection method is proposed to find the similarity between the network flows using flow correlation coefficient. The performance of proposed method proved the detection method and confirmed the effectiveness of discrimination method. Keywords- DDoS, Flash Crowd, Botnet, Similarity, Discriminate. I. INTRODUCTION Network security has emerged as a challenging field in computer networking. A network security system typically relies on layers of protection and consists of multiple components including continuous network monitoring and security software in addition to hardware and appliances. All components work together to increase the overall security of the computer network. A major problem in network security is Distributed Denial of Service. A recent survey [1] of the 70 largest Internet operators in the world demonstrated that DDoS attacks have increased dramatically in recent years. A distributed denial-ofservice (DDoS) attack is one in which a multitude of compromised systems or botnets attack a single target, thereby causing denial of service for users of the targeted system. The flood of incoming messages to the target system essentially forces it to shut down, thereby denying service to the system to legitimate users. A botnet is a collection of internet-connected programs and it participates in distributed denial-of-service attacks. Further-more, in order to sustain their botnets, bot masters take advantage of various techniques to disguise their traces. One of the techniques is flash crowd mimicking [2], [3]. Flash crowds are unexpected, but legitimate, dramatic surges of access to a server, such as breaking news. One powerful strategy for attackers is to simulate the traffic patterns of flash crowds. This is referred to as a flash crowd attack. To address these problems, we propose a new discrimination detection method to differentiate between the DDoS attack and flash crowd attack. We observed that the DDoS attack flows use controlled functions to pump attack packages to the victim, therefore, the attack flows to the victim are always share some properties, e.g. packages distribution behaviors, which are not possessed by flash crowd flows in a short time period. Based on this observation, once there appear suspicious flows to a server, we start to calculate the distance of the package distribution behavior among the suspicious flows. If the distance is less than a given threshold, then it is a DDoS attack, otherwise, it is a flash crowd attack. The proposed detection system has detected attacks in routers using trace back algorithm which continually calculates information distances and so the router will stop forwarding the traffic from the attacker immediately. 39

II. DEFINITIONS AND ANALYSIS ON PROPOSED METHOD In this section, we begin by presenting a number of preliminary definitions, and then discuss the analysis of proposed method. Definition 1 (Network Flow). For a given router in a local network (e.g., a community network as in Fig.2.1), we cluster the network packets that share the same destination address as one network flow. Fig. 2.1. A sample community network with network flows. For example, if the length of a given network flow Xi is N, then the network flow can be expressed as follows: -------(1) According to our definition of flow, a router may have many network flows at any given point in time. Definition 2 (Flow Correlation Coefficient). Let Xi and Xj (i j) be two network flows with the same length N. We define the correlation coefficient of the two flows as respectively. The local traffic of is the traffic generated from its LAN, the forward traffic of is the sum of its local traffic and the traffic forwarded from its immediate upstream routers. Distance based routing The proposed detection system has detected attacks in routers and then the proposed trace back algorithm calculates information distances based on variations of their local traffic and the forward traffic from their immediate upstream routers. If the proposed detection system finds that there are no attacks in LAN and router, then the proposed algorithm calculates continually information distances based on variations of their traffic flows. If it find there is an attack (zombie) in LAN so the router will stop forwarding the traffic from the attacker immediately. This paper is organized as follows; related work is briefed in section III. Similarity based detection method and flow correlation coefficient calculation is presented in section IV. The result is discussed in section V. Section VI concludes the work with suggestion of future work. III. RELATED WORK Researchers proposed a number of IP trace back approaches to identify attackers. Chao Gong and Kamil Sarac have proposed two major methods for IP trace back, the probabilistic packet marking (PPM) and the deterministic packet marking (DPM) [4]. -------(2) The flow correlation coefficient is used to indicate similarity between two flows. TRACE BACK OPTION IP trace back is the ability to find the source of an IP packet without relying on the source IP field in the packet, which is often spoofed. We combine our DDoS attacks detection metric with IP trace back algorithm to form an effective collaborative defense mechanism against network security threats in Internet. In hop-by-hop IP tracing, the more hops the more tracing processes, thus the longer time will be taken. In order to convenience for IP trace back algorithm analysis, we classify two types of traffic, local traffic and forward traffic, Both of these strategies require routers to inject marks into individual packets. Moreover, the PPM strategy can only operate in a local range of the internet (ISP network), where the defender has the authority to manage. However, this kind of ISP networks is generally quite small, and we cannot trace back to the attack sources located out of the ISP network. The DPM strategy requires all the Internet routers to be updated for packet marking. However, with only 25 spare bits available in as IP packet, the scalability of DPM is a huge problem. Moreover, the DPM mechanism poses an extraordinary challenge on storage for packet logging for routers. IP trace back methods should be independent of packet pollution and various attack patterns. In the previous work, on 40

DoS attack detection, compare the packet number distributions of packet flows, which are out of the control of attackers once the attack is launched, and the similarity of attack flows is much higher than the similarity among legitimate flows, e.g., flash crowds. The work of discriminating DDoS attacks from flash crowds has been explored for around a decade. Previous work [2], [5], [6] focused on extracting DDoS attack features, and was followed by detecting and filtering DDoS attack packets by the known features. However, these methods cannot actively detect DDoS attacks. Xie and Yu tried to differentiate DDoS attacks from flash crowds at the application layer based on user browsing dynamics [7], [8]. The current most popular defense against flash crowd attacks is the use of graphical puzzles to differentiate between humans and bots. This method involves human responses and can be annoying to users [9]. Oikonomou and Mirkovic tried to differentiate the two by modeling human behavior. These behavior-based discriminating methods work well at the application layer. However, we have not seen any detection method at the network layer, which can extend our defense diameter far from the potential victim [10]. Wang et al. have even implemented a peer-to-peer-based bot net for research purposes. There are a number of reports on the size and organization of bot nets. Bots are caught by honey pots and analyzed thoroughly via inverse engineering techniques. Botnet infiltrations are further implemented [2]. As a result, there is no effective and efficient method to deal with this issue so far. Based on this observation, we found that the similarity among the current DDoS attack flows is higher than that of a flash crowd. Therefore, we propose a similarity based detection method using the flow correlation coefficient to actively detect DDoS attacks in an efficient manner. IV. SIMILARITY BASED DETECTION METHOD In this section, we present the similarity-based detection method against flash crowd attacks. For a given community network, we set up an overlay network on the routers that we have control over. We execute software on every router to count the number of packets for every flow and record this information for a short term at every router. Under this framework, the requirement of storage space is very limited and an online decision can be achieved. A real community network may be much more complex with more routers and servers. However, for a given server, we can always treat the related community network as a tree, which is rooted at the server. We must point out that the topology of the community network has no impact on our detection strategy, whether it is a graph or a tree, because our detection method is based on flows rather than network topology. Once an access surge on the server occurs, our task is to identify whether it is a genuine flash crowd or a DDoS attack. According to our proposal, when a possible DDoS attack alarm goes off, the routers in the community network start to sample the suspected flows by counting the number of packets for a given time interval, for example, 100 milliseconds. When the length of a flow, N, is suitable, we start to calculate the flow correlation coefficient between suspected flows. S uppose we have sampled M network flows, X1, X2;...,XM, therefore, we can obtain the flow correlation coefficient of any two network flows, Xi(1 i M) and Xj(1 j M,i j).let I Xi,Xj be an indicator for the similarity of flow Xi and Xj, and I Xi,Xj has only two possible values: 1 for DDoS attacks and 0 otherwise. Let δ be the threshold for the discrimination, then we have -------(3) where 1 i, j M, and i j. In general, we may have more than two suspected flows in a community network. This means we can conduct a number of different pair wise comparisons, and the final decision can be derived from them in order to improve the reliability of our decision. 41

We can, therefore, have an integrated DDoS attack positive probability as follows: -------(4) where IA is the indicator for DDoS attacks, and I A =1 represents positive for DDoS attacks. We can set a threshold δ (0 δ 1) for our global judgment, therefore, we make our final decision with global information as follows: -------(5) The value of δ has an impact on our detection accuracy. For example, if δ =0.6, then it is a DDoS attack if at least 60 percent of the comparisons are positive. Let us consider a sample network with DDoS attack. In a DDoS attack scenario, as shown in figure.4.1 the flows with destination as the victim include legitimate flows, such as f3, and a combination of attack flows and legitimate flows, such as f1 and f2. Compared with non attack cases, the volumes of some flows increase significantly in a very short time period in DDoS attack cases. based on the information of flow entropy variations, and therefore, we can identify the locations of attackers. The trace back can be done in a parallel and distributed knowledge of entropy variations, the victim knows that attackers are somewhere behind router R1, and no attackers are behind router R2. Then the trace back request is delivered to router R1. Similar to the victim, router R1 knows that there are two groups of attackers, one group is behind the link to LAN0 and another group is behind the link to LAN1. Then the trace back requests are further delivered to the edge routers of LAN0 and LAN1, respectively. Based on entropy variation information of router R3, the edge router of LAN0 can infer that the attackers are located in the local area network, LAN0. Similarly, the edge router of LAN1 finds that there are attackers in LAN1; further there are attackers behind router R4. The trace back request is then further passed to the upstream routers, until we locate the attackers in LAN5. V. RESULT AND DISCUSSION In this section we demonstrate the effectiveness of proposed detection method. To effectively discriminate DDoS attack from flash crowd attack, we have to do router configuration. In router configuration, first we have to start trace back router server and set the route from source to destination, thereby routers are configured. Now we can able to start communication between client and server. Figure 4.1 A sample network with DDoS attacks. Observers at routers R1, R4, R5, and V will notice the dramatic changes; however, the routers who are not in the attack paths, such as R2 and R3, will not be able to sense the variations. Therefore, once the victim realizes an ongoing attack, it can push back to the LANs, which caused the changes If the data sent through predefined route, then there is only legitimate flow otherwise it is DDoS attack. Thus if there appear any suspicious flow to server, we start to calculate the distance of the package distribution behavior among the Suspicious flows. If the distance is less than a given threshold, then it is a DDoS attack, otherwise, it is a legitimate accessing as shown in the figure 5.1. Finally if DDos attack was detected, then we have to find the location of the attacker by using trace back route algorithm and so the router will stop forwarding the traffic from the attacker immediately. 42

Fig 5.1 Detecting DDoS attacks VI. CONCLUSION AND FUTURE WORK In this paper, we proposed to discriminate flash crowd attacks from genuine flash crowds, which is a tough and open problem for researchers. We used the flow correlation coefficient as a metric to measure the similarity among suspicious flows to differentiate DDoS attacks from genuine flash crowds. We theoretically proved the feasibility of the proposed detection method, and our experiments confirmed the effectiveness of the proposed detection method. And the results proved that similarity based detection method is appropriate one. For future work we are considering that once our detection strategy is known to attackers, they may develop new strategies to disable our detection. It is necessary to explore which actions should we take against attackers actions. [3] Scherrer, N. Larrieu, P. Owezarski, P. Borgnat, and P. Abry, Non- Gaussian and Long Memory Statistical Characterizations for Internet Traffic with Anomalies, IEEE Trans. Dependable Secure Computing, vol. 4, no. 1, pp. 56-70, Jan.-Mar. 2007. [4] Chao Gong, University of Texas at Dallas, USA and Kamil Sarac, University of Texas at Dallas, USA IP Traceback based on Packet Marking and Packet Logging. 2000. [5] G. Carl, G. Kesidis, R. Brooks, and S. Rai, Denial-of-Service Attack- Detection Techniques, IEEE Internet Computing, vol. 10, no. 1, pp. 82-89, Jan./Feb. 2006. [6] Y. Chen and K. Hwang, Collaborative Detection and Filtering of Shrew DDoS Attacks Using Spectral Analysis, J. Parallel Distributed Computing, vol. 66, no. 9, pp. 1137-1151, 2006. [7] Y. Xie and S.-Z. Yu, A Large-Scale Hidden Semi-Markov Model for Anomaly Detection on User Browsing Behaviors, IEEE/ACM Trans. Networking, vol. 17, no. 1, pp. 54-65, Feb. 2009. [8] Y. Xie and S.-Z. Yu, Monitoring the Application-Layer DDoS Attacks for Popular Websites, IEEE/ACM Trans. Networking, vol. 17, no. 1, pp. 15-25, Feb. 2009. [9] S. Kandula, D. Katabi, M. Jacob, and A. Berger, Botz-4-Sale: Surviving Organized DDoS Attacks that Mimic Flash Crowds (Awarded Best Student Paper), Proc. Second Symp. Networked Systems Design and Implementation (NSDI 05), 2005. [10] G. Oikonomou and J. Mirkovic, Modeling Human Behavior for Defense against Flash-Crowd Attacks, Proc. IEEE Int l Conf.Comm., 2009. REFERENCES [1] Arbor, IP Flow-Based Technology, http://www.arbornetworks.com, 2011. [2] J. Jung, B. Krishnamurthy, and M. Rabinovich, Flash Crowds and Denial of Service Attacks: Characterization and Implications for CDNs and Web Sites, Proc. 11th Int l Conf. World Wide Web (WWW), pp. 252-262, 2002. 43