Embed Size (px)
Citation preview
Scalable Denial of Service Attack Prevention on the Internet
Kihong Park Hyojeong Kim Bhagya BethalaNetwork Systems Lab
Department of Computer SciencesPurdue University
Team: Ali Selcuk, Humayun Khan, Heejo Lee
Outline
Background & set-up [Kihong Park]
Proactive & reactive protection performance [Bhagya Bethala]
Network security tools [Hyojeong Kim]
Network Security Projects at NSL
Scalable defenses for:Distributed denial of service (DDoS) attack prevention
Virus/worm attack prevention
Supported by:
Distributed DoS Attack
Source localization or traceback
Internet
e.g., TCP SYN flooding
serverbandwidth
...
→ spoofing: forge IP source address
→ hinders source localization & delays reactive response
→ more and more against network infrastructure
Virus/Worm Attack
0
20000
40000
60000
80000
100000
120000
0 5 10 15 20Hours
# of
infe
cted
hos
ts
Code Red
Sapphire
David Moore ([email protected])
Solution Approach
DDoS: route-based filtering
Virus/worm: content-based filtering
Where are you coming from? “unde venis”
→ if the packet lies, discard
Where are you headed? “quo vadis”
→ if the packet contains worm/virus, discard
router
Objective
Containment DDoS: prevent attack packets from reaching their targets in the first placeWorm/virus: stop spreading in its tracks→ proactive protection
TracebackDDoS: when infeasible to do so, locate attack sourceWorm/virus: adapt to new viruses→ reactive protection
Key Issue
Partial deployment & effective placement
Internet topology
→ distributed filtering vs. local filtering (aka firewall)
Performance Evaluation
Internet Connectivity: Power-law Nature
Key features exploited by placement strategyBias toward high degree nodes→ locally star-like topology→ efficiency→ simple
Power-law Connectivity
Power-law vs. random graph
kkx −≈= 2])Pr[deg(α−≈= kkx ])Pr[deg(
Demo: DDoS Attack Configuration attacker
victim
filter
Demo: Without DPF - Snapshot 1 lowmedhigh
Demo: Without DPF - Snapshot 2 lowmedhigh
Demo: With DPF - Snapshot lowmedhigh
Results: DDoS Attack
Protection Traceback~99%
4 or less
Worm Attack: Containment Pockets
Containment Pocket: Definition
Locally ContainedPocketFilter
Infected Node
Worm Attack: Containment Pockets
Worm Attack: Containment Pockets
Worm Attack: Containment Pockets
Results: Worm Attack
Tools and System Building
Dynamic DPF Simulator
Built using DaSSFNetDaSSF
Scalable simulation on workstation clusters
DaSSFNetC++ SSFNet with improved synchronization
Parallel DML support
Collaborative effort with David Nicol (DaSSF PI)
Dynamic DPF SimulatorKey Extensions
Protocol stack:DPF-lookup, IP, TCP, UDPBGP-4, DPF-updateAttack configuration, traffic generation suiteMeasurement subsystem
Meta-DMLAutomatic DML script generation
Topology-aware partitioning scheme
Trace-driven visualization tool
Dynamic DPF Simulator: Architecture
{attackers, traffic generators, fault generators, …}
CBR, Poisson, self-similar, MMPP, file transfer
Link Layer
DPF Lookup
IP
TCP UDP
Socket API
BGP DPF Update
Applications
DaSSF Kernel
MPI
DML
Protocol Stack
Meta-DMLTopology
Protocol Stack
Attack Configuration
Network Partition
Dynamic DPF Simulator: Demo
without DPF
Network Topology300-node subgraph of 1997 Internet AS topology
DDoS Attack Configuration106 attackers / 1 victimIP source address spoofing
Filter deployment15 nodes (5%)
TimelineSetup: BGP & DPF convergenceSynchronized AttackAttack Duration: 4.0 sec
with DPF
Memory and Speed-up Benchmarks
Workstation clusterx86 PCs, 2 GHz, 1 GB, Linux 2.4+DaSSFNet, MPI
Memory and Speed-up Benchmarks
Nov. 1997, 3023-node Internet AS topology10 machines
Memory and Speed-up Benchmarks
Nov. 1997, 3023-node Internet AS topology10 machines
Network Processor Prototyping
7-node Intel IXP1200 NP testbedTeja development environment
Abilene/Internet2 Connectivity
Conclusion
DDoS attack/Internet Worm attack constrained by Internet connectivity
Distributed Packet Filteringexploits Internet connectivity
Effective performance with strategic/partial placementScalable simulation tool for evaluating time dynamicsNetwork processor based prototype system
http://www.cs.purdue.edu/nsl
