Real-time DDoS Defense - University of Bonn...6% No 60% Plan of use of automatic mitigation and...

Real-time DDoS Defense:A collaborative Approach at

Internet Scale

Agenda

3rd July 2015 Jessica Steinberger: Real-time DDoS Defense: A collaborative Approach at Internet Scale2

Problem & Goal

Overview

Challenges

Implementation

Evaluation

Conclusion

Insight

Discussion

Problem & Goal

Problem

Source: https://www.youtube.com/watch?v=kBBIqKeVdDo

Problem

network-traffic

Problem

mitigation and reaction

3rd July 2015 Jessica Steinberger: Real-time DDoS Defense: A collaborative Approach at Internet Scale7 Source: https://www.gallaudet.edu/rsia/world_deaf_information_resource.html

Ingredients

Source: http://www.mitnatur.com/wp-content/uploads//2013/11/Kochen.jpg

InsightOverview

ChallengesImplementation

Evaluation

Insight

RQ1: Is real-time and automatic mitigation at ISP level performed and if yes, how?

Insight

May – July 2014

Online

52 4256 47

November – December 2012

Source: http://www.pieuvre.ca/v2/wp-content/uploads/2010/01/survey.jpg

Real-time and automatic mitigation

Europe93%

North America

Asia5%

Origin

10,00%

15,00%

20,00%

25,00%

30,00%

35,00%

Market segment and frequency

16. February 2015 Jessica Steinberger: Give and Take - Mitigation and Response: A collaborative approach11

• Process and involved third-parties

• ISPs and CSIRTs

• to aid NOC

• by email or telephone

Yes37%

Unsure3% Agree

Disagree17%

Use of automatic mitigation and response tools

Yes37%

Unsure3%

Plan of use of automatic mitigation and response tools

Yes, we are planning to do it We are looking into it

No, we will not make use of it I am not aware of it

Rerouting traffic Change blocking/ filter

capabilities

Notification Rate limiting atingress

Exchange datawith trusted

partners

Quarantinemachines

Changing thetarget's IP

address

Automatic actions of mitigation and response tools

Actions already performed Actions would like to use

Yes48%No

IP traffic filtering

Blacklists53%

Whitelists29%

Greylists18%

IP traffic filtering

Netconf SNMP OpenFlow Other

Network configuration protocols

Yes29%

13%10%

Current technical ability to use OpenFlow / Plan to make use of

OpenFlow in 3 years

Yes, we are planning to do it We are looking into it

No, we will not make use of it I am not aware of it

None Various CERTs or CSIRTs Law enforcement orgovernmental entities

Industry peers Only receive data

Sharing threat indicators or security events / incidents

Threat indicators Security events/incidents

Strongly agree53%

Agree43%

Disagree4%

Collaboration improves mitigation and response capabilities

SCAP IDXP IDMEF IODEF x-arf

Exchange protocols / formats

Do or did use Know Heard of Unknown

Ingredients

InsightOverview

Evaluation

Terminology

Format Protocol

Source: http://www.mifus.de/out/pictures/master/product/1/8000796013248_simba_sechs_sandformen.jpghttp://www.bluesource.at/2013/11/bluesource-enewsletter-november-2013/

Terminology

Security Event/Incident

Incident

Alert/Event

Alarm/

Warning

Terminology

IncidentEvent

Chance Card

Source: http://www.hasbro.com/monopoly/de_DE/ Source: http://www.bitstorm.org/journaal/2005-6/grolsch.jpg

Application Domain

Source: http://makingsecuritymeasurable.mitre.org/about/index.html

Who is involved ?

• US governments Defense Advance Research Projects Agency (DARPA)

• TERENA• IETF Incident Handling• Stuttgart University‘s CERT• IETF IDWG• MITRE• IETF MARF• Eco – Association of the German

Internet Industry

Source: http://m.crosstalkonline.org/media/cache/54/c8/54c83f7398d4ee4bece7c84e899c8a64.jpg

Timeline

1997CISL

2001IODEF

TERENA

2002IODEF

IETF INCH

2003FINE

IETF INCH

2003IODEF

IETF INCH2002CAIF

University Stuttgart CERT

2003IDMEF

IETF IDWG

2009CEE

2005ARF

2007ARF

IETF MARF

2012x-arf

Eco-Association of the German Internet Industry

2013x-xarf

Kohlrausch & Übelacker

2013Project DMTF Cloud Audit

or Project Lumberjack

Exchange formats

CISL IODEF CAIF IDMEF CEE ARF x-arf/x-xarf syslog

Language S-expressions XML XML XML XML, JSON MIME MIME Text/XML

Content Events, Attacks,Responses

Events,Incidents

Problem, Vulnerability, Exposure

Alerts, Alive messages

Events Spam Incidents, Attacks

Events

Producer Machine Human Human Machine Machine Machine Machine Machine

Consumer Machine Human Human Machine Human Machine/Human

Machine/Human Machine/Human

IODEF vs. IDMEF

ARF vs. x-xarf

Exchange formats and protocolsProtocol OSI layer Format Security

CIDF Transport CISL message SymmetricCryptography

RID Application IODEF TLS

XEP-0268 Application IODEF TLS

IDXP Application IDMEF TLS

CLT Transport CEE Provided by syslog(RFC 5425)

SMTP Application CAIFARFx-arf

NoneS/MIMEMultipart/SignedMultipart/Encrypted

Syslog (RFC 3164) Transport Syslog (RFC 3164) None

Syslog (RFC 5425) Transport Syslog (RFC 5424) TLS

Evaluation results

Ingredients

InsightOverview

Evaluation

Challenges

„rogue ISPs“ Quantifying cost/benefit

FPRisk

Source: http://www.lowcarb-ernaehrung.info/

Source: http://whiteboard-ratgeber.de/wp-content/uploads/2013/04/digitales-whiteboard-vs-tafel.jpg

Ingredients

InsightOverview

Evaluation

Framework

Inference Engine (PHREAK)

Mitigation and Response System

Production Memory (rules)

Working Memory (facts)

Pattern Matcher Agenda

Event producer

sends consumes publishes

subscribes

delivers

Incident consumer

Pattern Matcher

Event Processing Response Selection

Reaction Execution

Knowledge Base

Event Processing

Normalization Aggregation / Correlation

Event Pattern Frequency of event in a time window

Geolocation IP Filtering Lists Confidence

Response Selection

Comparison Prioritation

Previous Reactions Potential damage

Benefit Risk CVSS Event profiles

Reaction Execution

Notification

Configuration Exchange formats

Email Pub/Sub Consumer

Flow-based Event Exchange Format (FLEX)

Ingredients

InsightOverview

Evaluation

Evaluation Methodology

Source: http://www.microgen.com/uk-en/products/microgen-aptitude/v4/microgen-aptitude-business-it-collaboration

Ingredients

InsightOverview

Evaluation

Conclusion

• insight into processes, structures and capabilities

• a hands-on for network operators

Conclusion

• FLEX

• framework

Discussion

Source: http://www.prosperitycometh.com/wp-content/uploads/2012/11/business_conference_1600_clr_3835.png

Real-time DDoS Defense - University of Bonn...6% No 60% Plan of use of automatic mitigation and...

Documents

DDoS Threats Landscape : Countering Large-scale DDoS attacks

DDoS hybrid protection - rsnog.rs · DDoS protection system –Hybrid solution •Telenor hybrid DDoS protection is based • Local netflow based DDoS protection segment • Cloud

(D)DOS DEMYSTIFIED - OARnet...DDoS Attack Customers DDoS Attack Volumetric Protection Cloud ISPa ISPb L3-4 DDoS mitigation DDoS Platform DDoS Platform L7 DDoS mitigation SSL Termination

DDoS Protection Protecting Against The DDoS Attacks Since 2007

DDOS REPORT | 2019 Global DDoS Threat Landscape · Global DDoS Threat Landscape DDOS REPORT | 2019. 2 2019 oa DDoS Trea acape Repor Contents 01 Highlights 02 Overview 03 Network layer

PLNOG15 :DDOS Attacks & Collateral Damage. Can we avoid it? Asraf Ali

SCALABLE PROTECTION AGAINST DDOS AND WORM ATTACKS · (DDoS) and worm attacks. We advance new solutions aimed at providing scalable defenses against these potentially debilitating

The Elknot DDoS Botnets We Watched - Virus Bulletin · The Elknot DDoS Botnets We Watched Ya Liu, ... C2 communication from Netflow data ... –even together with other DDoS botnet

A Taxonomy of DDoS Attack and DDoS Defense Mechanisms

DDoS Mitigation Support on CGSE - Cisco...DDoS Mitigation Support on CGSE Distributeddenial-of-service(DDoS)attackstargetnetworkinfrastructuresorcomputerservicesresources

Performance Analysis of a system during a DDoS …In this report, we provide a general overview of DDoS attacks and its prevention measures. Additionally, we simulate a DDoS attack

SCALABLE PROTECTION AGAINST DDOS AND WORM ATTACKS · 2004-04-09 · (DDoS) and worm attacks. We advance new solutions aimed at providing scalable defenses against these potentially

We refresh Bonn. · 2019-11-15 · Bonn. SWB Energie und Wasser online stadtwerke-bonn.de bonn-spart-besser.de Free service line Phone: 0800 1 011700 Monday through Friday 8 am –

DDoS Attack: Who is at risk?Our DDoS detection tools identify attacks based upon unexpected traffic patterns. During mitigation, we will redirect attack packets and allow legitimate

DDoS Saldırı Analizi - DDoS Forensics

DDoS Attacks 101 - Vistnet DDoS Protection & Mitigation ...€¦ · DDoS Protection Company V DDoS Attacks 101 eserved. 7 In the meantime the quality of DDoS attack software is improving;

Datasheet: DDoS Protection - Grayhats Datasheet DDoS...or OpenBSD vulnerabilities ... Datasheet: DDoS Protection DNS DDoS Protection ... DNS server. This protects your

DDoS Attacks

Scalable DDoS mitigation · •Scalable DDoS Mitigation –BGP FlowSpec •Cloud DDoS Protection –F5 Silverline. DDoS Overview • Distributed denial-of‐service (DDoS) attacks

DDOS REPORT - Imperva · which changed how we define a single distributed denial of service (DDoS) attack in our quarterly reports. In prior reports, a DDoS event was defined as a