Network Flow-Based Anomaly Detection of DDoS Attacks

Vassilis Chatzigiannakis

National Technical University of Athens, Greece

vhatzi@netmode.ntua.gr

TNC 2004TNC 2004

Network Flow-based Anomaly Detection of DDoS Attacks - TNC

2004

Intrusion Detection

An IDS is a system used for detecting network attacks

They detect both successful and unsuccessful attacks

They Detect attacks from insidersIDS Categories:

Host /Network based They use Misuse /Anomaly detection Distributed Intrusion Detection Systems

Network Flow-based Anomaly Detection of DDoS Attacks - TNC

2004

Intrusion Detection(2)

Misuse Detection Sniffs network packets If known a signature is matched, it detects the

attack Resembles to an anti-virus system Must be updated night and day

Network Flow-based Anomaly Detection of DDoS Attacks - TNC

2004

Intrusion Detection(3)

Anomaly Detection Checks for great variation from the normal

behaviour of an entity An entity could be a user, a computer or network

link Use of an expert system The system has to be trained to become

operational

Network Flow-based Anomaly Detection of DDoS Attacks - TNC

2004

Denial of Service AttacksDenial of Service Attacks An attack to suspend the availability of a

service Until recently the "bad guys" tried to enter our

systems. Now it’s: ""If not us, then NobodyIf not us, then Nobody""

DoS: single correctly made malicious packets against the target machine

Distributed DoS: traffic flows from various sources to exhaust network or computing resources

Network Flow-based Anomaly Detection of DDoS Attacks - TNC

2004

Main Characteristics of DoSMain Characteristics of DoS Variable targets:

Single hosts or whole domains Computer systems or networks ImportantImportant: Active network components (e.g.

routers) also vulnerable and possible targets! Variable uses & effects:

Hacker "turf" wars High profile commercial targets (or just

competitors…). Useful in cyber-warfare, terrorism etc.

Network Flow-based Anomaly Detection of DDoS Attacks - TNC

2004

1. Taking Control

2. Commandingthe attack

Distributed DoSDistributed DoS

Target

domain

"zombies"

Pirated machines

Domain A

Pirated machines

Domain B

Attacker

X

Network Flow-based Anomaly Detection of DDoS Attacks - TNC

2004

NetflowNetflow

What is a flow? Defined by seven keys: Source IP address Destination IP address Source Port Destination Port Layer 3 Protocol Type TOS byte (DSCP) Input logical interface (ifIndex)

Network Flow-based Anomaly Detection of DDoS Attacks - TNC

2004

NetFlow Sequence Router (from Cisco.com)

1. Create and update flows in NetFlow Cache

• Inactive timer expired (15 sec is default)• Active timer expired (30 min is default)•NetFlow cache is full (oldest flows expire)• RST or FIN TCP Flag

ExportPacket

Payload(flows)

2. Expiration

3. Aggregation?

Protocol Pkts SrcPort DstPort Bytes/Pkt

11 11000 00A2 00A2 1528

SrcIf SrcIPadd DstIf DstIPadd Protocol TOS Flgs Pkts SrcPort SrcMsk SrcAS DstPort DstMsk DstAS NextHop Bytes/Pkt Active Idle

Fa1/0 173.100.21.2 Fa0/0 10.0.227.12 11 80 10 11000 00A2 /24 5 00A2 /24 15 10.0.23.2 1528 1800 4

e.g. Protocol-Port Aggregation Scheme becomes

4. Export Version

SrcIf SrcIPadd DstIf DstIPadd Protocol TOS Flgs Pkts SrcPort SrcMsk SrcAS DstPort DstMsk DstAS NextHop Bytes/Pkt Active Idle

Fa1/0 173.100.21.2 Fa0/0 10.0.227.12 11 80 10 11000 00A2 /24 5 00A2 /24 15 10.0.23.2 1528 1745 4

Fa1/0 173.100.3.2 Fa0/0 10.0.227.12 6 40 0 2491 15 /26 196 15 /24 15 10.0.23.2 740 41.5 1

Fa1/0 173.100.20.2 Fa0/0 10.0.227.12 11 80 10 10000 00A1 /24 180 00A1 /24 15 10.0.23.2 1428 1145.5 3

Fa1/0 173.100.6.2 Fa0/0 10.0.227.12 6 40 0 2210 19 /30 180 19 /24 15 10.0.23.2 1040 24.5 14

YesNo

Aggregated Flows – export Version 8 or 9Non-Aggregated Flows – export Version 5 or 9

5. Transport Protocol

Our Solution:Our Solution:An anomaly detection tool An anomaly detection tool

OpenEyeOpenEye

Network Flow-based Anomaly Detection of DDoS Attacks - TNC

2004

OpenEye

DDoS Attack Detection Tool Analyses flows that are exported from

Cisco Netflow enabled routers Compatible with Netflow v9 Works with IPv4 and IPv6 traffic Uses anomaly detection algorithm based

on specific metrics and thresholds Written in Java language

Network Flow-based Anomaly Detection of DDoS Attacks - TNC

2004

Implementation

Two main modules:- CollectorThe Collector is responsible for receiving flow data from the Netflow enabled routers, information is analyzed and stored in a local data structure.

- DetectorThe Detector is responsible for calculating the metrics and comparing the results to detection thresholds. It is periodically activated, implements extensive logging of detection events and generates e-mail notifications with security alerts to the administrator.

Network Flow-based Anomaly Detection of DDoS Attacks - TNC

2004

DoS Detection Metrics (1)

Metrics for Packets/Flows based on deviation

CPij = Current Packets/Flows from interface i to j

APij = Average Packets/Flows from interface i to j

CPij AP ij

AP ij

k1

CP ij

j

CPij

k2

Network Flow-based Anomaly Detection of DDoS Attacks - TNC

2004

DoS Detection Metrics (2)

Number of flows with very small lifetime

Number of flows with a very small number of packets

Percentages of TCP/UDP traffic

Network Flow-based Anomaly Detection of DDoS Attacks - TNC

2004

Data structures

Tables for number of packets and number of flows for every pair of interfaces

Hash Tables with the Dst IP (key) and the number of packets and flows (values) for each IP for every pair of interfaces

Network Flow-based Anomaly Detection of DDoS Attacks - TNC

2004

Attack Graphs

Network Flow-based Anomaly Detection of DDoS Attacks - TNC

2004

Future WorkFuture Work More experiments Detection of worms Creation and testing of new metrics Usage of OpenEye as a part of a Distributed

Intrusion Detection System

Network Flow-based Anomaly Detection of DDoS Attacks - TNC

2004

Acknowledgements

Panoptis http://panoptis.sourceforge.net/

GrNet http://www.grnet.gr

Ntua NOC http://noc.ntua.gr

Netmode http://netmode.ntua.gr

Questions and AnswersQuestions and Answers