1 / 42

Kill-Bots: Surviving DDoS Attacks That Mimic Legitimate Browsing

Protect your web server from CyberSlam DDoS attacks that mimic legitimate browsing by using the Kill-Bots kernel extension. It offers cheap stateless authentication and optimal balance between authentication and service, improving performance during flash crowds.

amberc
Download Presentation

Kill-Bots: Surviving DDoS Attacks That Mimic Legitimate Browsing

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Kill-Bots: Surviving DDoS Attacks That Mimic Legitimate Browsing Srikanth Kandula Dina Katabi, Matthias Jacob, and Arthur Berger

  2. CyberSlam = DDoS that Mimics Legitimate Browsing

  3. 20,000+ zombies issue requests that mimic legitimate browsing GET File.zip DO DBQuery CyberSlam www.foo.com Requests Look Legitimate  Standard filters don’t help

  4. Instances of CyberSlam First FBI DDoS Case – Hired professionals hit competitor Mafia extorts online gaming sites … Code RED Worm Why CyberSlam? Avoid detection by NIDS & firewalls High pay-off by targeting expensive resources E.g., CPU, DB, Disk, processes, sockets Large botnets are available CyberSlam Attacks Happen!

  5. Threat Model • In scope • Attacks on higher layer bottlenecks, e.g., CPU, Memory, Database, Disk, processes, … • Attacks that fool the server to congest its uplink bandwidth • Mutating attacks • Outside the scope • Flooding server’s downlink (prior work) • Live-lock in the device driver

  6. Tentative Solutions • No big consumers; Commodity OS do not support fine-grained resource accounting • Might not exist, expensive to check • Computation is abundant in a botnet • Filter big resource consumers? • Passwords? • Computational puzzles? ????

  7. Reverse Turing Test (e.g., CAPTCHAs) to distinguish humans from zombies Partial Solution: But…

  8. 3 Problems with CAPTCHA Authentication (2) Bias against users who can’t or won’t answer CAPTCHAs NO Can’t see it • (1) DDoS the authentication mechanism (connect to server, force context-switches, hog sockets etc.) • (3)How to divide resources between service andauthentication as to maximize system goodput?

  9. Kill-Bots’ Contributions • First to protect against CyberSlam • Solves problems with CAPTCHAs: • Cheap stateless authentication • Serves legit. users who don’t answer CAPTCHAs • Optimal balance between authentication & service • Improves performance during Flash Crowds • Order of magnitude improvement in goodput & response time

  10. Kill-Bots is a kernel extension for web servers LOAD > L1 Suspected Attack Normal LOAD < L2 < L1 New Clients are authenticated once and given HTTP Cookie No Overhead

  11. Authentication vulnerable to DDoS Problem 1:

  12. SYN SYNACK SYNACKACK Send CAPTCHA HTTP Request TCP FIN Authentication vulnerable to DDoS Problem 1: Client Server Standard Network Stack SYN Cookie Check cookie, socket, reserve buffers Causes context switch, buffer copies Resources are reserved till client sends a FIN but zombies don’t FIN

  13. Authentication vulnerable to DDoS Problem 1: Modify network stack to issue CAPTCHAs without state Solution:

  14. SYN SYNACK SYNACKACK Send CAPTCHA HTTP Request TCP FIN Authentication vulnerable to DDoS Problem 1: Modify network stack to issue CAPTCHAs without state Solution: Client Kill-Bots Server Modified Network Stack Stateless & Cheap Keep congestion control semantics No browser mods. SYN Cookie Drop; Check cookie, send CAPTCHA without a socket!

  15. Legit. Users who don’t answer CAPTCHA Problem 2: Solution: Humans • Answer CAPTCHA • Reload; if doesn’t work, give up Use reaction to CAPTCHA Zombies Can’t answer CAPTCHA, but have to bombard the server with requests Count the unanswered CAPTCHAs per IP, and drop if more than T; Cheap with a Bloom Filter Bloom Filter increase give captcha decrease correct ans. COUNTER

  16. Stage 1: CAPTCHA Authentication Learn IP addresses of zombies using Bloom filter Stage 2: Use only Bloom filter for Authentication No CAPTCHAs Bloom Learns All Zombie IPs Users who don’t answer CAPTCHAs can access the server despite the attack in Stage 2

  17. Problem 3: To Authenticate or To Serve?

  18. To Authenticate or To Serve? Authenticate all new arrivals  can’t serve all authenticated clients Authenticate very few arrivals  too few legitimate users are authenticated Problem 3: Solution: • Authenticate new clients with prob.  (drop others)  A form of admission control with 2 arrival types But what  maximizes goodput?

  19. Analysis Modeled system using Queuing Theory Found Optimal *(proof in paper) But * depends on many unknown parameters • attack rate • mean service time • mean session size • legitimate request rate, etc…

  20. Kill-Bots adapts the authentication prob. by measuring fraction of time CPU is idle Solution to Problem 3:

  21. Solution to Problem 3: Kill-Bots adapts the authentication prob. by measuring fraction of time CPU is idle • Analysis says: if idle > 0,  is prop. to (1- idle) • Say you want to keep server busy 90% of time:

  22. Solution to Problem 3: Kill-Bots adapts the authentication prob. by measuring fraction of time CPU is idle • Analysis says: if idle > 0,  is prop. to (1- idle) • Say you want to keep server busy 90% of time: • Kill-Bots adapts in real time

  23. Solution to Problem 3: Kill-Bots adapts the authentication prob. by measuring fraction of time CPU is idle • Analysis says: if idle > 0,  is prop. to (1- idle) • Say you want to keep server busy 90% of time: • Kill-Bots adapts in real time

  24. Tying it Together

  25. Tying it Together

  26. Tying it Together

  27. Tying it Together

  28. Tying it Together

  29. DDoS the authentication Serve legitimate users who don’t answer CAPTCHAs Divide resources between authentication & service Problem Solution Recap: Kill-Bots addresses CyberSlam • Send CAPTCHAs cheaply without sockets • Use reaction to CAPTCHA to identify zombies • Adaptive authentication as admission control

  30. Attacks & Defenses • Replay Attacks? • Don’t work. Limit #connections per cookie • Spoof IP, cause Bloom filter to block • Doesn’t happen. SYN cookie before updating Bloom • Breaking the CAPTCHA? • Kill-bots can use any Reverse Turing Test

  31. Performance

  32. Wide-area Evaluation Using PlanetLab Legit. users are driven from CSAIL Web traces >25,000 attackers on PlanetLab request random pages 60% of legitimate users answer CAPTCHAs

  33. Metrics • Goodput (of Legitimate Users) • Response time (of Legitimate Users) • Maximum survivable attack rate

  34. Kill-Bots under DDoS Goodput of Legit. (Mb/s) Attack Rate (Request/sec)

  35. Kill-Bots under DDoS Goodput of Legit. (Mb/s) Attack Rate (Request/sec) Response Time (sec) Attack Rate (Request/sec)

  36. Kill-Bots under DDoS 5-10 times better Goodput and Response Time Goodput of Legit. (Mb/s) Attack Rate (Request/sec) Response Time (sec) Attack Rate (Request/sec)

  37. Why Adapt the Authentication Probability? Server with adaptive authentication Server with authentication Base server Goodput of Legit. (Mb/s) Attack Rate (Request/sec) Adaptive  is much better than authenticating every new user

  38. Kill-Bots under Flash Crowd Flash Crowd Goodput of legit. (Mb/s) Response Time (sec) Time (sec)

  39. Orders of magnitude better Response Time Flash Crowd Goodput of legit. (Mb/s) Response Time (sec) Time (sec)

  40. Kill-Bots under Flash Crowd Adaptive  provides admission control Flash Crowd Authentication Prob.  Time (sec) Response Time (sec) Time (sec)

  41. Kill-Bots under Flash Crowd Base Server Kill-Bots Number of dropped legitimate requests 360,000 80,000 Response Time (sec) Kill-Bots authenticates new clients only if it can serve them… Time (sec)

  42. Kill-Bots’ Contributions • First to protect Web servers from DDoS attacks that mimic legitimate browsing • First to deal with CAPTCHA’s bias against legitimates users who don’t solve them • Sends CAPTCHA and checks answer without any server state • Addresses both DDoS attacks and Flash Crowds • Orders of magnitude better response time, goodput, and survivable attack rate

More Related