380 likes | 389 Views
Solving DDoS Attacks. facilitating bridging solutions and stakeholders. in the Netherlands. , europe. , and beyond. Ddos clearing house. 2019-05-21. Solving DDoS Attacks. Koen van Hove. Researcher at the University of Twente. The problem and our idea.
E N D
Solving DDoS Attacks facilitating bridging solutions and stakeholders in the Netherlands , europe , andbeyond Ddos clearing house 2019-05-21
Solving DDoS Attacks • Koen van Hove • Researcher at the University of Twente
https://www.business.com/categories/best-ddos-protection-services/https://www.business.com/categories/best-ddos-protection-services/
https://scholar.google.nl/scholar?hl=en&as_sdt=0%2C5&q=ddos+attack&btnG=https://scholar.google.nl/scholar?hl=en&as_sdt=0%2C5&q=ddos+attack&btnG=
? ? ? ? ? ? ? ? Why does DDoS stillexist?
Solving DDoS Attacks DDoS protection providers Academia
Network operators + CERT/CSIRT DDoS protection providers Law enforcement agencies Victims Academia
Network Measurement (pcap, net flow, ipfix, sflow, logs, …) • DDoS_Dissector • input: network measurement • Output: DDoS fingerprint (+*NOTES) • filtered & anonymized networkmeasUrements DDoS_Fingerprint_converters input: ddos fingerprint Output: rule/signature for specific hw/sw solution(s) (SNORT, SURICATA, BRO, IPtables, ebpf, bgpflowspec, …) DDoSDB STORE, enrich, and distribute DDoS attack related info
Network operators + CERT/CSIRT DDoS protection providers Law enforcement agencies Victims Academia
Network operators + CERT/CSIRT DDoS protection providers Law enforcement agencies Victims Academia
Network operators + CERT/CSIRT DDoS protection providers Law enforcement agencies Victims Academia
Network operators + CERT/CSIRT DDoS protection providers Law enforcement agencies Victims Academia
Network operators + CERT/CSIRT DDoS protection providers Law enforcement agencies Victims Academia
Demo: Using the ddos dissector
Demo: Querying ddosdb
[the current] deployment & governance
? Timelime 2019 2018 2017
https://github.com/ddos-clearing-house https://ddosdb.ORG https://ddosdb.NL
challenges & future directions
.nl .org
.org .nl .it
Solving DDoS Attacks • Koen van Hove • Researcher at the University of Twente Questions? • koen@ddosdb.org
Network Measurement (pcap, net flow, ipfix, sflow, logs, …) • DDoS_Dissector • input: network measurement • Output: DDoS fingerprint (+*NOTES) • filtered and anonymized netw. measU. DDoS_Fingerprint_converters input: ddos fingerprint Output: rule/signature for specific hw/sw solution(s) (SNORT, SURICATA, BRO, IPtables, ebpf, bgp flowspec, …) DDoSDB STORE, enrich, and distribute DDoS attack related info
Solving DDoS Attacks facilitating bridging solutions and stakeholders in the Netherlands, Europe, and Beyond Ddos clearing house 3/03/2019
WHAT IS THE AVERAGE ECONOMIC LOSS PER DDOS ATTACK? A. $25.000 C. $2.500.000 https://www.zdnet.com/article/the-average-ddos-attack-cost-for-businesses-rises-to-over-2-5m/ B. $250.000 D. $25.000.000