1 / 24

Presented by Nadine Sundquist

“On Scalable Attack Detection in the Network” Ramana Rao Kompella, Sumeet Singh, and George Varghese. Presented by Nadine Sundquist. Roadmap. Why do we need scalable attack detection? What are the difficulties in implementing scalable attack detection? What kinds of attacks can be detected?

sjefferson
Download Presentation

Presented by Nadine Sundquist

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. “On Scalable Attack Detection in the Network”Ramana Rao Kompella, Sumeet Singh, and George Varghese Presented by Nadine Sundquist

  2. Roadmap • Why do we need scalable attack detection? • What are the difficulties in implementing scalable attack detection? • What kinds of attacks can be detected? • What are Partial Completion Filters (PCFs)? • How do we use Partial Completion Filters? • What are the experimental results?

  3. Roadmap • Why do we need scalable attack detection? • What are the difficulties in implementing scalable attack detection? • What kinds of attacks can be detected? • What are Partial Completion Filters (PCFs)? • How do we use Partial Completion Filters? • What are the experimental results?

  4. Why do w need scalable attack detection? • Scalable: Able to detect network behavior at multi-gigabit speeds (at least 1 Gb/s). • Detect behavior over a set of packets at network vantage points such as routers. • Proposed solution: Aggregation (combining multiple connections) for attack detection?

  5. Why Use Aggregation? • Combining several lines into one is more efficient for forwarding. • Can have millions of flows/connections with no enough high speed memory (on-chip and off-chip SRAM or cache) at router. • Other services use forms of aggregation for faster processing. • Example: Internet lookup routers store 150 000 prefixes for the entire Internet to process requests faster.

  6. Roadmap • Why do we need scalable attack detection? • What are the difficulties in implementing scalable attack detection? • What kinds of attacks can be detected? • What are Partial Completion Filters (PCFs)? • How do we use Partial Completion Filters? • What are the experimental results?

  7. Problems of Aggregation BehavioralAliasing: Good behaviors aggregate to look like bad behaviors. 2 computers look like 1 computer due to aggregation. 192.168.1.1 192.168.1.1 128.1.1.7 128.1.1.7 192.168.1.1 192.168.1.1 128.1.1.7 128.1.1.7 False positive: Server thinks a resource is under attack, when traffic is in a normal state.

  8. Problems of Aggregation Spoofing – Attacker avoids detection by appearing benign. Our focus is TCP (Transport Control Protocol) SYN flooding, also known as Partial Completion Attacks: Connections Opened, but not closed. SYN – Connection request and connection opened. FIN – Connection finished/closed. Attacker Victim SYN 128.1.1.7:80 SYN 128.1.1.7:80 SYN 128.1.1.7:80 SYN 128.1.1.7:80 SYN 128.1.1.7:80 FIN 128.1.1.7:80 FIN 128.1.1.7:80 Firewall/Proxy/Victim Server (Does detection of SYN flooding)

  9. Roadmap • Why do we need scalable attack detection? • What are the difficulties in implementing scalable attack detection? • What kinds of attacks can be detected? • What are Partial Completion Filters (PCFs)? • How do we use Partial Completion Filters? • What are the experimental results?

  10. Kinds of Attacks • Partial Completion Attacks • Attacks That Do Scanning • Bandwidth Attacks • Commonality = Bandwidth Tied Up or Resources Tied Up

  11. Roadmap • Why do we need scalable attack detection? • What are the difficulties in implementing scalable attack detection? • What kinds of attacks can be detected? • What are Partial Completion Filters (PCFs)? • How do we use Partial Completion Filters? • What are the experimental results?

  12. Partial Completion Filters (PCFs) • New data structure. • Can detect scanning attacks and partial completion attacks with small traffic volume. • Can detect victims reacting to an attack. • Only useful for TCP. • Only have a local geographical scope.

  13. Partial Completion Filters (PCFs) If N packets delivered, stay within √N standard deviation. SYN 192.168.1.1:20 FIN 192.168.1.1:20 SYN 10.1.1.5:24 SYN 10.1.1.5:24 SYN 10.1.1.5:24 Courtesy of Minsoo Choi, University of Southern California If noise, 3 √N standard deviation. 5000 hash functions in experiments. (Requires 480 Kbits memory)

  14. Roadmap • Why do we need scalable attack detection? • What are the difficulties in implementing scalable attack detection? • What kinds of attacks can be detected? • What are Partial Completion Filters (PCFs)? • How do we use Partial Completion Filters? • What are the experimental results?

  15. How do we use PCFs? • Partial Completion Attacks PCF(SYN, FIN, <Destination IP: Destination Port>) • TCP Scanning Detection PCF(SYN, FIN, <Source IP>)

  16. Where do I deploy PCFs? • Near sources -> Look at Source IP. • Recognizes Scanning • Recognizes too many SYN packets w/o FINs. • Incoming/Outgoing edge of network -> Look at Destination IP. • Recognizes Attack • Outgoing edge of network -> Look at Source IP. • Recognizes false FIN w/o FIN-ACK

  17. Roadmap • Why do we need scalable attack detection? • What are the difficulties in implementing scalable attack detection? • What kinds of attacks can be detected? • What are Partial Completion Filters (PCFs)? • How do we use Partial Completion Filters? • What are the experimental results?

  18. Experiment Setup Dir 1 Dir 0 Internet Dir 0 Dir 1 ISP A ISP B 2 real flows of traffic from 1 day OC-48 -> 2488.32 Mbits/second Dir = Direction ISP = Internet Service Provider

  19. How do we take into account bias? SYN FIN Difference in Experiment -150 150

  20. Results • 5 million destinations (About 30 million ports) & 2 million sources (About 30 million ports). • 517 Attack Flows. • 6 False Positives -> Too many SYNs. • 0 False Negatives -> Too many FINs. • Could measure the time length of the attacks.

  21. Scanning Detection • SYNs without FINs could mean port scans A source doing port scanning will send SYN packets, but no FIN packets to MANY destinations (in red).

  22. Conclusions • Speed requirement: Using aggregation is possible for attack detection on networks of at least 2488.32 Mbits/second. • Memory requirement: Only uses 480 Kbits memory for hash functions. • Accurate in a Local Area Network.

  23. Further Research/Work • Run more tests using more sets of data. Only one set of data used in paper’s experiment. • Research other methods of attack detection at high speeds and compare results. • Further research scan-based (worm) attacks.

  24. References Ramana Rao Kompella, Sumeet Singh, and George Varghese, “On Scalable Attack Detection in the Network”, February 2007. Choi, Minsoo, “On Scalable Attack Detection in the Network Presentation”, netweb.usc.edu/ftp/pub/cs558f05/Slides/minsoo.ppt, 2007.

More Related