Inferring Internet Denial-of-Service Activity

1
Inferring Internet Denial-of-Service Activity

• David Moore, Geoffrey M Voelker, Stefan Savage
• Presented by Yuemin Yu CS290F Winter 2005

2
Outline

• Motivation
• Attack types
• Backscatter analysis
• Results
• Conclusion

3
Motivation

• How to prevalent are DOS attacks today on the
  internet?
• Nature of the current treats
• Longer term analyses of trends and recurring
  patterns of attacks
• Publish quantitative data about attacks

4
Attack Types

• Logic attacks
• Exploit software vulnerabilities
• Software patches
• Flooding attacks
• Distributed DoS
• Spoof source IP address randomly
• Exhaust system resources

5
Backscatter

• Attacker uses randomly selected source IP address
• Victim reply to spoofed source IP
• Results in unsolicited response from victim to
  third party IP addresses

6
Backscatter
7
Backscatter Analysis

• m attack packets sent
• n distinct IP address monitored
• Expectation of observing an attack
• R Actual rate of attack
• R extrapolated attack rate

8
Analysis Assumptions

• Address uniformity
• Spoof at random
• Uniformly distributed
• Reliable delivery
• Attack and backscatter traffic delivered reliably
• Backscatter hypothesis
• Unsolicited packets observed represent backscatter

9
Attack classifications

• Flow-based
• Based on target IP address and protocol
• Fixed time frame (Within 5mins of most recent
  packet)
• Event-based
• Based on target IP address only
• Fixed time frame

10
Data collection
/8 network 224 IP 1/256 of internet address
space
11
Data collections

• Collect data extract following information
• TCP flags
• ICMP payload
• Address uniformity
• Port settings
• DNS information
• Routing information

12
Response/Used Protocols
13
Rate of attack
14
Victims by ports
15
Attack Duration Cumulative - Probability
Cumulative
probability density
16
Top level domain
17
Victims by Hostnames
18
Autonomous System
19
Repeated Attacks
20
Conclusion

• Observed 12,000 attacks against more than 5,000
  distinct targets.
• Distributed over many different domains and ISP
• Small long attacks with large of attack
  volume
• An unexpected amount of attacks targeting home,
  foreign, specific ISP

21
Thanks

• Questions?