A framework for classifying denial of service attacks

ABSTRACT

Launching a denial of service (DoS) attack is trivial, but detection and response is a painfully slow and often a manual process. Automatic classification of attacks as single- or multi-source can help focus a response, but current packet-header-based approaches are susceptible to spoofing. This paper introduces a framework for classifying DoS attacks based on header content, and novel techniques such as transient ramp-up behavior and spectral analysis. Although headers are easily forged, we show that characteristics of attack ramp-up and attack spectrum are more difficult to spoof. To evaluate our framework we monitored access links of a regional ISP detecting 80 live attacks. Header analysis identified the number of attackers in 67 attacks, while the remaining 13 attacks were classified based on ramp-up and spectral analysis. We validate our results through monitoring at a second site, controlled experiments, and simulation. We use experiments and simulation to understand the underlying reasons for the characteristics observed. In addition to helping understand attack dynamics, classification mechanisms such as ours are important for the development of realistic models of DoS traffic, can be packaged as an automated tool to aid in rapid response to attacks, and can also be used to estimate the level of DoS activity on the Internet.

REFERENCES

• 1: M. Allman, V. Paxson, and W. Stevens. TCP congestion control. RFC 2581, Internet Request For Comments, April 1999.
• 2: Paul Barford , Jeffery Kline , David Plonka , Amos Ron, A signal analysis of network traffic anomalies, Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment, November 06-08, 2002, Marseille, France [doi>10.1145/637201.637210]
• 3: Steven Bellovin. ICMP traceback messages. Work in Progress: draft-bellovin-itrace-00.txt.
• 4: Steven M. Bellovin, A technique for counting natted hosts, Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment, November 06-08, 2002, Marseille, France [doi>10.1145/637201.637243]
• 5: George Edward Pelham Box , Gwilym M. Jenkins, Time Series Analysis: Forecasting and Control, Prentice Hall PTR, Upper Saddle River, NJ, 1994
• 6: Ronald Bracewell. The Fourier Transform and Its Applications. Series in Electrical Engineering. McGraw-Hill, New York, NY, 1986.
• 7: Andre Broido , Evi Nemeth , K. C. Claffy, Spectroscopy of DNS update traffic, Proceedings of the 2003 ACM SIGMETRICS international conference on Measurement and modeling of computer systems, June 11-14, 2003, San Diego, CA, USA
• 8: Hal Burch, Tracing Anonymous Packets to Their Approximate Source, Proceedings of the 14th USENIX conference on System administration, December 03-08, 2000, New Orleans, Louisiana
• 9: Chen-Mou Cheng, H.T. Kung, and Koan-Sin Tan. Use of spectral analysis in defense against DoS attacks. In Proceedings of the IEEE GLOBECOM, Taipei, Taiwan, 2002.
• 10: David Dittirch. DDoS Attacks and Tools. http://staff.washington.edu/dittrich/misc/ddos.
• 11: Julio Escobar , Craig Partridge , Debra Deutsch, Flow synchronization protocol, IEEE/ACM Transactions on Networking (TON), v.2 n.2, p.111-121, April 1994 [doi>10.1109/90.298430]
• 12: Fyodor. Remote OS detection via TCP/IP stack fingerprinting. http://www.insecure.org/nmap/, October 1998.
• 13: Thomer M. Gil and Massimiliano Poletto. MULTOPS: A Data-Structure for bandwidth attack detection. In Proceedings of the USENIX Security Symposium, pages 23--38, Washington, DC, July 2001.
• 14: Hevin Houle and George Weaver. Trends in denial of service technology. CERT Coordination Center at Carnegie-Mellon University, October 2001.
• 15: Alefiya Hussain, John Heidemann, and Christos Papadopoulos. A Framework for Classifying Denial of Service Attacks. Technical Report ISI-TR-2003-569, USC/Information Sciences Institute, February 2003.
• 16: Van Jacobson, Craig Leres, and Steven McCanne. tcpdump - the protocol packet cpature and dumper program. http://www.tcpdmp.org.
• 17: Jelena Mirkovic , Gregory Prier , Peter L. Reiher, Attacking DDoS at the Source, Proceedings of the 10th IEEE International Conference on Network Protocols, p.312-321, November 12-15, 2002
• 18: P. Kamath , K. Lan , J. Heidemann , J. Bannister , J. Touch, Generation of High Bandwidth Network Traffic Traces, Proceedings of the 10th IEEE International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunications Systems (MASCOTS'02), p.401, October 11-16, 2002
• 19: Angelos D. Keromytis , Vishal Misra , Dan Rubenstein, SOS: secure overlay services, Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications, August 19-23, 2002, Pittsburgh, Pennsylvania, USA
• 20: Los nettos-passing packets since 1988. http://www.ln.net.
• 21: Ratul Mahajan , Steven M. Bellovin , Sally Floyd , John Ioannidis , Vern Paxson , Scott Shenker, Controlling high bandwidth aggregates in the network, ACM SIGCOMM Computer Communication Review, v.32 n.3, p.62-73, July 2002 [doi>10.1145/571697.571724]
• 22: D. Meyer. University of oregon Route Views Project. Advanced Network Technology Center web site, http://www.antc.uoregon.edu/route-views.
• 23: Jeffrey C. Mogul. Observing TCP dynamics in real networks. Technical Report 92.2, DEC Western Research Laboratory, April 1992.
• 24: David Moore, Geoffrey Voelker, and Stefan Savage. Inferring Internet denial of service activity. In Proceedings of the USENIX Security Symposium, Washington, DC, USA, August 2001. USENIX.
• 25: Christos Papadopoulos, Robert Lindell, John Mehringer, Alefiya Hussain, and Ramesh Govindan. COSSACK: Coordinated Suppression of Simultaneous Attacks. In In Proceeding of Discex III, Washington, DC, USC, April 2003.
• 26: Kihong Park , Heejo Lee, On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internets, Proceedings of the 2001 conference on Applications, technologies, architectures, and protocols for computer communications, p.15-26, August 2001, San Diego, California, United States
• 27: Craig Partridge , David Cousins , Alden W. Jackson , Rajesh Krishnan , Tushar Saxena , W. Timothy Strayer, Using signal processing to analyze wireless data traffic, Proceedings of the 3rd ACM workshop on Wireless security, p.67-76, September 28-28, 2002, Atlanta, GA, USA [doi>10.1145/570681.570689]
• 28: Vern Paxson, Bro: a system for detecting network intruders in real-time, Computer Networks: The International Journal of Computer and Telecommunications Networking, v.31 n.23-24, p.2435-2463, Dec. 1999 [doi>10.1016/S1389-1286(99)00112-7]
• 29: Vern Paxson, An analysis of using reflectors for distributed denial-of-service attacks, ACM SIGCOMM Computer Communication Review, v.31 n.3, July 2001 [doi>10.1145/505659.505664]
• 30: Martin Roesch. Snort - lightweight intrusion detection for networks. http://www.snort.org.
• 31: Stefan Savage , David Wetherall , Anna Karlin , Tom Anderson, Practical network support for IP traceback, Proceedings of the conference on Applications, Technologies, Architectures, and Protocols for Computer Communication, p.295-306, August 28-September 01, 2000, Stockholm, Sweden
• 32: Alex C. Snoeren, Hash-based IP traceback, Proceedings of the 2001 conference on Applications, technologies, architectures, and protocols for computer communications, p.3-14, August 2001, San Diego, California, United States
• 33: Dawn X. Song and Adrian Perrig. Advanced and authenticated marking schemes for IP traceback. In Proceedings of the IEEE Infocom, Anchorage, Alaska, April 2001.
• 34: Neil Spring , Ratul Mahajan , David Wetherall, Measuring ISP topologies with rocketfuel, Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications, August 19-23, 2002, Pittsburgh, Pennsylvania, USA
• 35: Robert Stone. Centertrack: An IP overlay network for tracking DoS floods. In Proceedings of the USENIX Security Symposium, pages 199--212, Denver, CO, USA, July 2000. USENIX.
• 36: Ajay Tirumala, Feng Qin, Jon Dugan, Jim Ferguson, and Kevin Gibbs. Iperf Version 1.6.5. http://dast.nlanr.net/Projects/Iperf/.
• 37: Gene Trent and Mark Sake. WebSTONE: The first generation in HTTP server benchmarking.
• 38: Haining Wang, Danlu Zhang, and Kang Shin. Detecting SYN flooding attacks. In Proceedings of the IEEE Infocom, New York, NY, June 2002. IEEE.
• 39: Zhi-Li Zhang, Vinay Ribeiro, Sue Moon, and Christophe Diot. Small-time scaling behaviors of Internet backbone traffic: An empirical study. In Proceedings of the IEEE Infocom, San Francisco, CA, April 2003.

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

Additional Classification:
  G. Mathematics of Computing
  G.3 PROBABILITY AND STATISTICS
      Subjects: Time series analysis

General Terms:
Measurement, Security

Keywords:
denial of service attacks, measurement, security, time series analysis