DDoS Attack Detection under SDN Context Author: Yang Xu and Yong Liu Presentation: Haozhou Yu

Denial-of-Service Attack

Distributed Denial-of-Service Attack DDoS attack NormalTraffic

Distributed Denial-of-Service Attack

DoS Attack Flood Attacks Logic / Software Attacks TCP SYN Flood Attack Smurf IP Attack UDP Flood Attack ICMP Flood Attack Logic / Software Attacks Ping of Death Teardrop Land Echo/Chargen

Defense of DDoS attack 1. Detect 2. Filter Covariance analysis, Cluster analysis, Wavelets … 2. Filter

Detect?

Traditional Network http://www.excitingip.net/27/a-basic-enterprise-lan-network-architecture-block-diagram-and-components/

Traditional Network Protocols The Future of Networking, and the Past of Protocols, Scott Shenker, with Martin Casado, Teemu Koponen, Nick McKeown

Software Defined Networking Control Programs Global Network View Network Operating System Control via forwarding interface The Future of Networking, and the Past of Protocols, Scott Shenker, with Martin Casado, Teemu Koponen, Nick McKeown

OpenFlow usage Controller PC Alice’s Rule Alice’s code OpenFlow Switch Decision? OpenFlow Protocol OpenFlow Switch OpenFlow Switch How the actual protocol works OpenFlow offloads control intelligence to a remote software The Future of Networking, and the Past of Protocols, Scott Shenker, with Martin Casado, Teemu Koponen, Nick McKeown 12 12

DoS on traditional network Internet management is distributed each network is run according to local policies no way to enforce global deployment of a particular security mechanism or security policy often impossible to investigate cross-network traffic behavior

Software Defined Networking Separate control plane and data plane Provides new network management methods Network measurement SDN central controller can quickly install and adapt measurement rules on all switches in a coordinated fashion.

Utilize SDN to detect DDoS attacks In this paper: Large volume DDoS attacks traffic rate deviation/asymmetry TCAM(Ternary Content-addressable memory) size for each SDN-enabled switch is very limited

Utilize SDN to detect DDoS attacks Challenges: How to capture the traffic rate feature as well as the traffic rate deviation/asymmetry feature to achieve high detection precision? How to collaboratively utilize limited TCAM available on all switches to monitor the whole network?

System Overview Two Steps: Two Methods: Victim Detection Post-detection Two Methods: Sequential Method Concurrent Method

Sequential Method

Concurrent Method

Victim Detection Initial Rule Placement: Rule management: Monitor all IPs in the system by separate IP ranges; Measure the flow rate asymmetry. Rule management: Dedicate one measurement rule solely for one potential victim IP range; Each rule is used to monitor both the source victim IP range and the destination victim IP range; A1 B1 B A A2 B2 A B A1 B1 A2 B2

Initial Rule Placement

Rule Placement Feasibility Check Ford-Fulkerson algorithm: As long as there is a path from the start node to the terminate node, with available capacity on all edges in the path, we will send flow along one of these paths.

Detection Rule Adaptation

Attacker Detection Procedure

Concurrent Method

Pros & Cons Sequential Method Concurrent Method finer victim observation IP ranges find the attacker at the same time with victim cannot find the victim in the same time use more TCAM space

Choose between two methods

Classification Method Feature Selection Victim Identification Features Attacker Identification Features Classifiers

Victim Identification Features Packet Count per Destination (P): describe the average number of packets to each destination IP in that range; Byte Count per Destination (B): describe the average number of bytes to each destination IP in that range; Packet Count Asymmetry per Destination (PA): describe the average packet count asymmetry for each destination IP in that range; Byte Count Asymmetry per Destination (BA): describe the average byte count asymmetry for each destination IP in that range.

Attacker Identification Features Packet Count per Source (P): describe the average number of packets from a host in IP range i to a host in victim IP range j; Byte Count per Source (B): describe the average number of bytes from a host in IP range i to a host in victim IP range j; Packet Count Asymmetry from Source (PA): describe the average packet numbers asymmetry to victim IP range; Byte Count Asymmetry from Source (BA): describe the average bytes numbers asymmetry to victim IP range.

Classifiers--Self Organizing Mapping (SOM) Randomize node’s weights in the map space. Choose one input vector I from the data space. Calculate Euclidean distance between input vector and all map’s nodes’ weight vector. Find node with smallest distance, label this node as winner node. Update the nodes in the neighborhood of winner node so that the Euclidean distance between their individual weight vector and the input vector becomes smaller. repeat procedure 2 - 4 until weight vector has no significant change.

Experiment Attack Transmission (A): flows from 10, 000 randomly picked source IPs to the victim IP, with sending rate from each source IP randomly distributed within (30kbps, 70kbps) and receiving rate of each source IP randomly distributed within (1kbps, 4kbps); Normal Large Volume Transmission (N1): From one source IP to another destination IP, with sending rate within (300mbps, 700mbps) and receiving rate randomly within (300mbps, 700mbps); Normal Small Asymmetry Transmission (N2): From one source IP to another destination IP, with sending rate randomly distributed within (30kbps, 70kbps) and receiving rate randomly distributed within (1kbps, 4kbps), the number of sources sending traffic to the same destination is no more than 100; Normal Small Symmetry Transmission (N3): From one source IP to another destination IP, with sending rate randomly distributed within (30kbps, 70kbps) and receiving rate randomly distributed within (30kbps, 70kbps), number of sources sending traffic to the same destination is no more than 100.

Importance of Asymmetry Feature

Performance of Two Detection Methods

Performance of Two Detection Methods

Performance of Two Detection Methods

Experiment Simulation results demonstrate that capturing asymmetry feature is important to achieve high detection accuracy. Using suitable features, SOM classifier can achieve very accurate detection performance. The features obtained from finer granularity will make the detection more accurate. Experiment results show that if the priority of DDoS detection is to find victims, Sequential Method is preferable, as it can detect finer potential victim IP ranges given limited TCAM sizes. If the objective of DDoS detection is to find victims as well as attackers, Concurrent Method is preferable if TCAM sizes are abundant, as it finds victims and attackers more quickly.

Conclusion Use SDN on DDoS attack detection Capture the flow volume feature as well as the flow rate asymmetry feature Propose Sequential Method as well as Concurrent Method to adaptively change the flow monitoring granularities on all switches to quickly locate the potential victims and suspicious attackers

Future work Refine the detection method Evaluate methods with packet traces collected from real DDoS attacks Implement the methods in the Openflow platform

Q & A