ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 Minimizing Collateral Damage by Proactive Surge Protection Jerry Chou, Bill Lin University of California, San Diego Subhabrata Sen, Oliver Spatscheck AT&T Labs-Research

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 2 Problem Large-scale bandwidth-based DDoS attacks can quickly knock out substantial parts of the network before reactive defenses can respond All traffic that share common route links will suffer collateral damage even if OD pair is not under direct attack

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 3 Problem Potential for large-scale bandwidth-based DDoS attacks exist e.g. large botnets with more than 100,000 bots exist today that, when combined with the prevalence of high-speed Internet access, can give attackers multiple tens of Gb/s of attack capacity Moreover, core networks are oversubscribed (e.g. some core routers in Abilene have more than 30 Gb/s incoming traffic from access networks, but only 20 Gb/s of outgoing capacity to the core

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 4 Problem Router-based defenses like Random Early Drop (RED, RED-PD, etc) can prevent congestion by dropping packets early before congestion  But may drop normal traffic indiscriminately, causing responsive TCP flows to severely degrade Approximate fair dropping schemes aim to provide fair sharing between flows  But attackers can launch many seemingly legitimate TCP connections with spoofed IP addresses and port numbers Both aggregate-based and flow-based router defense mechanisms can be defeated

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 5 Problem Router-based defenses like Random Early Drop (RED, RED-PD, etc) can prevent congestion by dropping packets early before congestion  But may drop normal traffic indiscriminately, causing responsive TCP flows to severely degrade Approximate fair dropping schemes aim to provide fair sharing between flows  But attackers can launch many seemingly legitimate TCP connections with spoofed IP addresses and port numbers Both aggregate-based and flow-based router defense mechanisms can be defeated In general, defenses based on unauthenticated header information such as IP addresses and port numbers may not be reliable

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 6 Example Scenario Suppose under normal condition  Traffic between Seattle/NY + Sunnyvale/NY under 10 Gb/s New YorkSeattle 10G Seattle/NY: 3 Gb/s HoustonAtlanta Indianapolis Kansas City Sunnyvale Sunnyvale/NY: 3 Gb/s

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 7 Example Scenario Suppose sudden attack between Houston/Atlanta  Congested links suffer high rate of packet loss  Serious collateral damage on crossfire OD pairs New York Sunnyvale Seattle 10G Sunnyvale/NY: 3 Gb/s Seattle/NY: 3 Gb/s HoustonAtlanta Houston/Atlanta: Attack 10 Gb/s Indianapolis Kansas City

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 8 Impact on Collateral Damage OD pairs are classified into 3 types with respect to the attack traffic Even a small percentage of attack flows can affect substantial parts of the network

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 9 Our Solution Provide bandwidth isolation between OD pairs, independent of IP spoofing or number of TCP/UDP connections We call this method Proactive Surge Protection (PSP) as it aims to proactively limit the damage that can be caused by sudden demand surges, e.g. sudden bandwidth-based DDoS attacks

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 10 Traffic received in NY: Seattle: 3 Gb/s Sunnyvale: 3 Gb/s … Basic Idea: Bandwidth Isolation Reserve bandwidth for expected OD pair demand Meter and tag packets on ingress as HIGH or LOW Drop LOW packets under congestion inside network New York Sunnyvale Seattle 10G Seattle/NY: Limit: 3.5 Gb/s Actual: 3 Gb/s All admitted as High HoustonAtlanta Houston/Atlanta: Limit: 3 Gb/s Actual: 10 Gb/s High: 3 Gb/s Low: 7 Gb/s Indianapolis Kansas City Sunnyvale/NY: Limit: 3.5 Gb/s Actual: 3 Gb/s All admitted as High

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 11 Traffic received in NY: Seattle: 3 Gb/s Sunnyvale: 3 Gb/s … Basic Idea: Bandwidth Isolation Reserve bandwidth for expected OD pair demand Meter and tag packets on ingress as HIGH or LOW Drop LOW packets under congestion inside network New York Sunnyvale Seattle 10G Seattle/NY: Limit: 3.5 Gb/s Actual: 3 Gb/s All admitted as High HoustonAtlanta Houston/Atlanta: Limit: 3 Gb/s Actual: 10 Gb/s High: 3 Gb/s Low: 7 Gb/s Indianapolis Kansas City Sunnyvale/NY: Limit: 3.5 Gb/s Actual: 3 Gb/s All admitted as High Unlike conventional admission control, packets are permitted into the network even when reserved bandwidth has been exceeded Proposed mechanism readily available in modern routers Unlike conventional admission control, packets are permitted into the network even when reserved bandwidth has been exceeded Proposed mechanism readily available in modern routers

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 12 Forecaster Bandwidth Allocator Bandwidth Allocator Preferential Dropping Preferential Dropping Differential Tagging Differential Tagging Architecture Forecast Matrix Bandwidth Allocation Matrix tagged packets forwarded packets dropped packets Data Plane Policy Plane Deployed at Network Routers Deployed at Network Perimeter arriving packets High priority Low priority

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 13 Forecasting and Allocation We use historical network measurements as a forecast of expected normal traffic  e.g. average weekday traffic demand at 3pm EDT over past 2 months  More sophisticated forecasting methods (e.g. Bayesian schemes) possible, but already good results with simple forecasting To account for forecasting inaccuracies and to provide headroom for traffic burstiness, proportionally scale forecast matrix to fully allocate available network capacity

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 14 Proportional Scaling Iteratively scale bandwidth allocation in “water-filling” manner BW BACBBCAB Links 1st round BW BACBBCAB Links 2nd round A B C Forecast Matrix ∞ ∞ ∞ A B C ABC Bandwidth Allocation 10G A B C ABC

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 15 Networks Abilene  US public academic network  11 nodes, 14 links (10Gb/s)  Traffic data: 10/01/06-12/06/06 US Backbone  US Private ISP tier1 backbone network  700 nodes, 2000 links (1.5Mb/s – 10Gb/s)  Traffic data: 09/01/06-11/17/06 Europe Backbone  Europe private ISP tier1 backbone network  900 nodes, 3000 links (1.5Mb/s – 10Gb/s)  Traffic data: 11/18/06-12/18/06

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 16 DDoS Attack Data Abilene  Bottleneck links Denver, Kansas City, Indianapolis  Chicago (5G each) US Backbone  Commercial anomaly detection alarm Pick the alarm with most flows, and scale their demand by 1000x Europe Backbone  Synthetic attack flow generator Randomly generate attack flows among 0.1% OD pairs. Seattle Sunnyvale Indianapolis Denver Los Angeles Kansas City Chicago New York Washington Atlanta Houston

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 17 Packet Drop Rate Comparison Abilene

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 18 Packet Drop Rate Comparison US

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 19 Packet Drop Rate Comparison Europe

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 20 Behavior Under Scaled Attacks Packet drop rate under attack demand scaled by factor 0 to 3x PSP provides greater improvement as attack scale increases Abilene

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 21 Packet drop rate under attack demand scaled by factor 0 to 3x PSP provides greater improvement as attack scale increases Behavior Under Scaled Attacks US

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 22 Packet drop rate under attack demand scaled by factor 0 to 3x PSP provides greater improvement as attack scale increases Behavior Under Scaled Attacks Europe

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 – Slide 23 Summary of Contributions Proposed proactive solution provides network operators with first line of defense when sudden DDoS attacks occur Solution not dependent on unauthenticated header information, thus robust to IP and TCP sproofing Minimize collateral damage by providing bandwidth isolation between traffic Solution readily deployable using existing router mechanism Simulation results show up to 95.5% of network could suffer collateral damage Solution reduced collateral damage by %

ACM SIGCOMM LSAD Workshop, Kyoto, Japan, August 27, 2007 Questions?