1 Attacking DDoS at the Source Jelena Mirković, Gregory Prier, Peter Reiher University of California Los Angeles Presentation by: David Allen.

Slides:

Advertisements

Similar presentations

On the Necessity of Handling DDoS Traffic in the Middle of the Network Peter Reiher UCLA Computer Communications Workshop October 22, 2008.

Advertisements

Shutup An E2E Approach to DoS Defense Paul Francis Saikat Guha Cornell.

Network and Application Attacks Contributed by- Chandra Prakash Suryawanshi CISSP, CEH, SANS-GSEC, CISA, ISO 27001LI, BS 25999LA, ERM (ISB) June 2006.

Code-Red : a case study on the spread and victims of an Internet worm David Moore, Colleen Shannon, Jeffery Brown Jonghyun Kim.

Overview of Distributed Denial of Service (DDoS) Wei Zhou.

Lecture slides prepared for “Computer Security: Principles and Practice”, 2/e, by William Stallings and Lawrie Brown, Chapter 7 “Denial-of-Service-Attacks”.

Computer Security Fundamentals by Chuck Easttom Chapter 4 Denial of Service Attacks.

2005 Stanford Computer Systems Lab Flow Cookies Bandwidth Amplification as Flooding Defense Martin Casado, Pei Cao Niels Provos.

Security Awareness: Applying Practical Security in Your World, Second Edition Chapter 5 Network Security.

Security Awareness: Applying Practical Security in Your World

© 2006 Cisco Systems, Inc. All rights reserved. Implementing Secure Converged Wide Area Networks (ISCW) Module 6: Cisco IOS Threat Defense Features.

CS155: Computer and Network Security Programming Project 3 – Spring 2008 Craig Gentry, Naef Imam, Arnab Roy {cgentry, nimam, Thanks.

DDoS Attack Prevention by Rate Limiting and Filtering d’Artagnan de Anda CS239 Network Security 26 Apr 04.

Detecting SYN-Flooding Attacks ＡａｒｏｎＢｅａｃｈＣＳ３９５ＮｅｔｗｏｒｋＳｅｃｕｒｉｔｙＳｐｒｉｎｇ２００４.

John Kristoff DePaul Security Forum Network Defenses to Denial of Service Attacks John Kristoff

Computer Security: Principles and Practice EECS710: Information Security Professor Hossein Saiedian Fall 2014 Chapter 7: Denial-of-Service Attacks.

Max Robinson Jelena Mirković DR. Peter Reiher DefCOM Motivation Distributed denial-of-service attacks require a distributed solution. Detection is more.

Attack Profiles CS-480b Dick Steflik Attack Categories Denial-of-Service Exploitation Attacks Information Gathering Attacks Disinformation Attacks.

COEN 252: Computer Forensics Router Investigation.

DoS/DDoS Attack Forbes Henderson. What is a DoS Attack  DoS Attack (Denial of Service Attack)  A Denial of Service Attack is Often used by hackers to.

Lecture 15 Denial of Service Attacks

Design and Implementation of SIP-aware DDoS Attack Detection System.

Using Argus Audit Trails to Enhance IDS Analysis Jed Haile Nitro Data Systems

Introduction to InfoSec – Recitation 12 Nir Krakowski (nirkrako at post.tau.ac.il) Itamar Gilad (itamargi at post.tau.ac.il)

Source Router Approach to DDoS Defense Jelena Mirković and Peter Reiher UCLA USENIX Work-In Progress Session Washington DC, 08/17/2001 {sunshine,

DDoS Attack and Its Defense1 CSE 5473: Network Security Prof. Dong Xuan.

PacNOG 6: Nadi, Fiji Dealing with DDoS Attacks Hervey Allen Network Startup Resource Center.

Lecture 22 Page 1 Advanced Network Security Other Types of DDoS Attacks Advanced Network Security Peter Reiher August, 2014.

1 Figure 3-33: Internet Control Message Protocol (ICMP) ICMP is for Supervisory Messages at the Internet Layer ICMP and IP  An ICMP message is delivered.

1Federal Network Systems, LLC CIS Network Security Instructor Professor Mort Anvair Notice: Use and Disclosure of Data. Limited Data Rights. This proposal.

© 2007 Cisco Systems, Inc. All rights reserved.Cisco Public ITE PC v4.0 Chapter 1 1 Basic Security Networking for Home and Small Businesses – Chapter 8.

Computer Security: Principles and Practice First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Chapter 8 – Denial of Service.

Clouseau: A practical IP spoofing defense through route-based filtering Jelena Mirkovic, University of Delaware Nikola Jevtic,

Introduction to InfoSec – Recitation 11 Nir Krakowski (nirkrako at post.tau.ac.il) Itamar Gilad (itamargi at post.tau.ac.il)

Source-End Defense System against DDoS attacks Fu-Yuan Lee, Shiuhpyng Shieh, Jui-Ting Shieh and Sheng Hsuan Wang Distributed System and Network Security.

Denial-of-Service Attacks Justin Steele Definition “A "denial-of-service" attack is characterized by an explicit attempt by attackers to prevent legitimate.

--Harish Reddy Vemula Distributed Denial of Service.

Lecture 4 Denial of Service Attack

TCP/IP Vulnerabilities

© 2006 Cisco Systems, Inc. All rights reserved. Cisco IOS Threat Defense Features.

Distributed Denial of Service Attacks

Bandwidth Distributed Denial of Service: Attacks and Defenses.

Group 8 Distributed Denial of Service. DoS SYN Flood DDoS Proposed Algorithm Group 8 What is Denial of Service? “Attack in which the primary goal is to.

Module 10: How Middleboxes Impact Performance

EMIST DDoS Experimental Methodology Alefiya Hussain January 31, 2006.

Denial of Service Sharmistha Roy Adversarial challenges in Web Based Services.

DoS Suite and Raw Socket Programming Group 16 Thomas Losier Paul Obame Group 16 Thomas Losier Paul Obame.

Design and implementation of SIP-aware DDoS attack detection system By: Arif Iqbal.

NETWORK ATTACKS Dr. Andy Wu BCIS 4630 Fundamentals of IT Security.

Chapter 7 Denial-of-Service Attacks Denial-of-Service (DoS) Attack The NIST Computer Security Incident Handling Guide defines a DoS attack as: “An action.

1 Very Fast containment of Scanning Worms By: Artur Zak Modified by: David Allen Nicholas Weaver Stuart Staniford Vern Paxson ICSI Nevis Netowrks ICSI.

Chapter 7 Denial-of-Service Attacks 7.1. Tấn công từ chối dịch vụ 7.1. Tấn công từ chối dịch vụ Bản chất của tấn công từ chối dịch vụ Bản chất của tấn.

Advanced Packet Analysis and Troubleshooting Using Wireshark 23AF

DoS/DDoS attack and defense

Autonomic Response to Distributed Denial of Service Attacks Paper by: Dan Sterne, Kelly Djahandari, Brett Wilson, Bill Babson, Dan Schnackenberg, Harley.

High Performance Research Network Dept. / Supercomputing Center 1 DDoS Detection and Response System NetWRAP : Running on KREONET Yoonjoo Kwon

Page 12/9/2016 Chapter 10 Intermediate TCP : TCP and UDP segments, Transport Layer Ports CCNA2 Chapter 10.

An Analysis of Using Reflectors for Distributed Denial-of- Service Attacks Paper by Vern Paxson.

1 Figure 4-11: Denial-of-Service (DoS) Attacks Introduction  Attack on availability  Act of vandalism Single-Message DoS Attacks  Crash a host with.

UDP & TCP Where would we be without them!. UDP User Datagram Protocol.

Denial of Convenience Attack to Smartphones Using a Fake Wi-Fi Access Point Erich Dondyk, Cliff C. Zou University of Central Florida.

Inferring Internet Denial-of-Service Activity Authors: David Moore, Geoffrey M. Voelker and Stefan Savage; University of California, San Diego Publish:

TCP/IP1 Address Resolution Protocol Internet uses IP address to recognize a computer. But IP address needs to be translated to physical address (NIC).

Denail of Service(Dos) Attacks & Distributed Denial of Service(DDos) Attacks Chun-Chung Chen.

Denial-of-Service Attacks

AP Waseem Iqbal.  DoS is an attack on computer or network that reduces, restricts or prevents legitimate of its resources  In a DoS attack, attackers.

Firewalls. Overview of Firewalls As the name implies, a firewall acts to provide secured access between two networks A firewall may be implemented as.

Chapter 9 The Transport Layer The Internet Protocol has three main protocols that run on top of IP: two are for data, one for control.

DDoS Attacks on Financial Institutions Presentation

Error and Control Messages in the Internet Protocol

Presentation transcript:

1 Attacking DDoS at the Source Jelena Mirković, Gregory Prier, Peter Reiher University of California Los Angeles Presentation by: David Allen

2 Overview Denial-of-Service (DoS) attack: –Packet streams from disparate sources converge on victim. –Consume key resource rendering it unavailable to legitimate clients. Traceback and mitigation are difficult. Some system attempt to block at victim: –Can be difficult to determine attack packets from valid ones. –Attack volume may overwhelm defenses.

3 Overview Ideally stop attacks as close to source as possible. –Facilitates traceback. –Easier to separate from legitimate traffic. –Less traffic to manage. System described in paper: D-WARD

4 D-WARD Implemented within a router in cooperation with a router. Traffic is monitored and flow statistics are gathered. These are compared to a normal flow model. Attack flows are throttled exponentially based on rate.

5 D-WARD Flows that return to normal are allowed to recover. Speed of recovery is slow at first, then fast.

6 D-WARD Model TCP ratio of packets sent and received. Flow considered an attack if TCP ratio is above a threshold. Certain ICMP packets must be paired with a reply. Flow considered attack if ICMP ratio is above a threshold. Limits on the number of UDP connections per destination and sending rate. Flow considered attack if limits on UDP are exceeded.

7 D-WARD Implementation Linux based software router. Limited size connection hash-table is used to store stats. Connections are purged if they are considered transient and are old, or If table is full, bad connections are deleted. Good connection records are never deleted.

8 Results

9