CSE715 Presentation Project Fall 2004 by Michael Alexandrou and Rusty Coleman

The paper … A Framework for Classifying Denial of Service Attacks A Framework for Classifying Denial of Service AttacksAuthors: Alefiya Hussain Alefiya Hussain John Heideman John Heideman Christos Papadopoulos Christos Papadopoulos

Basis for classifying DoS attacks Why classify the attack? Helps to counter the attack Helps to counter the attack Attack Analysis: Header content Header content Ramp up behavior Ramp up behavior Spectral analysis Spectral analysis

Contribution of the paper Automated methodology Automated methodology A real time attack analysis A real time attack analysis Use of a traceback to identify the attacker is trivia in single source Use of a traceback to identify the attacker is trivia in single source New techniques of ramp up and spectral analysis New techniques of ramp up and spectral analysis

Taxonomy of DoS attacks To launch a Distributed DoS attack a malicious user : Compromises Internet hosts by exploiting security holes. Compromises Internet hosts by exploiting security holes. Installs attack tools on the compromised host also known as a zombie. Installs attack tools on the compromised host also known as a zombie.

Taxonomy of DoS attacks Software exploits Software exploits Software exploits. These attacks exploit specific bugs in the victim’s OS or applications. These cases are not considered in this paper. Flooding attacks Flooding attacks

Flooding attacks One or more attackers One or more attackers Streams of packets aimed at overwhelming link bandwidth or computing resources at the victim. Streams of packets aimed at overwhelming link bandwidth or computing resources at the victim. Single source attacks Single source attacks Multi-source attacks Multi-source attacks Reflector attack Reflector attack

Taxonomy of DoS attacks

Flooding attacks

Examples Ping of death Ping of death A modified version of a regular ping request. Land attack Land attack A packet with source host/port equal to destination host/port.

Attack tools Several canned attack tools are available on the Internet, such as Stacheldraht, Trinoo, Tribal Flood Network 2000, and Mstream that generate flooding attacks using a combination of TCP, UDP, and ICMP packets Several canned attack tools are available on the Internet, such as Stacheldraht, Trinoo, Tribal Flood Network 2000, and Mstream that generate flooding attacks using a combination of TCP, UDP, and ICMP packets

Attack Classification Header Contents Header Contents Ramp up behavior Ramp up behavior Spectral Analysis Spectral Analysis

Header Contents Most attacks spoof the source IP address Most attacks spoof the source IP address ID and TTL fields can give hints of the attackers ID and TTL fields can give hints of the attackers Difficult for attackers to coordinate the ID fields. Difficult for attackers to coordinate the ID fields.

Header Contents

Some attack tools forge all header contents. Impossible to distinguish between a single or multiple sources based on header information Need to use another technique

Ramp-up Behavior Observation point near the victim Observation point near the victim Master triggers zombies with trigger message Master triggers zombies with trigger message Results in a ramp up behavior Results in a ramp up behavior

Spectral analysis The attack stream is treated as a discrete function of time x(t) The attack stream is treated as a discrete function of time x(t) The autocorrelation function r(k) of x(t) is examined The autocorrelation function r(k) of x(t) is examined

Autocorrelation function

Discrete-time Fourier Transform

Spectral analysis We define two functions We define two functions The power of the attack stream P(f) The power of the attack stream P(f) The quantile of the attack stream F(p) The quantile of the attack stream F(p)

The cumulative power P(f) & C(f)

The quantile F(p)

Sample Graphs Single Source

Sample Graph Two Sources

Sample Graph Three Sources

Sample Graph Multiple Sources

Conclusion Possible to determine type of DoS attack Possible to determine type of DoS attack Analysis can be performed on the attack to determine if it is single or multi sourced Analysis can be performed on the attack to determine if it is single or multi sourced Need for automated tool to produce these analyses Need for automated tool to produce these analyses