1. Identification of Repeated Denial of Service Attacks
Alefiya Hussain,
John Heidemann,
Christos Papadopoulos
16 November 2018

2. Why detect repeated attacks?
DoS used as a weapon for extortion, vandalism, and ideological attacks
Attribution – ability to quantify and associate repeated attacks on a victim to the same attackers
Assist in criminal and civil prosecution
Copyright 2004, USC/ISI All rights reserved.

3. Repeated Attack Scenarios
M monitors series of attacks
Converts each attack packet trace ti to fingerprint F(ti)
Each fingerprint uniquely identifies an attack scenario
Attack scenario – combination of attack troops and attack tool
F(t1) similar to F(t2)
F(t1) not similar to F(t3) V1 M V2
Copyright 2004, USC/ISI All rights reserved.

4. Our Approach Goal: Test is attack scenario has occurred earlier
Build on our previous work (SIGCOMM 2003)
F(Y) C
F(Z)
Step I: Create a fingerprint
Step II: Compare F(Z) to C
Copyright 2004, USC/ISI All rights reserved.

5. Defining fingerprint Step Ia: Feature Extraction
Power spectral density of attack trace
Dominant frequencies in attack spectra
Step Ib: Estimate fingerprint
Mean vector and Covariance matrix of dominant frequencies
Copyright 2004, USC/ISI All rights reserved.

6. Step I: Create fingerprint for Z
Segment attack trace in K section xk(t) of packets
Estimate psd for each xk(t)
Extract dominant frequencies from each psd to form matrix Xk
Estimate distribution parameters:
Mean vector
Covariance matrix
Copyright 2004, USC/ISI All rights reserved.

7. Step II: Comparing Attacks
Pattern recognition techniques
Divergence between the probability distributions - Maximum-likelihood classifier
Similar attack scenarios have small divergence
Using cdf of divergence test if attack have small divergence
lowCZ
rangeCZ
Copyright 2004, USC/ISI All rights reserved.

8. Step II: Compare C to F(Z)
Segment attack trace into L sections of xl(t) packets
Estimate psd for each xl(t)
Extract dominant frequencies to form matrix Xl
Compute divergence
Copyright 2004, USC/ISI All rights reserved.

9. Interpreting Match Data
Are the comparisons accurate? Does attack C match well with F(Z)?
Are the comparisons precise? Does attack C have a small divergence with F(Z)?
Summarize set LCZ
highCZ as 95% quantile of LCZ
lowCZ as 5% quantile of LCZ
rangeCZ as difference between highCZ and lowCZ
Accurate match -> small lowCZ value
Precise match -> small rangeCZ value
C and F(Z) match iff both accurate and precise
Copyright 2004, USC/ISI All rights reserved.

10. Results Database of 18 attacks captured at Los Nettos
Attack duration > 400s to create fingerprint
Real world attacks
Emulate similar attack scenarios by comparing the head and tail of the same attack
Tests different attack scenarios
Experimental evaluation for factors affecting the fingerprint
Copyright 2004, USC/ISI All rights reserved.

11. Detect repeated Scenario
Example:
comparing head & tail of
same attack
comparing different attacks
Detected seven repeated attack scenarios
over a period of five months
lowFF=172,
rangeFF=57
lowFJ =223,
rangeFJ=768333
Copyright 2004, USC/ISI All rights reserved.

12. Robustness of Fingerprints
What factors affect the fingerprint? OS
CPU speed
Attack tool
LM1
LM2
LM3
FM1
FM2
FM3
Victim M
Attack Scenario =
Troop + Tool
Do not affect fingerprint
Host Load
Less than 60% cross-traffic
Copyright 2004, USC/ISI All rights reserved.

13. Future Work Alternate feature definitions Clustering Algorithms
Wavelet Energy vectors
Clustering Algorithms
K-means and hierarchical clustering
Temporal Stability
Portability
Copyright 2004, USC/ISI All rights reserved.

14. Technical report located at
Thank You
Technical report located at
Copyright 2004, USC/ISI All rights reserved.