1. High Performance Research Network. Development Lab. / Supercomputing Center 1 Design of the Detection and Response System against DDoS attacks Yoonjoo Kwon yulli@kisti.re.kr High Performance Research Network Dept. Supercomputing Center KISTI

2. High Performance Research Network. Development Lab. / Supercomputing Center 2 Table of contents Motivations Motivations DDoS Activities (In KREONET) DDoS Activities (In KREONET) DDR System DDR System Test Results Test Results Summary Summary Future Plans Future Plans

3. High Performance Research Network. Development Lab. / Supercomputing Center 3 Motivations DDoS attacks are being appeared continuously DDoS attacks are being appeared continuously DDoS attack DDoS attack Consumes host resources Consumes host resources Memory Processor cycles Consumes network resources Consumes network resources Bandwidth Router resources (its a host too!) Attack tools are more sophisticated as time passed. Attack tools are more sophisticated as time passed. In terms of ISP, we need to respond to DDoS attack for protecting network users and network resources In terms of ISP, we need to respond to DDoS attack for protecting network users and network resources

4. High Performance Research Network. Development Lab. / Supercomputing Center 4 High Low 1980198519901995 2001 password guessing password cracking exploiting known vulnerabilities disabling audits back doors hijacking sessions sniffers packet spoofing GUI automated probes/scans denial of service www attacks Tools Attackers Intruder Knowledge Attack Sophistication stealth / advanced scanning techniques burglaries network mgmt. diagnostics distributed attack tools binary encryption Source: CERT/CC Attack tools over time

5. High Performance Research Network. Development Lab. / Supercomputing Center 5 10Gbps 40Gbps Daejeon SuperSIReN Seoul DDoS Activities (In KREONET) status We have monitored amount of network traffic in KREONET using flowscan and flowscan+. DDoS attacks are detected continuously. After Jan. 25, 2003, various worms which include DDoS features has shown up frequently So far, the reaction was done by manual configurations. So we thought the automatic DDoS Detection and Response system should be needed. udp flooding tcp flooding

6. High Performance Research Network. Development Lab. / Supercomputing Center 6 Our System DDR system : DDoS Detection and Response system DDR system : DDoS Detection and Response system DDR system uses netflow data DDR system uses netflow data Functions are Functions are to detect DDoS attacks to detect DDoS attacks to traceback DDoS agents to traceback DDoS agents to control DDoS traffic to control DDoS traffic Overview of DDR system Overview of DDR system DDoS Agent DDoS Agent DDR Agent Victim DDIP DDR Server Rate Limit Victim IP Attack Direction Target Protocol

7. High Performance Research Network. Development Lab. / Supercomputing Center 7 Components of DDR system DDR Agent DDR Agent Analyze netflow data Analyze netflow data Checks DDoS attack Checks DDoS attack Sends information of DDoS attack to DDR Server Sends information of DDoS attack to DDR Server Attack Info. Receiver DDoS Agent Tracer Router Command Applier Traceback Module Edge Router Netflow Collector Finishing Checkup Module DDR Server Edge Router Traffic Checker Router command Remover Edge Routers Sending Netflows Removing router commands(ratelimit) Applying router commands (ratelimit) DB Netflow Collector DDoS detector Reactor Detection Module Inner Command Sender Communication Module Router Command Applier Inner Command Sender Control Module DDR Agent backbone Router DDIP

8. High Performance Research Network. Development Lab. / Supercomputing Center 8 Whether are network connections to a destination or from a source over 85% of current flows or not? DDoS Detection Algorithm of DDR Agent Two level tests for DDoS Detection Two level tests for DDoS Detection Level 1 Test : whether current flow is abnormal or not Level 1 Test : whether current flow is abnormal or not Level 2 Test : whether the flow trend is DDoS Attack or not Level 2 Test : whether the flow trend is DDoS Attack or not time # of flow per protocol time # of flow per protocol time # of inbound flow # of outbound flow abnormal traffic models final standard of judge on DDoS attack

9. High Performance Research Network. Development Lab. / Supercomputing Center 9 Traceback : Finding DDoS agents Start at the router which detected DDoS attack Start at the router which detected DDoS attack For the router identify the interfaces on which the attack flow came in. For the router identify the interfaces on which the attack flow came in. For each input interface, identify the remote router. (Need to know the topology) For each input interface, identify the remote router. (Need to know the topology) For each remote router, repeat until DDR Server meets the edge router. For each remote router, repeat until DDR Server meets the edge router. Apply ratelimit command to edge-routers Apply ratelimit command to edge-routers

10. High Performance Research Network. Development Lab. / Supercomputing Center 10 Daejeon Seoul V V

11. High Performance Research Network. Development Lab. / Supercomputing Center 11 Traceback : After finding DDoS agents We know where the traffic came from We know where the traffic came from We can filter the traffic at the ingress if we need. We can filter the traffic at the ingress if we need. We can identify the peer network and contact them We can identify the peer network and contact them

12. High Performance Research Network. Development Lab. / Supercomputing Center 12 Test Environment Cross Traffic : UDP 19.0Mbps(iperf) DDoS Attack Tool : flitz Number of DDoS agents : 3 RTT/Loss Test between Site P and Site Q Router : Cisco 7200 series, IOS 12.3 DDoS Agent DDoS Agent DDR Agent Victim(203.230.7.205) DDIP DDR Server Rate Limit Site P Site Q ISP A ISP B RTT/Loss Test 25Mbps 1Gbps

13. High Performance Research Network. Development Lab. / Supercomputing Center 13 Normal Loss DDoS Attack DDOS Attack Loss Starting DDR System Test Results(skping) Loss: 0% RTT : 1.23ms Loss: 30.9% RTT : 190.15ms Loss: 8.73% RTT : 189.98ms Loss: 0% RTT : 4.65ms

14. High Performance Research Network. Development Lab. / Supercomputing Center 14 Summary DDoS attacks are appeared continuously DDoS attacks are appeared continuously We developed DDR system using netflow data We developed DDR system using netflow data We got some test results in test environment We got some test results in test environment

15. High Performance Research Network. Development Lab. / Supercomputing Center 15 Future Plans We plan to We plan to deploy DDR system to STAR TAP, international link. deploy DDR system to STAR TAP, international link. deploy DDR system to a section of KREONET deploy DDR system to a section of KREONET update detecting engine (DDR Agent) periodically update detecting engine (DDR Agent) periodically These days, worms which include DDoS features have been increased We would like We would like to form a shared infrastructure capable of accurate backtracing to form a shared infrastructure capable of accurate backtracing that our result of this topic contribute to Asia- Pacific Research that our result of this topic contribute to Asia- Pacific Research