KEYNOTE OF THE FUTURE 3: DAVID BECKETT CSIT PhD Student QUEEN’S UNIVERSITY BELFAST

@CSIT_QUB Detection, Mitigation and Prevention of Emerging Application Layer DDoS Attacks David Beckett, PhD Student 20/03/2015

Overview of Distributed Denial of Service (DDoS) Emerging Application Layer Attacks State of the art Detection and Mitigation methods Future Plans DDoS - Distributed Denial of Service

Distributed Denial of Service (DDoS) Attack An attempt to make a network or server unavailable to its intended users DDoS - Distributed Denial of Service

DDoS Attacks 2010

Types of Attacks Infrastructure Layer (3,4) Application Layer (7) Bandwidth CPU Conns CPU Mem Sessions

DDoS attack types observed by Arbor Networks (2014)

Why will application layer attacks become popular? Content Delivery Networks -Cache static content -Global network with large infrastructure Content Delivery Networks -Cache static content -Global network with large infrastructure Infrastructure Layer (3,4) Application Layer (7) Dynamic Application Layer Attack L3/L4 DDoS Bypass CDN protection Lower bandwidth required Difficult to detect Bypass CDN protection Lower bandwidth required Difficult to detect Firewall Protection -SYN Cookies -Signature rules for fragmented packets Firewall Protection -SYN Cookies -Signature rules for fragmented packets CDN absorbs the attack

HTTP GET – Attacker profiles the website and requests resources with large computation loads. HTTP POST - Slow Post Attack, Sends 1000 byte form post, 1 byte every 110 seconds. SSL Attack - Creates many SSL connections, the server has a larger workload than the client. Layer 7 Request Floods CPU Sessions CPU Mem Sessions Emerging Application Layer Attacks

State of the Art Detection Methods User Behavior Resource Popularity Page transitions using Hidden Markov Model Layer 7 Timing Statistics Compare page size vs browsing time GET/POST request frequencies Hidden Decoy Links Home Item Basket Pay 3s 9s 4s

State of the Art Mitigation Methods User Puzzles – CAPTCHAs Cryptographic Puzzles Network Puzzles Cloud Computing

Targeted Detection Approach Resource Monitoring CPU Usage Memory Usage Session Usage Anomaly Detection Anomaly Detection

Targeted Mitigation Approach Use of Software Defined Infrastructure (SDI) to Re-route suspicious traffic to decoy servers Minimise damage Further analysis Scale server resources

Identify attackers by their affect not their behaviour Light weight Detect low rate attacks Can detect zero day attacks Future Plans Creation of attack classifier Further development of test bed Summary and Future Plan