Defending Against Low-rate TCP Attack: Dynamic Detection and Protection Haibin Sun John C.S.Lui CSE Dept. CUHK David K.Y.Yau CS Dept. Purdue U.

.2. Outline Introduction to the Low-rate TCP Attack Formal Description of Low-rate TCP Attack Distributed Detection Defense Mechanism Conclusion

.3. Introduction to the Low-rate TCP Attack  Common DoS attack  Consume resources (bandwidth, buffer …etc)  Keep legitimate users away form service  Large number of machines or agents are involved  Harmful, but relatively easy to be detected  Consume resources (bandwidth, buffer …etc)  Keep legitimate users away form service  Large number of machines or agents are involved  Harmful, but relatively easy to be detected  Low-rate DoS attack  Aim to deny the bandwidth of legitimate TCP flows  Attacker sends the attack stream with low volume  Exploit the TCP congestion control feature  Attacker sends a periodic short burst to victim/router  Aim to deny the bandwidth of legitimate TCP flows  Attacker sends the attack stream with low volume  Exploit the TCP congestion control feature  Attacker sends a periodic short burst to victim/router

.4. TCP Retransmission Mechanism  TCP congestion control If under severe network congestion:  Wait until retransmission timeout (RTO)  Reduce the congestion window double the RTO retransmit the packet  If succeed, enter slow start phase else, exponential back off again If under severe network congestion:  Wait until retransmission timeout (RTO)  Reduce the congestion window double the RTO retransmit the packet  If succeed, enter slow start phase else, exponential back off again  Calculation of RTO In RFC 2988: RTO=max(minRTO,SRTT+max(G,4RTTVAR))  Usually, RTO = minRTO when slow start  minRTO=1 second (recommended in RFC 2988) In RFC 2988: RTO=max(minRTO,SRTT+max(G,4RTTVAR))  Usually, RTO = minRTO when slow start  minRTO=1 second (recommended in RFC 2988)

.5. Low-rate DoS Attack to TCP Flow  A example of low-rate DoS attack  Sufficiently large attack burst  Packet loss at congested router  TCP time out & retransmit after RTO  Attack period = RTO of TCP flow,  TCP continually incurs loss & achieves zero or very low throughput.  Sufficiently large attack burst  Packet loss at congested router  TCP time out & retransmit after RTO  Attack period = RTO of TCP flow,  TCP continually incurs loss & achieves zero or very low throughput. TCP Avg BW= lR/T

.6. What is the next? Introduction to the low-rate TCP Attack Formal Description of Low-rate TCP Attack Distributed Detection Defense Mechanism Conclusion

.7.  T: Attack period  l: Length of attack burst  R: Rate of attack burst  N: Background noise  S: Time shift  T: Attack period  l: Length of attack burst  R: Rate of attack burst  N: Background noise  S: Time shift l Formal Description  Mathematical Description N R T S

.8. Low-rate DoS Traffic Pattern The periodic burst may have different patterns:  Step-like double rate stream (Kuzmanovic & Knightly in Sigcomm 03)  Simple Square wave (Kuzmanovic & Knightly in Sigcomm 03)  General peaks with background noise Attack traffic is not easy to remain the same as the original at the victim router. Attack traffic between different period may not be the same, thus T, l, R may vary. We need a “ ROBUST ” method to identify attack

.9. Low-rate DoS Traffic Pattern Multiple distributed attack sources  Long Period combination  Small Burst combination

.10. What is the next? Introduction to the low-rate TCP Attack Formal Description of Low-rate TCP Attack Distributed Detection Defense Mechanism Conclusion

.11. Distributed Detection  Overall Idea of Distributed Detection

.12. Distributed Detection  Traffic signature Detection  Small average throughput => Throughput based IDS  No signature in packet => “per packet” approaches  Extract the essential signature of attack traffic  Small average throughput => Throughput based IDS  No signature in packet => “per packet” approaches  Extract the essential signature of attack traffic X X √

.13.  Sample recent instantaneous throughput at a constant rate (The rate should be frequent enough but not over burden system)  Each time of detection consists of a sequence of instantaneous throughput (The length of sequence should also be properly adjusted)  Normalization is necessary  Sample recent instantaneous throughput at a constant rate (The rate should be frequent enough but not over burden system)  Each time of detection consists of a sequence of instantaneous throughput (The length of sequence should also be properly adjusted)  Normalization is necessary  Similarity between the template and input should be calculated.  We use the Dynamic Time Warping (DTW). (The detail algorithm of DTW is provided in the paper)  The smaller the DTW value, the more similar they are.  DTW values will be clustered; threshold can be set to distinguish them.  Similarity between the template and input should be calculated.  We use the Dynamic Time Warping (DTW). (The detail algorithm of DTW is provided in the paper)  The smaller the DTW value, the more similar they are.  DTW values will be clustered; threshold can be set to distinguish them.  Autocorrelation is adopted to extract the periodic signature of input signal. periodic input => special pattern of its autocorrelation. (Autocorrelation can also mask the difference of time shift S)  Unbiased normalization M: length of input sequence m: index of autocorrelation  Autocorrelation is adopted to extract the periodic signature of input signal. periodic input => special pattern of its autocorrelation. (Autocorrelation can also mask the difference of time shift S)  Unbiased normalization M: length of input sequence m: index of autocorrelation  The background noise of samples need to be filtered  Background noise (UDP flows and other TCP flows that less sensitive to attack)  For simplicity, a threshold filter can be used.  The background noise of samples need to be filtered  Background noise (UDP flows and other TCP flows that less sensitive to attack)  For simplicity, a threshold filter can be used. Pattern match Extract the signature Filter the noise Sample the traffic Demo in Matlab Algorithm of Detection

.14.  Square, step, general peaks  T,l : Uniformly distributed s.t. :l /T<=0.25  R : 1 (full bandwidth)  N,S : Uniformly distributed  1000 simulations /type  Square, step, general peaks  T,l : Uniformly distributed s.t. :l /T<=0.25  R : 1 (full bandwidth)  N,S : Uniformly distributed  1000 simulations /type Robustness of Detection DTW Value of Low-rate TCP Attack Squar e General Peaks Step Max Min Mea n Stdv Attack traffic simulations  DTW values for low-rate attack

.15. Robustness of Detection  Legitimate traffic composition.  Legitimate traffic simulation: C+ Gaussian(0, N)  Run simulation 100 times for each C  Large DTW value for legitimated traffic  Legitimate traffic composition.  Legitimate traffic simulation: C+ Gaussian(0, N)  Run simulation 100 times for each C  Large DTW value for legitimated traffic Max Min62.51 Mea n Stdv66.63  DTW values for Legitimate traffic

.16. Robustness of Detection  Attack flows V.S. legitimate flows  Expect a separation between them.  Attack flows V.S. legitimate flows  Expect a separation between them.  Probability distribution of DTW values threshold

.17. What is the next? Introduction to the low-rate DoS Attack Formal Description of Low-rate TCP Attack Distributed Detection Defense Mechanism Conclusion

.18.  Pushback detection  Pushback to deployed router distributed attack  Deficit round robin (DRR)  Pushback detection  Pushback to deployed router distributed attack  Deficit round robin (DRR) Defense Mechanism  Router deployment } Resource Management

.19.  Classify packets according to the input port [i].  deficit_counter[i] += Quantum  If packet’s size<= deficit_counter[i], serve the packet  deficit_counter[i] -=packet’s size.  If no packet[i], deficit_counter[i] =0.  Classify packets according to the input port [i].  deficit_counter[i] += Quantum  If packet’s size<= deficit_counter[i], serve the packet  deficit_counter[i] -=packet’s size.  If no packet[i], deficit_counter[i] =0.  Deficit Round Robin (DRR) Defense Mechanism Second Round First Round Head of Queue A B C 0 Quantum=1000 bytes 1st Round A’s count : 1000 B’s count : 200 (served twice) C’s count : 400 2nd Round A’s count : 500 (served) B’s count : 0 C’s count : 800 (served)

.20. Experiment of Defense Mechanism  Multiple TCP flows vs. single source attacker Drop TailDRR Throughput (Kbps)% of link capacityThroughput (Kbps)% of link capacity Attack % % TCP % % TCP % % TCP % % TCP % % TCP % % TCP % % TCP % % TCP % % TCP Sum % %  Eight TCP flows  Single low-rate attacker  Go through the same router  Link Capacity 5Mbps  Eight TCP flows  Single low-rate attacker  Go through the same router  Link Capacity 5Mbps

.21. Experiment of Defense Mechanism  Network model of attack vs. Multiple TCP flows Drop TailDRR on R6 DRR on R6,R4 DRR on R6,R4,R2 DRR on R6,R4,R2,R1 ρ(Kbps) Attack TCP TCP TCP TCP Total TCP  4 TCP flows  Single attacker  7 routers network  R1,R2,R4,R6 may run DRR  Link capacity 5 Mb  4 TCP flows  Single attacker  7 routers network  R1,R2,R4,R6 may run DRR  Link capacity 5 Mb

.22. What is the next? Introduction to the low-rate TCP Attack Formal Description of Low-rate TCP Attack Distributed Detection Defense Mechanism Conclusion

.23. Conclusion  Conclusions  Formal model to describe low-rate TCP attack.  Distributed detection mechanism using Dynamic Time Wrapping  The push back mechanism  DRR approach protection and isolation  Formal model to describe low-rate TCP attack.  Distributed detection mechanism using Dynamic Time Wrapping  The push back mechanism  DRR approach protection and isolation