“On Scalable Attack Detection in the Network” Ramana Rao Kompella, Sumeet Singh, and George Varghese Presented by Nadine Sundquist

2November 7, 2007 CS-622 Roadmap Why do we need scalable attack detection? What are the difficulties in implementing scalable attack detection? What kinds of attacks can be detected? What are Partial Completion Filters (PCFs)? How do we use Partial Completion Filters? What are the experimental results?

3November 7, 2007 CS-622 Roadmap Why do we need scalable attack detection? What are the difficulties in implementing scalable attack detection? What kinds of attacks can be detected? What are Partial Completion Filters (PCFs)? How do we use Partial Completion Filters? What are the experimental results?

4November 7, 2007 CS-622 Why do w need scalable attack detection? Scalable: Able to detect network behavior at multi-gigabit speeds (at least 1 Gb/s). Detect behavior over a set of packets at network vantage points such as routers. Proposed solution: Aggregation (combining multiple connections) for attack detection?

5November 7, 2007 CS-622 Why Use Aggregation? Combining several lines into one is more efficient for forwarding. Can have millions of flows/connections with no enough high speed memory (on-chip and off-chip SRAM or cache) at router. Other services use forms of aggregation for faster processing. – Example: Internet lookup routers store prefixes for the entire Internet to process requests faster.

6November 7, 2007 CS-622 Roadmap Why do we need scalable attack detection? What are the difficulties in implementing scalable attack detection? What kinds of attacks can be detected? What are Partial Completion Filters (PCFs)? How do we use Partial Completion Filters? What are the experimental results?

7November 7, 2007 CS-622 Problems of Aggregation Behavioral Aliasing: Good behaviors aggregate to look like bad behaviors. False positive: Server thinks a resource is under attack, when traffic is in a normal state computers look like 1 computer due to aggregation.

8November 7, 2007 CS-622 SYN :80 Problems of Aggregation Spoofing – Attacker avoids detection by appearing benign. Our focus is TCP (Transport Control Protocol) SYN flooding, also known as Partial Completion Attacks: Connections Opened, but not closed. SYN – Connection request and connection opened. FIN – Connection finished/closed. SYN :80 FIN :80 Attacker Victim Firewall/Proxy/Victim Server (Does detection of SYN flooding)

9November 7, 2007 CS-622 Roadmap Why do we need scalable attack detection? What are the difficulties in implementing scalable attack detection? What kinds of attacks can be detected? What are Partial Completion Filters (PCFs)? How do we use Partial Completion Filters? What are the experimental results?

10November 7, 2007 CS-622 Kinds of Attacks Partial Completion Attacks Attacks That Do Scanning Bandwidth Attacks Commonality = Bandwidth Tied Up or Resources Tied Up

11November 7, 2007 CS-622 Roadmap Why do we need scalable attack detection? What are the difficulties in implementing scalable attack detection? What kinds of attacks can be detected? What are Partial Completion Filters (PCFs)? How do we use Partial Completion Filters? What are the experimental results?

12November 7, 2007 CS-622 Partial Completion Filters (PCFs) New data structure. Can detect scanning attacks and partial completion attacks with small traffic volume. Can detect victims reacting to an attack. Only useful for TCP. Only have a local geographical scope.

13November 7, 2007 CS-622 Partial Completion Filters (PCFs) SYN :20 FIN :20 SYN :24 Courtesy of Minsoo Choi, University of Southern California If N packets delivered, stay within √N standard deviation. If noise, 3 √N standard deviation hash functions in experiments. (Requires 480 Kbits memory)

14November 7, 2007 CS-622 Roadmap Why do we need scalable attack detection? What are the difficulties in implementing scalable attack detection? What kinds of attacks can be detected? What are Partial Completion Filters (PCFs)? How do we use Partial Completion Filters? What are the experimental results?

15November 7, 2007 CS-622 How do we use PCFs? Partial Completion Attacks TCP Scanning Detection PCF(SYN, FIN, )

16November 7, 2007 CS-622 Where do I deploy PCFs? Near sources -> Look at Source IP. –Recognizes Scanning –Recognizes too many SYN packets w/o FINs. Incoming/Outgoing edge of network -> Look at Destination IP. –Recognizes Attack Outgoing edge of network -> Look at Source IP. –Recognizes false FIN w/o FIN-ACK

17November 7, 2007 CS-622 Roadmap Why do we need scalable attack detection? What are the difficulties in implementing scalable attack detection? What kinds of attacks can be detected? What are Partial Completion Filters (PCFs)? How do we use Partial Completion Filters? What are the experimental results?

18November 7, 2007 CS-622 Experiment Setup ISP AISP B 2 real flows of traffic from 1 day OC-48 -> Mbits/second Dir = Direction ISP = Internet Service Provider Internet Dir 0 Dir 1

19November 7, 2007 CS-622 How do we take into account bias? SYN FIN Difference in Experiment

20November 7, 2007 CS-622 Results 5 million destinations (About 30 million ports) & 2 million sources (About 30 million ports). 517 Attack Flows. 6 False Positives -> Too many SYNs. 0 False Negatives -> Too many FINs. Could measure the time length of the attacks.

21November 7, 2007 CS-622 Scanning Detection SYNs without FINs could mean port scans A source doing port scanning will send SYN packets, but no FIN packets to MANY destinations (in red).

22November 7, 2007 CS-622 Conclusions Speed requirement: Using aggregation is possible for attack detection on networks of at least Mbits/second. Memory requirement: Only uses 480 Kbits memory for hash functions. Accurate in a Local Area Network.

23November 7, 2007 CS-622 Further Research/Work Run more tests using more sets of data. Only one set of data used in paper’s experiment. Research other methods of attack detection at high speeds and compare results. Further research scan-based (worm) attacks.

24November 7, 2007 CS-622 References Ramana Rao Kompella, Sumeet Singh, and George Varghese, “On Scalable Attack Detection in the Network”, February Choi, Minsoo, “ On Scalable Attack Detection in the Network Presentation ”, netweb.usc.edu/ftp/p ub/cs558f05/Slides/mi nsoo.ppt, 2007.