04/22/2001ecs289K: Intention Driven iTrace1 ecs298k Intention-Driven iTrace lecture #6 Dr. S. Felix Wu Computer Science Department University of California, Davis

04/22/2001ecs289K: Intention Driven iTrace2 A Statistic Problem with iTrace Routers closer to the victims have higher probability to generate iTrace packets toward the true victims. Routers closer to the DDoS slaves might have relatively small probability (smaller than the routers around the victims) to generate “useful” iTrace packets.

04/22/2001ecs289K: Intention Driven iTrace3 “Usefulness” Let’s think??

04/22/2001ecs289K: Intention Driven iTrace4 Two answers It carries attack packets. It carries attack packets from a router that is very close to the original slaves

04/22/2001ecs289K: Intention Driven iTrace5 Two measures P(U-iTrace) –When an iTrace message is generated, what is the probability that this iTrace message is “useful” (i.e., it carries an attack packet)? P(U-iT-sec) –What is probability for a router to generate at least ONE “useful” iTrace message in a second?

04/22/2001ecs289K: Intention Driven iTrace6 Example: Multi-S Single-V SlaveR1R1 R2R2 Victim 1K attack-pkt/sec 19K normal-pkt/sec P(U-iTrace) = 5% #iTrace/sec = 1 P(U-iT-sec) = 5% 4K attack-pkt/sec 196K normal-pkt/sec P(U-iTrace) = 2% #iTrace/sec = 10 P(U-iT-sec) = 18% 200K attack-pkt/sec 200K normal-pkt/sec P(U-iTrace) = 50% #iTrace/sec = 20 P(U-iT-sec) = % 980K attack-pkt/sec 20K normal-pkt/sec P(U-iTrace) = 98% #iTrace/sec = 50 P(U-iT-sec) = 100%

04/22/2001ecs289K: Intention Driven iTrace7 Motivation About (K* 0.005%) of our network resources will be spent on iTrace packets. Then, we hope we can spend the resources on more “useful” iTrace packets.

04/22/2001ecs289K: Intention Driven iTrace8 Three Types of Nodes DDoS victim with the intention to trace the slaves. DDoS victim without the intention. non-DDoS victims (assuming they do not have the intention as well -- and very likely they hope they won’t receive ones).

04/22/2001ecs289K: Intention Driven iTrace9 Intention-driven iTrace Different destination hosts, networks, domains/ASs have different “intention levels” in receiving iTrace packets. –We propose to add one “iTrace-intention” bit. Some of them might not care about iTrace, and some of them might not be under DDoS attacks, for example.

04/22/2001ecs289K: Intention Driven iTrace10 a little mathematics... S2V: 2% S2B:48% S2C:25% S2D:25% I: 1 I: 0 I: 1 Intention for receiving iTrace. V’s probability to receive iTrace packets: 7.41% 0.02 / ( ) = P iTrace (V) = (P traffic (V) * I(V)) / (P traffic (n) * I(n))

04/22/2001ecs289K: Intention Driven iTrace11 Example: Multi-S Two-V SlaveR1R1 R2R2 Victim 4K att-v1-pkt/sec 50K att-v2-pkt/sec 146K normal-pkt/sec P(U-iTrace) = 2% #iTrace/sec = 10 P(U-iT-sec) = 18% I(Victim-1) = 1 P(U-iTrace) = 7.4% P(U-iT-sec) = 53.7% P(U-iTrace) = 25% #iTrace/sec = 10 P(U-iT-sec) = 95% I(Victim-2) = 1 P(U-iTrace) = 92.6% P(U-iT-sec) = 100.0%

04/22/2001ecs289K: Intention Driven iTrace12

04/22/2001ecs289K: Intention Driven iTrace13

04/22/2001ecs289K: Intention Driven iTrace14

04/22/2001ecs289K: Intention Driven iTrace15

04/22/2001ecs289K: Intention Driven iTrace16

04/22/2001ecs289K: Intention Driven iTrace17 Issues How to determine the intention bit? –Policy to set the bit. How to distribute the intention bits to routers globally? –Utilize/extend BGP! How to use the intention bits at each router?

04/22/2001ecs289K: Intention Driven iTrace18 How to distribute I(n)? YABE: (Yet Another BGP Extension) –For every BGP route update, we include I(n) as a new string in the community attribute: 0x[iTrace-Intention]:0x[0-1] (optional & transitive) –These I(n) values will be forwarded or even aggregated by the routers who understand this new community attribute. aggregation: I(new) = max {I(n)} –Rate-Limiting on Intention Update: should not be more frequent than Keep-Alive messages. should not trigger any major route computation.

04/22/2001ecs289K: Intention Driven iTrace19 The iTrace Statistics Model Packet buffering Routing table lookup Forward process iTrace Stochastic Process Should this packet be iTraced? Yes, we should generate an iTrace for this packet?

04/22/2001ecs289K: Intention Driven iTrace20 iTrace Trigger Packet buffering Routing table lookup Forward process iTrace Stochastic Process If yes, pick the N th packet in the buffer…. Should we generate an iTrace message now? iTrace Trigger

04/22/2001ecs289K: Intention Driven iTrace21 A simple design BGP table I(n) iTrace bit iTrace Process Add two bits to the routing table: (1). I(n): Intention Bit Value associated with this entry (2). iTrace bit: whether we need to generate an iTrace message for this entry now. per ~20K pkts

04/22/2001ecs289K: Intention Driven iTrace22 Handling an iTrace Trigger BGP table I(n) iTrace bit iTrace Process If all I(n)’s are zero, shut-off the iTrace trigger process. Set the iTrace bit on all the entries with I(n) = 1.

04/22/2001ecs289K: Intention Driven iTrace / / / / / / / / / / / /1600 (1). Before iTrace trigger: (2). After iTrace trigger: I(n) iTrace bit

04/22/2001ecs289K: Intention Driven iTrace / / / / / /16 (3). After iTrace sent: I(n) iTrace bit

04/22/2001ecs289K: Intention Driven iTrace25 Processing Overhead Processing for each data packet: 1. if the iTrace flag bit is 1, (1). send an iTrace message for this data packet. (2). reset all the iTrace bits to 0. 1/20K iTrace message trigger occurs: 1. Set all the iTrace bits on if I(n) = 1.

04/22/2001ecs289K: Intention Driven iTrace26 The Aggregation Problem SlaveR1R1 R2R2 Victim 4K att-v1-pkt/sec 50K att-v2-pkt/sec 146K normal-pkt/sec P(U-iTrace) = 2% #iTrace/sec = 10 P(U-iT-sec) = 18% I(Victim-1) = 1 P(U-iTrace) = 7.4% for 4K traffic. P(U-iT-sec) = 53.7% 4K att-v1-pkt/sec 16K agg-v1-pkt/sec 50K att-v2-pkt/sec 130K normal-pkt/sec P(U-iTrace) = 2% #iTrace/sec = 10 P(U-iT-sec) = 18% I(Victim-1) = 1 P(U-iTrace) = 5.7% for 20K traffic. P(U-iT-sec) = 44.4%

04/22/2001ecs289K: Intention Driven iTrace27 Summary for Intention iTrace Improve the probability of “useful” iTrace. Require some “minor” changes to the router forwarding process. Require another BGP extension. –We need to verify that this extension will be interoperable well with existing BGP nodes. The amount of generated iTrace messages should be no more than the current iTrace proposal.