Network Flow-Based Anomaly Detection of DDoS Attacks Vassilis Chatzigiannakis National Technical University of Athens, Greece TNC 2004

Network Flow-based Anomaly Detection of DDoS Attacks - TNC 2004 Intrusion Detection An IDS is a system used for detecting network attacks They detect both successful and unsuccessful attacks They Detect attacks from insiders IDS Categories:  Host /Network based  They use Misuse /Anomaly detection  Distributed Intrusion Detection Systems

Network Flow-based Anomaly Detection of DDoS Attacks - TNC 2004 Intrusion Detection(2) Misuse Detection  Sniffs network packets  If known a signature is matched, it detects the attack  Resembles to an anti-virus system  Must be updated night and day

Network Flow-based Anomaly Detection of DDoS Attacks - TNC 2004 Intrusion Detection(3) Anomaly Detection  Checks for great variation from the normal behaviour of an entity  An entity could be a user, a computer or network link  Use of an expert system  The system has to be trained to become operational

Network Flow-based Anomaly Detection of DDoS Attacks - TNC 2004 Denial of Service Attacks An attack to suspend the availability of a service Until recently the "bad guys" tried to enter our systems. Now it’s: "If not us, then Nobody" DoS: single correctly made malicious packets against the target machine Distributed DoS: traffic flows from various sources to exhaust network or computing resources

Network Flow-based Anomaly Detection of DDoS Attacks - TNC 2004 Main Characteristics of DoS Variable targets:  Single hosts or whole domains  Computer systems or networks  Important  Important : Active network components (e.g. routers) also vulnerable and possible targets! Variable uses & effects:  Hacker "turf" wars  High profile commercial targets (or just competitors…).  Useful in cyber-warfare, terrorism etc.

Network Flow-based Anomaly Detection of DDoS Attacks - TNC Taking Control 2. Commanding the attack Distributed DoS Target domain "zombies" Pirated machines Domain A Pirated machines Domain B Attacker X

Network Flow-based Anomaly Detection of DDoS Attacks - TNC 2004 Netflow What is a flow? Defined by seven keys: Source IP address Destination IP address Source Port Destination Port Layer 3 Protocol Type TOS byte (DSCP) Input logical interface (ifIndex)

Network Flow-based Anomaly Detection of DDoS Attacks - TNC 2004 NetFlow Sequence Router (from Cisco.com) 1.Create and update flows in NetFlow Cache Inactive timer expired (15 sec is default) Active timer expired (30 min is default) NetFlow cache is full (oldest flows expire) RST or FIN TCP Flag Export Packet Payload (flows) 2.Expiration 3.Aggregation? e.g. Protocol-Port Aggregation Scheme becomes 4.Export Version Yes No Aggregated Flows – export Version 8 or 9 Non-Aggregated Flows – export Version 5 or 9 5.Transport Protocol

Our Solution: An anomaly detection tool OpenEye

Network Flow-based Anomaly Detection of DDoS Attacks - TNC 2004 OpenEye DDoS Attack Detection Tool Analyses flows that are exported from Cisco Netflow enabled routers Compatible with Netflow v9 Works with IPv4 and IPv6 traffic Uses anomaly detection algorithm based on specific metrics and thresholds Written in Java language

Network Flow-based Anomaly Detection of DDoS Attacks - TNC 2004 Implementation Two main modules: - Collector The Collector is responsible for receiving flow data from the Netflow enabled routers, information is analyzed and stored in a local data structure. - Detector The Detector is responsible for calculating the metrics and comparing the results to detection thresholds. It is periodically activated, implements extensive logging of detection events and generates notifications with security alerts to the administrator.

Network Flow-based Anomaly Detection of DDoS Attacks - TNC 2004 DoS Detection Metrics (1) Metrics for Packets/Flows based on deviation CP ij = Current Packets/Flows from interface i to j AP ij = Average Packets/Flows from interface i to j

Network Flow-based Anomaly Detection of DDoS Attacks - TNC 2004 DoS Detection Metrics (2) Number of flows with very small lifetime Number of flows with a very small number of packets Percentages of TCP/UDP traffic

Network Flow-based Anomaly Detection of DDoS Attacks - TNC 2004 Data structures Tables for number of packets and number of flows for every pair of interfaces Hash Tables with the Dst IP (key) and the number of packets and flows (values) for each IP for every pair of interfaces

Network Flow-based Anomaly Detection of DDoS Attacks - TNC 2004 Attack Graphs

Network Flow-based Anomaly Detection of DDoS Attacks - TNC 2004 Future Work More experiments Detection of worms Creation and testing of new metrics Usage of OpenEye as a part of a Distributed Intrusion Detection System

Network Flow-based Anomaly Detection of DDoS Attacks - TNC 2004 Acknowledgements Panoptis  GrNet  Ntua NOC  Netmode 

Questions and Answers