Inferring Denial of Service Attacks David Moore, Geoffrey Volker and Stefan Savage Presented by Rafail Tsirbas 4/1/20151

Outline Denial of Service Attacks Motivation & Limitations Backscatter Analysis Results Conclusion 4/1/2015Footer Text2

Denial of Service Attacks Logic Attacks o “Ping of Death” Flooding Attacks o Overflow victim’s computer 4/1/2015Footer Text3

Flooding Attacks The attacker tries to overflow victim’s pc o SYN Floods o TCP DATA o TCP NULL o ICMP Echo Requests o DNS Request o “Monlist” o … 4/1/2015Footer Text4 Victim Attacker

Flooding Attacks The attacker tries to overflow victim’s pc o SYN Floods o TCP DATA o TCP NULL o ICMP Echo Requests o DNS Request o Zero Day Attack o NTP “monlist” o … 4/1/2015Footer Text5 AttackerVictim

Flooding Attacks Distributed Denial of Service Attacks o A lot more power o Hide easier o More sophisticated attack IP spoofing o Change source IP address o Tools Shaft, TFT etc 4/1/2015Footer Text6 Attacker Botnets

4/1/2015Footer Text7 Outline Denial of Service Attacks Motivation & Limitations Backscatter Analysis Results Conclusion

Motivation & Limitations “How prevalent are Denial of Service Attacks in the Internet today?” Base line for long term analysis Limitation Factors 4/1/20158

9 Outline Denial of Service Attacks Motivation & Limitations Backscatter Analysis Results Conclusion

Backscatter analysis 4/1/2015Footer Text10

Backscatter effect 4/1/2015Footer Text11 Attacker Victim Host A Host B Host C

Backscatter analysis 4/1/2015Footer Text12 Attacker Victim Host A Host B Host C M packets N pc’s monitoring

Backscatter analysis 4/1/2015Footer Text13

Attack classification Flow-based o How many, how long, what kind Event-based o Fixed time windows 4/1/2015Footer Text14

Backscatter analysis They monitored /8 Network 3 weeks long 4/1/2015Footer Text15 /8 Network Monitor

4/1/2015Footer Text16 Outline Denial of Service Attacks Motivation & Limitations Backscatter Analysis Results Conclusion

Results 4/1/2015Footer Text17 Flow based Over 12,800 attacks 6,000 distinct IP addresses Almost 200 million backscatter packets Event-based 10,000 distinct IP addresses Almost 200 million backscatter packets

Results 4/1/2015Footer Text18

Responses Protocols 4/1/2015Footer Text19

Protocols 4/1/2015Footer Text20

Duration 4/1/2015Footer Text21

TLDs 4/1/2015Footer Text22

4/1/2015Footer Text23 Outline Denial of Service Attacks Motivation & Limitations Backscatter Analysis Results Conclusion

Conclusions New techinque “backscatter analysis” DoS attacks exist 4/1/2015Footer Text24

Questions? 4/1/2015Footer Text25

Thank You! 4/1/2015Footer Text26