1. An Wang, Aziz Mohaisen, Wentao Chang, Songqing Chen
Delving into Internet DDoS Attacks by Botnets: Characterization and Analysis
An Wang, Aziz Mohaisen, Wentao Chang, Songqing Chen
2015 IEEE/IFTP International Conference on Dependable Systems and Networks
Presented by Ker-Hsuan Liao

2. Outline Introduction Dataset Collection and Methodology
Overview of DDoS Attacks
Analysis and Prediction of DDoS Target and Source
Analysis of Collaborative Attacks
Conclusion

3. Outline Introduction Dataset Collection and Methodology
Overview of DDoS Attacks
Analysis and Prediction of DDoS Target and Source
Analysis of Collaborative Attacks
Conclusion

4. Introduction
Today, internet Distributed Denial of Services (DDoS) attacks are prevalent with the ease of access to large numbers of infected machines, collectively called botnets.
The duration, intensity, and diversity of attacks are on the rise.
The report shows that the average DDoS attack size has increased by 245% in 2014 compared to in 2013.
Another report shows that a clear increase in the average duration of DDoS attacks from 60 minutes in the first quarter of 2014 to 72 minutes in second quarter of the same year.

5. Introduction
Today’s malicious actors are not limited to sophisticated machines, like servers and personal computers;
Recent DDoS attacks were reportedly utilizing fridges, or embedded devices, like monitoring cameras.

6. Introduction
Understanding the current trends in today’s DDoS attacks is an important phase in devising effective defenses.
Existing studies in this regard are based on traffic collected locally, or infiltrating into a botnet.
A large scale view of today’s DDoS attacks is missing.

7. Introduction
In this paper, we present our study of DDoS attacks and analysis.
The dataset utilized in this study focused on DDoS attacks launched by various botnet families across the Internet.
In a seven-month period captured in our dataset, a total of different DDoS attacks were observed, which were launched by 674 different botnets coming from 23 different botnet families.
These attacks targeted 9026 different IPs that belong to organizations in 186 countries.

8. Introduction Our analysis revealed some highlight includes:
Geolocation analysis.
The geospatial distribution of the attacking sources follows certain patterns, which enables very accurate source prediction of future attacks for most active botnet families.
Target perspective.
Multiple attacks to the same target exhibit strong patterns of inter-attack time interval, allowing accurate start time prediction of the next anticipated attacks from certain botnet families.
There is a trend for different botnets to launch DDoS attacks targeting the same victim.

9. Outline Introduction Dataset Collection and Methodology
Overview of DDoS Attacks
Analysis and Prediction of DDoS Target and Source
Analysis of Collaborative Attacks
Conclusion

10. Dataset Collection and Methodology
Our dataset is provided by third-party through monitoring Internet infrastructures, using both active and passive measurement techniques.
Host participating in the given botnet, by communicating with pieces of infrastructure infected by that malware family are then enumerated and monitored, and their activities are logged and analyzed.

11. Dataset Collection and Methodology
Collection methodology
Traces of traffic associated with various botnets are collected at various points on the Internet, in cooperation with various ISPs.
Traffic logs are then analyzed to attribute and characterize attacks.
The analysis are guided by two general principles:
(1) the source of the traffic is an infected host participating in a botnet attack.
(2) the destination of the traffic is a targeted client.

12. Dataset Collection and Methodology
By tracking activities of 23 different known botnet families, the dataset captures a snapshot of each family every hour from 08/29/2012 to 03/24/2013, a total of 207 days, or about 7 months of valid and marked attack logs.
In the log, each DDoS attack is labeled with a unique DDoS identifier, corresponding to an attack by given DDoS malware family on a given target.
Other attributes and statistics of the dataset are shown in Table I.

13. Dataset Collection and Methodology

14. Dataset Collection and Methodology
Features and statistics
The feature, attack category, which refers to the nature of the DDoS attacks by classifying them into various types based on the protocol utilized for launching them: HTTP, TCP, UDP, Undetermined, ICMP, Unknown, and SYN.
The feature, longitude and latitude of each IP address, are obtained using a highly-accurate geo-mapping service during the trace collection.
We also generate the individual city and organization of each IP address involved in an attack using highly accurate service, called Digital Element services.

15. Dataset Collection and Methodology
Digital Element services
IP targeting
Provide city/town and ZIP/postcode level accuracy.

16. Dataset Collection and Methodology
Feature and statistics
Table II sums up some statistics of our dataset, including information from both the attacker and the target sides.
Over a period of 28 weeks, different DDoS attacks were observed. These attacks were launched by 674 different botnets.
These attacks targeted victims located in 84 different countries, 616 cities, involving 1074 organizations, and residing in different autonomous systems (ASes).

17. Dataset Collection and Methodology

18. Dataset Collection and Methodology
Attack mechanisms
Figure 1 shows the statistics of different protocols.
The dominant protocol used in these attacks is HTTP, followed by UDP and TCP.
Table III show the breakdown of transport types used by different botnet families.
The last column in the table shows the number of attacks belonging to each type.
A botnet could utilize multiple attack types
For example, Blackenergy supports different transport mechanism of attack traffic, including HTTP, TCP, UDP, ICMP, and SYN.

19. Dataset Collection and Methodology
Attack mechanisms

20. Dataset Collection and Methodology

21. Dataset Collection and Methodology
Comparison
Most of exist paper’s work is concerned with a single network.
Our work is at large scale.

22. Outline Introduction Dataset Collection and Methodology
Overview of DDoS Attacks
Analysis and Prediction of DDoS Target and Source
Analysis of Collaborative Attacks
Conclusion

23. Overview of DDoS Attacks
Not all of the 23 botnets logged in our dataset are active all the time.
Among them, 10 families are more active than others.
So in this section we focus on analyzing attacks launched by those 10 families:
Aldibot, BlackEnergy, Colddeath, Darkshell, DDoSer, DirJumper, Nitol, Optima, Pandora, and YZF.

24. Overview of DDoS Attacks
Attack distribution
For studying the attack distribution along time, we extract the beginning time of each attack and plotted the aggregate number of attack over the period of 28 weeks in figure 2.
We find that on average there are 243 DDoS attacks launched by the 10 botnet families everyday.
The maximum number of simultaneous DDoS attacks per day was 983 attacks on August 30,

25. Overview of DDoS Attacks

26. Overview of DDoS Attacks
We did not find any obvious daily, weekly, monthly patterns in figure 2.
This is because DDoS attacks typically are not user-driven, thus lack recurring patterns.

27. Overview of DDoS Attacks
We define the intervals between two DDoS attacks similar to that of the inter-arrival time:
The time interval between any two consecutive attacks launched by the same botnet family.
The time interval between any two consecutive attacks launched on the same target across multiple families.

28. Overview of DDoS Attacks

29. Overview of DDoS Attacks
Attack intervals observed from all attacks and family-based attacks show consistent patterns.
From figure 3, we can observe some thing below.
Clearly, more than half of the attacks are launched simultaneously.
For family based attacks, 80% of the attack intervals lasted less than 1081 seconds.
The average DDoS attack interval was 3060 seconds.
15% of the attack fall in the [1000,10000] seconds interval.

30. Overview of DDoS Attacks
We can classify attacks into two categories
(1) attacks launched by a single botnet family
(2) attacks launched by multiple families
Attacks in the first category happened times.
Attacks in the second category happened 956 times.

31. Overview of DDoS Attacks
For the first category, we found that seven out of 10 botnet families exhibit such behavior.
Among all families, Dirjumper is the most active in launching simultaneous attacks.
For the second category, we found that most common combinations were Dirjumper with Blackenergy and Dirjumper with Pandora, which happened 391 and 338 times respectively.
Further investigation is in section, ”Analysis of Collaborative Attacks.”

32. Overview of DDoS Attacks
Random interval distribution
From figure 4 we observe that the attack intervals are random.

33. Overview of DDoS Attacks
Figure 5 shows the attack interval CDF for each family where the x-axis represents the attack intervals and each color represents a single family.

34. Overview of DDoS Attacks
From figure 5, we observe that Blackenergy, Aldibot and Optima launch 40%-50% of attacks simultaneously.
From the same figure, we observe that the activeness of botnets differ by an order of magnitude, with Nitol and Aldibot being the least active ones.

35. Overview of DDoS Attacks
Figure 6 depicts the durations of all DDoS attacks.
As shown, the attack duration varies significantly: while the average duration is seconds, the median is only seconds.

36. Overview of DDoS Attacks
Figure 7 further shows the corresponding CDF of the attack duration.
As shown, 80% of the attacks last for less than seconds(~four hours).

37. Overview of DDoS Attacks
From figure 7, we find that four hours might be a reasonable duration for DDoS attacks to be detected and mitigated.
The longer the attack lasts, the higher its chances are of being detected.
By limiting attack to four hours, the attacker can successfully reduce the detection rate.

38. Outline Introduction Dataset Collection and Methodology
Overview of DDoS Attacks
Analysis and Prediction of DDoS Target and Source
Analysis of Collaborative Attacks
Conclusion

39. Analysis and Prediction of DDoS Target and Source
We shift our attention to geolocation of these attacks.
To further quantify the geolocation affinity, we extract all the bots involved in DDoS attacks for each family and aggregate the number of these bots per week.
Thus, we are able to observe the attack source and their migrations over weeks.

40. Analysis and Prediction of DDoS Target and Source
Figure 8 shows the dynamic per week as a shift pattern of Optima.

41. Analysis and Prediction of DDoS Target and Source
From figure 8, we can see clearly that most of the attack sources will be limited to the same group of countries.

42. Analysis and Prediction of DDoS Target and Source
In our dataset, each DDoS attack could be illustrated by a series of snapshots along time.
In each snapshot, IP addresses of all bots evolved at the given time were recorded.
Since every IP address corresponds to a single location, we are able to identify the locations of all the bots involved on a map.
To characterize source locations, we find the geological center point of the various locations of IP addresses at any time.
Then, we calculate the distance between each bot and the center point, and add the distance together.

43. Analysis and Prediction of DDoS Target and Source
We use these distances to represent the geolocation distribution of the bots.
The distance has a sign to indicate direction:
positive indicates east or north, and negative indicates west and south.
A sum of zero means that participating bots are geographically symmetric.

44. Analysis and Prediction of DDoS Target and Source

45. Analysis and Prediction of DDoS Target and Source
From figure 9, we observe that for the families Optima and Blackenergy, the distances exhibit a normal distribution, whereas other families have a skewed distribution.
The families Dirtjumper and Pandora both have more than 40% distribution distances of zero, indicating complete geographical symmetry.
Dirtjumper and Pandora collaborate closely, which may explain the similar distribution of their geolocation distances.

46. Analysis and Prediction of DDoS Target and Source
We plot the geolocation distances along time in figure 10 and figure 11.
From these two figures, we see that periodic patterns exist in both cases and the distance values vary around a certain mean value.
This indicate that these values are predictable or even stable.

47. Analysis and Prediction of DDoS Target and Source

48. Analysis and Prediction of DDoS Target and Source

49. Analysis and Prediction of DDoS Target and Source
We build a prediction model over this data.
We use the Autoregressive Integrated Moving Average (ARIMA) model.
To evaluate the results of our prediction model, we split our data into two parts, the first half is for training and the other half is used for prediction and evaluation.
The prediction results are shown in figure 12 and figure 13.

50. Analysis and Prediction of DDoS Target and Source

51. Analysis and Prediction of DDoS Target and Source

52. Analysis and Prediction of DDoS Target and Source
From these figures, we can observe that the predicted results are almost identical with the ground truth value.
We further calculate the numerical statistics for all the families in Table IV.

53. Analysis and Prediction of DDoS Target and Source
From table IV, we can see that for all the families, both the mean value and the standard deviation are close to those of the ground truth, except for family Dirtjumper and Colddeath.

54. Analysis and Prediction of DDoS Target and Source
Country-level analysis
The third column in Table V shows the top five popular targeted countries of each active family.

55. Analysis and Prediction of DDoS Target and Source
Organization-level analysis
Figure 14 shows the organization-level analysis in February 2013 for Pandora.
From this figure, we can identify some hotspots in Russia and the USA.

56. Analysis and Prediction of DDoS Target and Source
We sorted the attacks with respect to their time and calculate the attack intervals between consecutive attacks toward the same target.
Figure 15 displays two examples of targets by the family Blackenergy.

57. Analysis and Prediction of DDoS Target and Source
Figure 15 shows some repeated patterns of peaks and dips of their attack interval series.
It is possible to predict those series by modeling using an ARIMA model to forecast the next attack interval value, thus the start time of the next attack.
Figure 16 and figure 17 shows that predicted values match the ground truth value.

58. Analysis and Prediction of DDoS Target and Source

59. Analysis and Prediction of DDoS Target and Source

60. Analysis and Prediction of DDoS Target and Source
The country and organization level target analyses provide insights for defenses.
Findings concerning the country-level characterization can set some guidelines on country-level prioritization of disinfection.
Understanding the attack interval pattern guides preparation for the attacks beforehand by allocating needed resources.
Prediction with a high accuracy minimizes damages caused by DDoS attacks.

61. Outline Introduction Dataset Collection and Methodology
Overview of DDoS Attacks
Analysis and Prediction of DDoS Target and Source
Analysis of Collaborative Attacks
Conclusion

62. Analysis of Collaborative Attacks
We found that different botnets (in the same family corresponding to different generations, or from different families) may collaborate to attack the same target.
Basically, if different botnets are targeting the same target, and their starting time is simultaneous, and their duration difference is within half an hour, then they are regarded as collaborations.
Table VII shows the collaboration results using both intra- family and cross-family collaborations.
Among these collaborations, we observe that Dirtjumper and Darkshell have the most intra-family collaborations.

63. Analysis of Collaborative Attacks

64. Analysis of Collaborative Attacks
Figure 18 shows the collaboration attack magnitude by the family Dirtjmper.

65. Analysis of Collaborative Attacks
From this figure, we can see that for most collaborations, there are two botnets involved, where the average number of botnets involved in the collaboration is 2.19.
Looking into figure 18, we also find that for most bars along the same timestamp, they have the same height.
The reason of this is that for all the botnets involved in the collaboration, detailed instructions were perhaps given for the attack magnitude.

66. Analysis of Collaborative Attacks
From table VII, we can see that all families involved in inter- family collaborations had collaborated with Dirtjumper.
Among these collaborations, Dirtjumper and Pandora collaborated with each other the most.
The collaborations between Dirtjumper and Pandora involved 96 unique targets, which were located in 16 countries, 58 organizations.
The most popular three countries were Russia, the USA, and Germany.

67. Analysis of Collaborative Attacks
Figure 19 shows the duration and attack magnitude of collaborations between Dirtjumper and Pandora as they change over time.
From this figure, we observe that the attack magnitude for these two families are almost equal (有點牽強???) for most of the attacks, and the duration of these two families are almost identical.
Another observation we make is that the attack magnitudes are not very high for both families except for an outlier.

68. Analysis of Collaborative Attacks

69. Analysis of Collaborative Attacks
Thus far, we consider the collaboration as multiple DDoS attacks are launched at the same time.
Another form of collaboration could be multiple DDoS attacks happening continuously one after another.
For this purpose, we extract the DDoS attacks on a given target that happen consecutively (i.e., the second attack happens at the end of the first attack, or within 60 second margin over overlap).
We found that four families had this type of collaboration:
Darkshell, Ddoser, Dirtjumper and Nitol.

70. Analysis of Collaborative Attacks
Figure 20 displays the CDF of the intervals between two consecutive attacks.
The figure shows that nearly 80% of the consecutive attacks happened within 30 seconds.

71. Analysis of Collaborative Attacks

72. Analysis of Collaborative Attacks
Figure 21 shows the attack magnitude of all consecutive DDoS attacks.
In this figure, the x-axis represents the 28 week timespan of our dataset, and the y-axis represents all the targets attacked by these consecutive DDoS attacks.
Each dot represents a single DDoS attack.
The dots displayed consecutively in a row indicate that the attacks were happened consecutively.
The size of each marker represents the attack magnitude of each DDoS attack.

73. Analysis of Collaborative Attacks

74. Outline Introduction Dataset Collection and Methodology
Overview of DDoS Attacks
Analysis and Prediction of DDoS Target and Source
Analysis of Collaborative Attacks
Conclusion

75. Conclusion
Most of the existing studies have mainly focused on designing various defense schemes.
The measurement and analysis of large scale Internet DDoS attacks are not very common.
Although understanding DDoS attacks patterns is the key to defending against them.

76. Conclusion
In this study, with the access to a large scale dataset, we were able to collectively characterize today’s DDoS attacks from different perspectives.
Our deep investigation reveals several interesting findings about today’s botnet based DDoS attacks.

77. Thanks for listening.