1. Identifying the scan and attack infrastructures behind amplification DDoS attacks
Authors – Johannes Krupp, Michael Backes, and Christian Rossow(2016)
Presented by - Aditya Walanj

2. Motivation
Amplification DDoS attacks have become serious threat to Internet users.
Attack bandwidths can be several 100’s of Gbit/s
Attackers can spoof source IP of requests sent to Open Internet Services.
Victims don’t know who to contact to prevent these attacks.
Goal is to render a network unusable by flooding target network with huge traffic.

3. Background
All amplification attacks are UDP based since it’s a connection-less protocol.
Four parties:
Attacker: Sends requests with spoofed IP
Amplifiers: Servers which act as reflectors
Victim: Source IP specified in request
Scanner: Used to find amplifiers by sending requests and recording responses.
Attacker leverages the amplification vectors in Network Protocols

4. Problem A little is known about origin of attack
Revealing attack sources is a significant problem
Spoofed nature of traffic makes it difficult
False source address provided to hide identity or impersonate another system
Solution:
Attributing attacks to Scan infrastructures using honeypot techniques.
Mapping Scan infrastructure to attackers using TTL trilateration techniques.

5. Solution Background Method fulfils three important goals:
Works at real time so we can attribute attacks on the fly
Attribution does not require cooperation between ISP’s
Provides probabilistic guarantees showing confidence levels of attribution outcomes.
A honeypot is computer security mechanism that contains valuable data which is monitored to detect unauthorised use.
AMPPOT emulates a server offering 7 different UDP protocols that are abused. E.g. NTP, DNS
Selective response scheme
AMPPOT only selectively replies to requests
Each scanner will see a different set of deployed honeypots  Distinct attribution feature
Implement by fixing fraction of network to respond to scan  fraction set to 0.5

6. Solution Background (cont)
Three /28 Networks  48 Honeypot IPs
Each Scanner scans all 48 Honeypot IPs and has unique reply set of 24 IPs
In real world, may not query with one source but with multiple sources
Confidence levels determine how robust attribution is in real world conditions
Two sets: Query set and Reply set
Find probability p to falsely accuse a scanner
Confidence = 1- p

7. Methodology: Step 1 Potential Scanner behind attack In attack set
Attack: A stream of at least 100 packets from same source to same port within 1 hour.
Amplifier set depends greatly on scan prior to attack.
For every honeypot IP, maintain all aware sources (scanners).
Potential Scanner behind attack
In attack set

8. Results
Three cases:
Zero candidates: No scanner was aware of amplifiers  Non Attributable (2.5 %)
Exactly one candidate: Single scanner was aware of amplifiers  Attributable (79.9 %)
More than one candidate: Multiple scanners were aware of amplifiers  Non Unique (17.6 %)
Most attributed attacks and scanners were from US, Netherlands, and Lithuania.

9. Methodology: Step 2
Were the infrastructure used to perform scans also used to launch attacks ?
Distance (source, receiver) = TTL at source (Attacker) – TTL at receiver (Honeypot)
Assumption: Initial TTL is fixed and equal hop distance from same source to same honeypot.
Compare hop distances to identify if two packets originate from same source.
Validate TTL metric using RIPE Atlas:
Select 200 random probes to send packets to 11 most prominent honeypots
Honeypots record TTL values
Compute minimal distance from every pair of source using recorded TTL values
Derive thresholds from distances

10. Methodology: Step 2 (cont)
Measurements < threshold  same source
Measurements > threshold  different sources
True Positive: 1 Probe had two measurements below threshold
False Positive: 2 different Probes have two measurements below threshold
Apply methodology to dataset of scanners by comparing TTL vectors of scan event and attributed attacks.
34 out of 286 scanner were found malicious with 99.9 % confidence.

11. Criticism Limitations Improvements
Amplifier set used in attack was scanned with single public IP
Attackers may identify AMPPOT by its behaviour
Initial TTL is fixed  Randomization is possible.
All networks considered
Scanner doesn’t spoof source address during scanning
Increase Network size and decrease response ratio
Run AMPPOT in “proxy” mode
Better approach  IP traceback (marking packets)
Ignore Networks provided by ISP that prevent spoofing
Extend method to further validate scan infrastructures before mapping

12. Thankyou for listening