1. Inferring Denial of Service Attacks David Moore, Geoffrey Volker and Stefan Savage Presented by Rafail Tsirbas 4/1/20151

2. Outline Denial of Service Attacks Motivation & Limitations Backscatter Analysis Results Conclusion 4/1/2015Footer Text2

3. Denial of Service Attacks Logic Attacks o “Ping of Death” Flooding Attacks o Overflow victim’s computer 4/1/2015Footer Text3

4. Flooding Attacks The attacker tries to overflow victim’s pc o SYN Floods o TCP DATA o TCP NULL o ICMP Echo Requests o DNS Request o “Monlist” o … 4/1/2015Footer Text4 Victim Attacker

5. Flooding Attacks The attacker tries to overflow victim’s pc o SYN Floods o TCP DATA o TCP NULL o ICMP Echo Requests o DNS Request o Zero Day Attack o NTP “monlist” o … 4/1/2015Footer Text5 AttackerVictim

6. Flooding Attacks Distributed Denial of Service Attacks o A lot more power o Hide easier o More sophisticated attack IP spoofing o Change source IP address o Tools Shaft, TFT etc 4/1/2015Footer Text6 Attacker Botnets

7. 4/1/2015Footer Text7 Outline Denial of Service Attacks Motivation & Limitations Backscatter Analysis Results Conclusion

8. Motivation & Limitations “How prevalent are Denial of Service Attacks in the Internet today?” Base line for long term analysis Limitation Factors 4/1/20158

9. 9 Outline Denial of Service Attacks Motivation & Limitations Backscatter Analysis Results Conclusion

10. Backscatter analysis 4/1/2015Footer Text10

11. Backscatter effect 4/1/2015Footer Text11 Attacker Victim Host A Host B Host C

12. Backscatter analysis 4/1/2015Footer Text12 Attacker Victim Host A Host B Host C M packets N pc’s monitoring

13. Backscatter analysis 4/1/2015Footer Text13

14. Attack classification Flow-based o How many, how long, what kind Event-based o Fixed time windows 4/1/2015Footer Text14

15. Backscatter analysis They monitored /8 Network 3 weeks long 4/1/2015Footer Text15 /8 Network Monitor

16. 4/1/2015Footer Text16 Outline Denial of Service Attacks Motivation & Limitations Backscatter Analysis Results Conclusion

17. Results 4/1/2015Footer Text17 Flow based Over 12,800 attacks 6,000 distinct IP addresses Almost 200 million backscatter packets Event-based 10,000 distinct IP addresses Almost 200 million backscatter packets

18. Results 4/1/2015Footer Text18

19. Responses Protocols 4/1/2015Footer Text19

20. Protocols 4/1/2015Footer Text20

21. Duration 4/1/2015Footer Text21

22. TLDs 4/1/2015Footer Text22

23. 4/1/2015Footer Text23 Outline Denial of Service Attacks Motivation & Limitations Backscatter Analysis Results Conclusion

24. Conclusions New techinque “backscatter analysis” DoS attacks exist 4/1/2015Footer Text24

25. Questions? 4/1/2015Footer Text25

26. Thank You! 4/1/2015Footer Text26