1. High Performance Research Network Dept. / Supercomputing Center 1 DDoS Detection and Response System NetWRAP : Running on KREONET Yoonjoo Kwon yulli@kisti.re.kr High Performance Research Network Dept. Supercomputing Center KISTI

2. High Performance Research Network Dept. / Supercomputing Center 2 Table of contents  Backgrounds  Motivations  Contribution and Results  Summaries and Future Plans

3. High Performance Research Network Dept. / Supercomputing Center 3 Backgrounds  DDoS attacks are being appeared continuously  February, 2000 Yahoo, Amazon  January, 2003 Korea

4. High Performance Research Network Dept. / Supercomputing Center 4 High Low 1980198519901995 2001 password guessing password cracking exploiting known vulnerabilities disabling audits back doors hijacking sessions sniffers packet spoofing GUI automated probes/scans denial of service www attacks Tools Attackers Intruder Knowledge Attack Sophistication “stealth” / advanced scanning techniques burglaries network mgmt. diagnostics distributed attack tools binary encryption Source: CERT/CC Backgrounds  Attack tools over time

5. High Performance Research Network Dept. / Supercomputing Center 5 Backgrounds Control Message Attack Flow target  The DDoS attack  Consumes host resources ( Memory & Processor Cycles )  Consumes network resources ( Bandwidth & Router resources ) legitimate user

6. High Performance Research Network Dept. / Supercomputing Center 6 10Gbps 40Gbps Daejeon SuperSIReN Seoul Motivation  DDoS attacks have been detected frequently  Manual reaction is too slow  Automatic DDoS detection and response system should be needed udp flooding tcp flooding ICMP Worm

7. High Performance Research Network Dept. / Supercomputing Center 7 Our Detection System  netflow data (version 5)  detection approaches  Signature-based Misuse TCP traffic Ex) It would be very unusual for a host to receive 10,000 connection attempts per second –If TCP Sync flow > 10000 and all flows go to a destination then alert  Anomaly-based What is typical? Non-TCP traffic Mean and standard deviation of numbers of flow

8. High Performance Research Network Dept. / Supercomputing Center 8 Our Response System  Response system traces back the nearest routers from DDoS agent in domain  Response system have a network topology  All routers have to export the netflow data  Response system applies ratelimit command to the nearest routers

9. High Performance Research Network Dept. / Supercomputing Center 9 Our Response System Detection system Response system x x x x x x x x An Administrative domain DDIP

10. High Performance Research Network Dept. / Supercomputing Center 10 Overview of NetWRAP  NetWRAP : NetWork Resource Abuse Preventive  NetWRAP system uses netflow data  Functions are  to detect DDoS attacks  to traceback DDoS agents  to control DDoS traffic Victim DDIP NetWRAP Server Rate Limit Victim IP Attack Direction Target Protocol NetWRAP Agent DDoS Agent DDoS Agent

11. High Performance Research Network Dept. / Supercomputing Center 11 Test Results   Router : Cisco 7200 series, IOS 12.3   Number of DDoS agents : 3   DDoS Attack Tool : flitz   Cross Traffic : UDP 19.0Mbps(iperf)   RTT/Loss Test between ‘Site P’ and ‘Site Q’ DDoS Agent DDoS Agent NetWRAP Agent Victim(203.230.7.205) DDIP NetWRAP Server Rate Limit Site P Site Q ISP A ISP B RTT/Loss Test 25Mbps 1Gbps

12. High Performance Research Network Dept. / Supercomputing Center 12 Normal Loss DDoS Attack DDOS Attack Loss Starting NetWRAP Test Results(skping) Loss: 0% RTT : 1.23ms Loss: 30.9% RTT : 190.15ms Loss: 8.73% RTT : 189.98ms Loss: 0% RTT : 4.65ms

13. High Performance Research Network Dept. / Supercomputing Center 13 Section of applying NetWRAP to STAR TAP Non-Applying Defending against TCP Sync Flooding Section of applying NetWRAP to STAR TAP TCP Sync Defending against Nachi Worm Results  Applying NetWRAP to STAR TAP link

14. High Performance Research Network Dept. / Supercomputing Center 14 Summaries  DDoS attacks are appeared continuously  We developed NetWRAP system using netflow data  We got successful test results  We deployed NetWRAP system to STAR TAP, international link

15. High Performance Research Network Dept. / Supercomputing Center 15 Future Plans  We plan to  update detecting engine (NetWRAP Agent) until June, 2004 Packet count

16. High Performance Research Network Dept. / Supercomputing Center 16 Welcome to join us  We would like  to form a shared infrastructure capable of defending network against DDoS attack we are going to update our system until June after June, we want to cooperate with other ISPs if anyone in NOC members are interested in our system, contact me –yulli@kisti.re.kr