Towards Coordinated, Network-Wide Traffic
Total Page:16
File Type:pdf, Size:1020Kb
Towards Coordinated, Network-Wide Traffic Monitoring for Early Detection of DDoS Flooding Attacks by Saman Taghavi Zargar B.Sc., Computer Engineering (Software Engineering), Azad University of Mashhad, 2004 M.Sc., Computer Engineering (Software Engineering), Ferdowsi University of Mashhad, 2007 Submitted to the Graduate Faculty of the School of Information Sciences in partial fulfillment of the requirements for the degree of Doctor of Philosophy University of Pittsburgh 2014 UNIVERSITY OF PITTSBURGH SCHOOL OF INFORMATION SCIENCES This dissertation was presented by Saman Taghavi Zargar It was defended on June 3, 2014 and approved by James Joshi, Ph.D., Associate Professor, School of Information Sciences David Tipper, Ph.D., Associate Professor, School of Information Sciences Prashant Krishnamurthy, Ph.D., Associate Professor, School of Information Sciences Konstantinos Pelechrinis, Ph.D., Assistant Professor, School of Information Sciences Yi Qian, Ph.D., Associate Professor, College of Engineering, Dissertation Advisors: James Joshi, Ph.D., Associate Professor, School of Information Sciences, David Tipper, Ph.D., Associate Professor, School of Information Sciences ii Copyright c by Saman Taghavi Zargar 2014 iii Towards Coordinated, Network-Wide Traffic Monitoring for Early Detection of DDoS Flooding Attacks Saman Taghavi Zargar, PhD University of Pittsburgh, 2014 DDoS flooding attacks are one of the biggest concerns for security professionals and they are typically explicit attempts to disrupt legitimate users' access to services. Developing a com- prehensive defense mechanism against such attacks requires a comprehensive understanding of the problem and the techniques that have been used thus far in preventing, detecting, and responding to various such attacks. In this thesis, we dig into the problem of DDoS flooding attacks from four directions: (1) We study the origin of these attacks, their variations, and various existing defense mecha- nisms against them. Our literature review gives insight into a list of key required features for the next generation of DDoS flooding defense mechanisms. The most important requirement on this list is to see more distributed DDoS flooding defense mechanisms in near future, (2) In such systems, the success in detecting DDoS flooding attacks earlier and in a distributed fashion is highly dependent on the quality and quantity of the traffic flows that are covered by the employed traffic monitoring mechanisms. This motivates us to study and understand the challenges of existing traffic monitoring mechanisms, (3) We propose a novel distributed, coordinated, network-wide traffic monitoring (DiCoTraM) approach that addresses the key challenges of current traffic monitoring mechanisms. DiCoTraM enhances flow coverage to enable effective, early detection of DDoS flooding attacks. We compare and evaluate the performance of DiCoTraM with various other traffic monitoring mechanisms in terms of their total flow coverage and DDoS flooding attack flow coverage, and (4) We evaluate the effectiveness of DiCoTraM with cSamp, an existing traffic monitoring mechanism that iv outperforms most of other traffic monitoring mechanisms, with regards to supporting early detection of DDoS flooding attacks (i.e., at the intermediate network) by employing two existing DDoS flooding detection mechanisms over them. We then compare the effectiveness of DiCoTraM with that of cSamp by comparing the detection rates and false positive rates achieved when the selected detection mechanisms are employed over DiCoTraM and cSamp. The results show that DiCoTraM outperforms other traffic monitoring mechanisms in terms of total flow coverage and DDoS flooding attack flow coverage. v PREFACE First, I am very grateful to my advisor, Professor James Joshi, for his great guidance, continuous encouragement, invaluable suggestions, and support throughout my PhD. I would like to thank him for giving me the great opportunity to work under his supervision as a member of LERSAIS lab. I am also very grateful to my co-advisor, Professor David Tipper, for his help and guid- ance that have shaped much of the theoretical and technical basis in this thesis. I have been and am going to be amazed by his incredible attention to technical detail. I hope I have inherited at least some of these characteristics from him during this time. I would also like to thank my dissertation committee members Professor Prashant Kr- ishnamurthy, Professor Yi Qian, and Professor Konstantinos Pelechrinis for their valuable feedback on my work. I would like to acknowledge the confidence and support that Professor Prashant Krishnamurthy have shown for my work. His support when things were getting tough was a great morale booster and he has always surprised me on many occasions by his great insights to get to the depth of a research question even without detailed discussions. I wish to thank my fellow colleagues at LERSAIS lab, Hassan Takabi, Amirreza Ma- soumzadeh Tork, Nathalie Angel Baracaldo, Jesus Gonzales, Lei Jin, and Xulian Long for the fruitful discussions and the knowledge they shared with me. I also thank the faculty and staff of the School of Information Sciences, especially people listed below for being incredibly resourceful and awesome. I have never come across something that they did not know the answer to. • Dean Ron Larsen, Dr. Martin Weiss, Kelly Shaffer, Wesley Lipschultz, Brandi Belleau, Sharon Bindas, Sandra Brandon, Marcy Walls, and Corey James. I also acknowledge that the research presented in this dissertation has been supported by vi the financial assistance provided through the School of Information Sciences at the University of Pittsburgh, US National Science Foundation Computing and Communication Foundations (CCF) award CCF-0720737, and Cisco systems Inc. award. Finally, I would like to thank my beloved parents, sister, and brother for their endless support in every step I took so far towards my career goals. I have been so lucky to have such luxury. This thesis would not have been possible without the encouragement of my family. vii TABLE OF CONTENTS PREFACE ......................................... vi 1.0 Introduction and Motivation .......................... 1 1.1 Thesis Statement and Challenges ........................ 2 1.1.1 Challenge 1: Network-wide approach for traffic monitoring policy en- forcement .................................. 3 1.1.2 Challenge 2: Resource-aware DDoS flooding attack tailored monitoring policy .................................... 4 1.1.3 Challenge 3: Distributed monitoring policy to enable distributed de- tection of DDoS flooding attack flows .................. 4 1.2 Proposed Research and Contributions ..................... 5 1.3 Scope of the Thesis ................................ 7 1.4 Organization ................................... 8 2.0 DDoS Flooding Attacks & Existing Defense Mechanisms ......... 9 2.1 DDoS problem definition & past incidents ................... 10 2.2 DDoS attacks: scope and classification ..................... 12 2.2.1 Network/transport-level DDoS flooding attacks ............. 13 2.2.1.1 Flood attacks ........................... 13 2.2.1.2 Protocol exploitation flood attacks ............... 13 2.2.1.3 Reflection-based flood attacks .................. 13 2.2.1.4 Amplification-based flood attacks ................ 13 2.2.2 Application-level DDoS flooding attacks ................. 14 2.2.2.1 Reflection/amplification based flood attacks .......... 14 viii 2.2.2.2 HTTP flooding attacks ...................... 15 2.3 DDoS defense: scope and classification ..................... 18 2.3.1 Classification based on the deployment location ............. 21 2.3.1.1 Defense mechanisms against network/transport-level DDoS .. 21 2.3.1.2 Defense mechanisms against application-level DDoS ...... 26 2.3.2 Classification by the point in time (i.e., between the start and end of a DDoS attack) that defense takes place .................. 28 2.3.2.1 Before the attack (attack prevention) .............. 28 2.3.2.2 During the attack (attack detection) .............. 30 2.3.2.3 After the attack (attack source identification and response .. 31 2.4 Summary ..................................... 33 3.0 Traffic Monitoring Mechanisms: Current Practice & Challenges .... 35 3.1 Packet sampling vs. Flow sampling (a.k.a. Flow monitoring) ......... 35 3.1.1 Discussion: Prioritized flow monitoring ................. 37 3.2 Traffic monitoring as a network management task ............... 38 3.2.1 Device-centric approaches ......................... 40 3.2.1.1 Existing router primitives: .................... 40 3.2.1.2 Additional middleboxes: ..................... 40 3.2.1.3 Enhancing current router primitives: .............. 40 3.2.2 Network-wide approaches ......................... 41 3.3 cSamp: A centrally managed system-wide flow monitoring mechanism ... 42 3.3.1 Case Study: cSamp's vs. other packet/flow sampling mechanisms ... 44 3.3.2 Discussion: ................................. 47 3.4 Summary ..................................... 48 4.0 DiCoTraM: A Distributed and Coordinated DDoS flooding attack tai- lored flow Traffic Monitoring .......................... 49 4.1 Introduction ................................... 49 4.2 DiCoTraM: an overview ............................. 50 4.2.1 Discussion: Router memory constraints ................. 53 4.2.2 Assumptions ................................ 55 ix 4.2.3 Notation .................................. 55 4.2.4 The Set-up Process ............................ 57 4.2.5 Proposed MIP formulation ........................ 58 4.2.6 Proposed heuristic ............................