.TW DNS Security: NOC & ISP collaboration. Cheng-Yi Chen & Tszheng Guo, TWNIC

Transcription

1 .TW DNS Security: NOC & ISP collaboration Cheng-Yi Chen & Tszheng Guo, TWNIC

2 Defense against DDoS attacks with ISPs Guo Tszheng

3 outline Filter action Block DNS query traffic from abroad Filter traffic with white list Increasing response capacity Set-up the hidden DNS

4 .tw DNS face DDoS attack Domestic attack traffic Attack traffic from Abroad Avoid traffic pass edge router Traffic through cache.tw authoritative DNS server

5 Filter action- Block DNS quary traffic from abroad.tw DNS service domestic users majorly, local user availability is the first priority There are.tw DNS servers distribute globally, include local and abroad. When suffer DDoS attack,block the DDoS attack traffic from abroad on the border router to ensure domestic user can reach.tw DNS. According to past experience the action can filter out 95% traffic.

6 Block attack traffice on the border router Domestic attack traffic Attack traffic from Abroad Traffic through cache

7 Filter action- Filter traffic with white list Authoritative DNS server only service recursive DNS server, traffic from end user is abnormal. We analysis the DNS query log to find out which IPs are cache DNS servers and put they into white list, then configure the edge router to limit the bandwidth usage which DNS query traffic come from the IPs not in white list.

8 Domestic attack traffic Attack traffic from Abroad Filter by white list Traffic through cache

9 Increasing response capacity -Set-Up the hidden DNS Hidden DNS server is an DNS server only service Taiwan ISP s cache server When.TW DNS suffer DDoS attack,the ISP can configure their cache DNS servers to forward.tw queries to hidden DNS to make sure the.tw DNS availability.

10 Domestic attack traffic Attack traffic from Abroad Normal query traffic Traffic through cache Enable hidden DNS

11 DNS Network Operation Center (DNSNOC) Cheng-Yi Chen 11

12 Outlines System Architecture Probes Parameters Introduction of probes Bandwidth System Alive Response System overview 12

13 Probe based Cyber Security System System Architecture (1) DDoS Colocation A Switch Bandwidth Record Botnet Load balancer Other Service Alive System Response Attack Alert DNS

14 Data Storage Backup Receiver Probe based Cyber Security System Processes MsgLog System Architecture (2) - Probes Colocation A Colocation B switch Colocation C Machine / Device SNMP Bandwidth Record Load balancer Machine/ Device ICMP Alive Alert DNS CPU Proc top - 12:20:49 up 125 days, 20:00, 9 users, load average: 0.12, 0.08, 0.05 Tasks: 264 total, 1 running, 263 sleeping, 0 stopped, 0 zombie Cpu(s): 0.1%us, 0.2%sy, 0.0%ni, 99.7%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st Mem: k total, 5 SNMP Sys log System Response DNS Web TCP/UDP Response Mail

15 Outlines System Architecture Probes Parameters Introduction of probes Bandwidth System Alive Response System overview 15

16 Parameters 16

17 Outlines System Architecture Probes Parameters Introduction of probes Bandwidth System Alive Response System overview 17

18 Bandwidth probe Warn value:n * max bandwidth from historical data of same month last year in normal status. Error value:m * max bandwidth from historical data of same month last year in normal status. (m>n) Red alert: (one of bellowing situation) Machine bandwidth > 80% * Site max bandwidth Machine bandwidth > Error value and Machine bandwidth > 60% * Site max bandwidth Yellow warn: Machine bandwidth > Error value or Machine bandwidth > 60% * Site max bandwidth 18

19 System probes - Load Memory Proc Disk Syslog Load Memory Proc Disk Error value and warn value are based on history log Red alert:query result via SNMP > error value Yellow warn:query result via SNMP > warn value Syslog Check syslog:find error and warning record via syslog analysis and domain knowledge. Red alert:error record has appeared in syslog. Ex: failed authentication, wrong account Yellow warn: warnning record has appeared in syslog. Ex: too many logins 19

20 Outlines System Architecture Probes Parameters Introduction of probes Bandwidth System Alive Response System overview 20

21 Alive Alive probe Lost ratio:ratio of missing ICMP probe test. Error value:100% lost Warn value:60% lost Red alert:icmp lost ratio is larger than error value Yellow warn: ICMP lost ratio is larger than warn value, but below error value 21

22 Response probe Response Lost ratio:ratio of missing connection test of service. Error value:100% lost Warn value:60% lost Red alert: lost ratio is larger than error value Yellow warn: lost ratio is larger than warn value, but below error value 22

23 Outlines System Architecture Probes Parameters Introduction of probes Bandwidth System Alive Response System overview 23

24 DNSNOC Colocation Probes Search 24

25 Query bandwidth and load 25

26 Query single probe hostory log Last 24 hours Last 7 days Last 4 weeks Last 12 months 26

27 Notice process log 27

28 28