On the Effectiveness of Route-Based Packet Filtering for Distributed DoS Attack Prevention in Power-Law Internets

Transcription

1 Kihong Park Heejo Lee On the Effectiveness of Route-Based Packet Filtering for Distributed DoS Attack Prevention in Power-Law Internets SIGCOMM'01 Presented by WeeSan Lee 10/28/2004

2 Outline Background Proactive Prevention vs Reactive Source ID Route-based Distributed Packet Filtering Performance Measures for DPF Performance Results Conclusion Pros & Cons Future Work 2

3 Outline Background Proactive Prevention vs Reactive Source ID Route-based Distributed Packet Filtering Performance Measures for DPF Performance Results Conclusion Pros & Cons Future Work 3

4 Background DoS Denial of Service Forge the source IP address Consume resources Processes (eg. Ping of Death) Network bandwidth (eg. Ping flood) Network connections (eg. SYN flood) Services becomes unavailable Impact QoS DDoS Distributed DoS From more than one host More severe impact 4

5 Outline Background Proactive Prevention vs Reactive Source ID Route-based Distributed Packet Filtering Performance Measures for DPF Performance Results Conclusion Pros & Cons Future Work 5

6 Proactive Prevention & Reactive Source ID Proactive Prevention Deploy filters Challenge: on which ASes? eg. vertex cover Reactive Source ID Locate the attackers Shut them down Catch the attackers Challenge: within small # of ASes, eg. 5 6

7 Outline Background Proactive Prevention vs Reactive Source ID Route-based Distributed Packet Filtering Performance Measures for DPF Performance Results Conclusion Pros & Cons Future Work 7

8 Route-based Distributed Packet Filtering AS7 forges AS2 address to attack AS4 AS6 filters attacked packets What if AS7 forges AS8 to attack AS4? 8

9 Route-based Distributed Packet Filtering (cont) AS1 attacks AS9 Filter on AS8, no spoof from AS6 & 7 Filter on AS8+AS3, no spoof from AS3-AS7 Single filter Distributed filter 9

10 Outline Background Proactive Prevention vs Reactive Source ID Route-based Distributed Packet Filtering Performance Measures for DPF Performance Results Conclusion Pros & Cons Future Work 10

11 Performance Measures for DPF Proactive Filtering Measures : the fraction of AS's that are immune from DoS attack. Perfect proactive, ie. ~1 when coverage ratio ~1 : the fraction of attack sites that is impossible to send spoofed IP packets to other ASes due to filtering. If, it means 90% of ASes can't be used to spoof IP packets. 11

12 Performance Measures for DPF (cont) Reactive Filtering Measure (AS Traceback) For example, means the fraction of attacked ASes that can traceback the attack location to within 5 possible attack ASes. 12

13 Outline Background Proactive Prevention vs Reactive Source ID Route-based Distributed Packet Filtering Performance Measures for DPF Performance Results Conclusion Pros & Cons Future Work 13

14 Performance Results Proactive Filtering Effect achieves 88% during Only 12% ASes left for attackers to spoof IP 14

15 Performance Results (cont) Reactive Filtering Effect (AS Traceback) Every attack can be traceback'd within 5 ASes Even increase the ASes by some factor c 15

16 Performance Results (cont) Maximal Filters vs Semi-maximal Filters Maximal filters use both src and dst Semi-maximal filters use only src Not much difference! 16

17 Performance Results (cont) Impact of Network Topology Random, Inet and Brite, and VC remains invariant over

18 Performance Results (cont) Random Topology Although VC, Reactive Filtering 18

19 Performance Results (cont) Inet Topology Generator VC ~50% larger, Inet performs better than Random 19

20 Performance Results (cont) Brite Topology Generator PC = 0, spatial proximity only PC = 1, power law on node degree distribution PC = 2, hybrid 20

21 Performance Results (cont) Brite Topology Generator Perform worst than Inet 21

22 Performance Results (cont) Ingress Filtering Protect itself from DoS, allow DoS within the AS Without Ingress Filtering Reactive Filtering increases to 20, ie. Proactive Filtering drops ~20% 22

23 Performance Results (cont) Multi-path Routing # of paths, Reactive and Proactive Filtering 23

24 Conclusion Deploy DPF on 18% of ASes, 88% of ASes are impossible to be used for DDoS Identify other DDoS within 5 ASes Filter performance depends on AS topology Vertex Cover Multi-path Routing Ingress Filtering is important as well Imply Inet is better than Brite? 24

25 Pros & Cons Scalable DDoS prevention architecture Systematic way to measure its performance Topology generators comparison Just a theory source reachability is not avail. in BGP Source ID in 5 ASes doesn't mean much Too many definitions & GRE words 25

26 Future Work Efficient implementation Costs associated with deployment & overhead 26