Information Metrics for Low-rate DDoS Attack Detection : A Comparative Evaluation

Transcription

1 Iformatio Metrics for Low-rate DDoS Attack Detectio : A Comparative Evaluatio Moowar. Bhuya Dept. of Computer Sciece ad Egg Kaziraga Uiversity Koraikhowa, Jorhat , Assam moowar.tezu@gmail.com D. K. Bhattacharyya Dept. of Computer Sciece ad Egg Tezpur Uiversity Napaam, Tezpur 78408, Assam dkb@tezu.eret.i J. K. Kalita Dept. of Computer Sciece Uiversity of Colorado Colorado Sprigs, CO 8098, USA jkalita@uccs.edu Abstract Ivasio by Distributed Deial of Service (DDoS) is a serious threat to services offered o the Iteret. A low-rate DDoS attack allows legitimate etwork traffic to pass ad cosumes low badwidth. So, detectio of this type of attacks is very difficult i high speed etworks. Iformatio theory is popular because it allows quatificatios of the differece betwee malicious traffic ad legitimate traffic based o probability distributios. I this paper, we empirically evaluate several iformatio metrics, amely, artley etropy, Shao etropy, Reyi's etropy ad Geeralized etropy i their ability to detect low-rate DDoS attacks. These metrics ca be used to describe characteristics of etwork traffic ad a appropriate metric facilitates buildig a effective model to detect low-rate DDoS attacks. We use MIT Licol Laboratory ad CAIDA DDoS datasets to illustrate the efficiecy ad effectiveess of each metric for detectig maily low-rate DDoS attacks. bots or slave machies) cotrolled by oe etity (i.e., the master) []. The master ca sed malformed packets through a sychroized host (i.e., the slave) to the target host. owever, detectio of botets is hard ad a effective solutio eeds to moitor all machies that ca possibly become active bots i a botet. Keywords DDoS attack, iformatio metric, etwork traffic, low-rate, etropy I. INTRODUCTION DDoS attacks use a set of compromised hosts to make Iteret services uavailable. Attackers are cotiually improvig their ability to lauch future DDoS attacks by ifectig ususpectig hosts. These attacks ormally cosume a massive amout of resources from a server that makes the server iaccessible to legitimate users; they also cosume etwork badwidth by compromisig etwork traffic. DDoS attacks are cooperative distributed large scale attacks ad ca spread by both wired ad wireless etworks. ece, both idustry ad academia are iterested i defedig their etworks from DDoS attacks, esurig uiterrupted access by legitimate users. It is challegig to distiguish malicious traffic from legitimate traffic sice they are similar based o traffic behavior aloe. There are two types of traffic that ca ormally compromise a host or a etwork with DDoS attacks []. They are: (a) high-rate DDoS attack traffic, which is exceptioal ad similar to a flash crowd ad (b) low-rate DDoS attack traffic, which is similar to legitimate traffic. Sice both have characteristics of legitimate traffic, it is crucial to detect a DDoS attack ad remit withi a short time iterval. Most recet work aims to detect DDoS attacks lauched by botets. A botet is a large etwork of compromised hosts (i.e., Fig.. Direct attacks There are two ways to lauch DDoS floodig attacks: direct floodig attacks ad reflector-based floodig attacks []. I direct DDoS floodig attacks, the attacker seds a massive umber of packets to the victim host or server directly through multiple compromised hosts or machies as show i Figure. Direct DDoS floodig attack is further classified as: Networklayer DDoS attacks ad Applicatio-layer DDoS attacks. TCP flood, UDP flood, ICMP flood ad SYN flood are some commo examples of etwork-layer DDoS attacks ad TTP flood, TTPS flood ad FTP flood are examples of applicatio-layer DDoS attacks. I reflector-based DDoS floodig attacks, the attacker seds request to a reflector host to forward a massive amout of malicious traffic by spoofig IPs of victim host(s). As a result, the reflector hosts sed their replies to the victim host ad make the victim iaccessible by the legitimate users soo as show i Figure. ICMP ECO reply flood, SYN ACK RST flood, DNS flood ad smurf flood are some well-kow reflector-based attacks. Iformatio theory-based metrics are well established i detectig distributed DoS attacks. I iformatio theory, /4/$ IEEE

2 etropy is a popular ucertaity measure uites with a radom variable. Iformatio distace computes the variatio betwee various probability distributios. Kullback-Leibler divergece ad Shao's etropy are assumed to be the most useful methods i detectig malicious traffic based o IP address or packet size distributio statistics [3], [4]. Fig.. Idirect attacks I this paper, we cotribute i two ways: First, we discuss the most commo iformatio metrics that are used i detectig DDoS attacks with pros ad cos. Secod, we aalyze ad evaluate each iformatio metric from a attacker's viewpoit i the cotext of detectig low-rate DDoS attacks. We use victim-ed architecture for aalyzig iformatio metrics i detectig low-rate DDoS attacks. The rest of the paper is orgaized as follows: Sectio II discusses related research with a focus o the detectio of low-rate DDoS attacks. Sectio III discusses various iformatio metrics that are used to detect low-rate DDoS attacks withi short time itervals. It also icludes the complexity aalysis of the detectio method. owever, i Sectio IV, we report experimetal results ad discussio based o the use of iformatio metrics i detectig low-rate DDoS attacks. Fially, Sectio V presets coclusios with future work. II. RELATED RESEARC Detectio of attacks is crucial for ifrastructure etworks. So, both idustry ad academic researchers are costatly tryig to detect etwork attacks with high accuracy for at least two decades. There are maily two techiques to detect attacks: sigature-based ad aomaly-based. Sigature-based detectio mechaisms oly ca detect attacks, whose sigatures are kow. If ay attack is discovered, it should be used to trai the system. owever, a aomaly-based detectio system characterizes legitimate etwork behavior ad reports a alarm if it deviates from it. Iformatio metric is a statistical metric, which is icreasigly beig used i etwork aomaly detectio. Sheg et al. [5] discuss a measure, desiged, based o urst coefficiet to detect low-rate DDoS attacks. Experimetal results obtaied ad demostrate effectiveess i detectig low-rate DDoS attacks. Xiag et al. [4] preset two iformatio metrics: geeralized etropy ad iformatio distace to idetify low-rate DDoS attacks. They measure the differece of the iformatio metrics betwee ormal traffic ad malicious traffic. They test their metric usig real-life DDoS traffic traces ad show the reductio of false alarms with early stage detectio. Zhag et al. [6] preset a metric for flow-level etwork traffic, desiged based o Cogestio Participatio Rate (CPR) to detect ad filter low-rate DDoS attacks that geerate low-level cogestio i the etwork. If the CPR value is higher tha the user defied threshold, a etwork flow is classified as a low-rate DDoS attack ad the etwork allows subsequetly droppig all coected packets. The authors aalyze the effectiveess of the CPR-based approach to quatify the average CPR differece betwee legitimate TCP flows ad low-rate DDoS flows. It was show that the CPRbased approach ca differetiate betwee legitimate ad attack traffic. Experimets usig Iteret traffic-trace aalysis, s- simulator ad test-bed experimets establish the results. Tao ad Yu [7] preset a DDoS floodig attack detectio method usig a iformatio theoretic measure. It ca detect DDoS attacks withi a short time iterval ad is effective whe experimeted o real-life datasets. Fracois et al. [8] report the theoretical foudatio, architecture, ad algorithms to detect DDoS floodig attacks; their approach is kow as FireCol. FireCol cotais itrusio prevetio systems (IPSs) istalled by various Iteret service providers (ISPs). A virtual protectio rig is created by IPSs aroud the hosts to defed agaist DDoS floodig attacks by iterchagig the chose traffic iformatio. FireCol was evaluated usig both simulatios ad real datasets ad obtais effective results. It also supports cumulative deploymet i real etworks. A. Discussio Based o our survey, we have made the followig observatios. Oly few detectio methods focus o detectig lowrate DDoS attacks. As discussed, low-rate DDoS traffic is similar to legitimate traffic. So, detectio of such attacks is difficult ad challegig. Detectio methods are more cocetrated o packetlevel datasets. III. INFORMATION METRICS FOR DDOS DETECTION A iformatio metric measure may be used to overcome the limitatios of existig DDoS attack detectio methods. I this paper, we attempt to evaluate iformatio metrics for detectig low-rate DDoS attacks. The followig assumptios have bee made durig experimetatio. Routers have full cotrol o i-ad-out traffic flow.

3 We collect packet ad flow level traffic at the victimed after various types of floodig attacks are lauched. Durig processig, we sample the etwork traffic at 5 miute itervals ad also further sample ito 0 secods time itervals. All malicious traffic follows Poisso distributio ad ormal traffic follows Gaussia distributio. The symbols used to describe the iformatio metrics for detectig low-rate DDoS attacks are give i Table. Term x P T t i x i δ S E E i N TABLE I. etwork traffic data total probability SYMBOLS USED Defiitio time iterval take for processig i th time iterval withi T the etropy metric etropy metric of order i th istace withi x threshold for attack detectio sample traffic iformatio distace metric differece of etropy metric values betwee two samples, s i ad s j total umber of packets withi full time iterval T represets the smaller time iterval t withi T I iformatio theory, larger values of etropy are expected whe the iformatio variable is more radom. I cotrast, the etropy value is expected to be small whe the amout of ucertaity i the iformatio variable is small [3]. To quatify the radomess of a system, Reyi [9] itroduced a etropy metric of order as a mathematical geeralizatio of Shao etropy [0]. Let us cosider a discrete probability distributio, P = {p, p, p 3, p }, i.e., p =, p i 0. The the Reyi's i = etropy of order is defied as ( x ) = log i= i p i where 0,, p i 0. If the values of the p i 's are the same, the maximum etropy value kow as artley etropy [0] is achieved: () 0 ( x ) = log () Whe, coverges to Shao etropy [0]: x ) = p i log p i ( (3) i= If =, it is kow as collisio etropy or Reyi's quadratic etropy [9]. x ) = log p i i= ( (4) Fially, whe, (x) reaches the miimum iformatio etropy value. ece, we say that the geeralizatio of iformatio etropy is a o-icreasig fuctio of order, i.e., (x) (x), for <, > 0. Based o this aalysis of iformatio etropy metric, we cosider differet probability distributios for legitimate etwork traffic ad malicious traffic whe detectig low-rate DDoS attacks. We fid the differece betwee legitimate ad malicious traffic i low-rate attack situatios. The major steps are give i Algorithm. Algorithm The low-rate DDoS attacks detectio Iput: etwork traffic x with respect to time widow, T ad threshold, δ Output: alarm iformatio (attack or ormal) : iitializatio: Probability p(x i ), sample period, T=0, where i=,,3,, T= t, t, t 3,, t N, N is the full time iterval. : sample the etwork traffic x received from upstream router R based o samplig period T 3: compute probability distributio p i based o traffic features (i.e., sip, dip ad protocol) for each sample withi T samplig period of i th sample. 4: compute etropy metric (x) usig Equatio() for each sample withi samplig period T E i = ( s ) ( s ) (5) i j 5: check agaist variatio threshold E i δ, if so geerate alarm; otherwise, router sed ahead the packet to the extlevel routers. 6: go to step. A. Complexity Aalysis This aalysis mechaism takes O(T) time for each sample i detectig low-rate DDoS attacks, where T is the time iterval ad is the umber of istaces withi a sample. Thus, for each idividual order of iformatio metric, the time complexity of the method is liear for each sample with respect to the size of the dataset ad the umber of attributes. IV. EXPERIMENTAL RESULTS Performace evaluatio is importat for ay attack defese system. Performace for detectig DDoS attacks is maily depedet o (i) the approach, (ii) deploymet poit ad (iii)

4 whether it is possible to dyamically update attack traffic iformatio [], []. Whe desigig a DDoS attack defese mechaism, these issues should be take ito cocetratio to desig a better defese mechaism. I our experimets, two differet datasets, viz., MIT Licol Laboratory [3] ad CAIDA DDoS 007 [4] datasets are used to detect low-rate DDoS attacks. The MIT Licol Laboratory tcpdump data is real-time pure ormal data; it does ot cotai ay attack traffic. The CAIDA dataset cotais 5 miutes (i.e., 300 secods) of aoymized traffic of a DDoS attack o August 4, 007. These traffic traces store oly attack traffic to the victim ad respose from the victim; o-attack traffic has bee removed as much as possible. Accordig to Moore et al. [5], it is a high-rate attack if there are more tha 0,000 packets per secod over the etwork. If,000 attack packets per secod over the etwork coverig 60% of the attack traffic the it is kow as low-rate attack. A. Results We iitially sample the etwork traffic every 0 secods for 5 miutes, for aalysis. We apply the geeralized etropy measure of order, where is varied from 0 to 5 for our experimet. We also evaluate the geeralized iformatio distace of order, where is varied from to 4 for detectig low-rate DDoS attacks. All features i etwork traffic may ot play role i the detectio of malicious traffic. Therefore, we cosider oly three features: source IP, destiatio IP, ad protocol, for our experimets. The geeralized etropy values of order ad spacig betwee ormal traffic ad malicious traffic for the CAIDA dataset are show i Figure 3. metric of order for the CAIDA DDoS dataset is give i Figure 4. The threshold δ value is varied from to whe detectig low-rate DDoS attacks usig CAIDA datasets. Fig. 4. Spacig betwee ormal ad low-rate DDoS traffic whe usig geeralized etropy measure i the CAIDA dataset B. Discussio To detect low-rate DDoS attack traffic, it is importat to use a miimum umber of traffic features. Several detectio mechaisms use either distributio of IP addresses or packet sizes. I this paper, we evaluate iformatio metric measures to detect low-rate DDoS attacks i real-life DDoS dataset. The followig are some observatios. Iformatio etropy provides better result whe icreasig the order of geeralized etropy i detectig low-rate DDoS attacks. Iformatio metric produces better result i terms of complexity because it uses a miimum umber of parameters durig detectio. For geeralized etropy, the value of ca be adjusted easily for better spacig betwee ormal ad attack traffic. Fig. 3. Spacig betwee ormal ad malicious traffic i CAIDA dataset I the figure, we see that spacig betwee ormal ad lowrate attack traffic is lower tha the spacig i high-rate attack traffic. This is because low-rate attack traffic is similar to legitimate traffic. The spacig betwee legitimate or ormal traffic ad low-rate attack traffic usig the geeralized etropy V. CONCLUSION This work presets a empirical evaluatio of iformatio metrics whe detectig low-rate DDoS attacks. We iclude several iformatio etropy measures: artley etropy, Shao etropy, Reyi's etropy ad Reyi's geeralized etropy. The use of iformatio metric magifies the spacig betwee legitimate ad malicious traffic for low-rate DDoS attack detectio i real world etwork traffic. Moreover, these measures take miimum time to fid the spacig betwee the malicious ad legitimate traffic.

5 ACKNOWLEDGMENT This work is supported by Coucil of Scietific ad Idustrial Research (CSIR) ad Departmet of Iformatio Techology, Govermet of Idia. REFERENCES [] W. Wei, F. Che, Y. Xia, ad G. Ji, A Rak Correlatio Based Detectio agaist Distributed Reflectio DoS Attacks, IEEE Commuicatios Letters, vol. 7, o., pp , 03. [] M.. Bhuya,. J. Kashyap, D. K. Bhattacharyya, ad J. K. Kalita, Detectig Distributed Deial of Service Attacks: Methods, Tools ad Future Directios, The Computer Joural, vol. 57, o. 4, pp , 04. [3] S. Yu, W. Zhou, R. Doss, ad W. Jia, Traceback of DDoS Attacks Usig Etropy Variatios, IEEE Tras. Parallel Distributed Systems, vol., o. 3, pp. 4 45, March 0. [4] Y. Xiag, K. Li, ad W. Zhou, Low-Rate DDoS Attacks Detectio ad Traceback by Usig New Iformatio Metrics, IEEE Trasactios o Iformatio Foresics ad Security, vol. 6, o., pp , 0. [5] Z. Sheg, Z. Qifei, P. Xuezeg, ad Z. Xuhui, Detectio of Low-rate DDoS Attack Based o Self-Similarity, i d Iteratioal Workshop o Educatio Techology ad Computer Sciece (ETCS), vol., March 00, pp [6] C. Zhag, Z. Cai, W. Che, X. Luo, ad J. Yi, Flow Level Detectio ad Filterig of Low-rate DDoS, Comput. Netw., vol. 56, o. 5, pp , October 0. [7] Y. Tao ad S. Yu, DDoS Attack Detectio at Local Area Networks Usig Iformatio Theoretical Metrics, i th IEEE Iteratioal Coferece o Trust, Security ad Privacy i Computig ad Commuicatios (TrustCom), 03, pp [8] J. Fracois, I. Aib, ad R. Boutaba, FireCol: A Collaborative Protectio Network for the Detectio of Floodig DDoS Attacks, IEEE/ACM Trasactios o Networkig, vol. 0, o. 6, pp , 0. [9] A. R eyi, O Measures of Etropy Ad Iformatio, i Proc. of the 4th Berkeley Symposium o Mathematics, Statistics ad Probability, 960, pp [0] C. E. Shao, A Mathematical Theory of Commuicatio, Bell system techical joural, vol. 7, pp , 948. [] M.. Bhuya, D. K. Bhattacharyya, ad J. K. Kalita, AOCD: A Adaptive Outlier Based Coordiated Sca Detectio Approach, Iteratioal Joural of Network Security, vol. 4, o. 6, pp , 0. [], Network Aomaly Detectio: Methods, Systems ad Tools, IEEE Commuicatios Surveys Tutorials, vol. 6, o., pp , 04. [3] MIT Licol Laboratory Datasets, MIT LLS DDOS 0.., ideval/data/000data.html, 000, Massachusetts Istitute of Techology, Cambridge,MA. [4] CAIDA, The Cooperative Aalysis for Iteret Data Aalysis, 0. [5] D. Moore, C. Shao, D. J. Brow, G. M. Voelker, ad S. Savage, Iferrig Iteret Deial-of-service Activity, ACM Tras. Computer System, vol. 4, o., pp. 5 39, May 006.