Global DDoS Measurements. Jose Nazario, Ph.D. NSF CyberTrust Workshop

Transcription

1 Global DDoS Measurements Jose Nazario, Ph.D. NSF CyberTrust Workshop

2 Quick Outline, Conclusions o Measurements - We re screwed o Observations - We know who o The wrong approach: point solutions Page 2

3 Overview o Internet Measurements o Botnet infiltration o Visibility is decent, room to grow Page 3

4 Measurement Approaches o Past - unused /8 (Peakflow Blackhole project) o Current Live traffic - Internet Traffic Project Botnet infiltration Page 4

5 Internet Traffic Project o Goal: Provide first global view of Internet traffic and attack trends o Leverage commercial probe deployments Pool of 2,500+ Flow / DPI collectors Across 250 ISPs / Content Provider / Higher Ed o Internet scale data collection Traffic, DPI, Mitigation and Security datasets Geographically and topologically diverse Page 5

6 Internet Traffic Project statistics.arbor.net ISP1 ISP2 ISP3 ISP5 ISP4 o Each participating ISP deployment submits XML o Anonymous XML over SSL every hour o Arbor managed servers collect/process Page 6

7 Internet Traffic Project o Service operational and research interests o Outgrowth Fingerprint Sharing Initiative (45 publicly disclosed participants) and Security Survey o Data from explicit voluntary anonymous data sharing agreement with ISPs o Research Partners Arbor, University of Michigan, Princeton (Intern) And 78 customers (and growing) o Initial / preliminary presentation of data Page 7

8 Internet Traffic Deployment 67 long-term participants (2 years) 17 unique countries 27 in US, though many have global footprint Page 8

9 Current Traffic Project Deployment o 67 long-term ISPs (now 78) 5 MSO, 4 Tier1, 15 Tier2, 4 Content, 1 R&E Remainder not self-catagorized o 1,270 routers o 141,629 interfaces o > 1.8 Tbps of inter-domain traffic o 485 days and counting (began September 2006) Page 9

10 Internet Attack Types o Data excluding floods o After nine years, TCP SYN (31%) still dominates DDoS o ICMP (27%) also prominent Page 10

11 Most Frequently Attacked Ports HTTP ports account for bulk of TCP-based attacks Fragmentation attacks lead the pack on the UDP front Page 11

12 Internet Attack Scale o Unique attacks exceeding indicated BPS threshold for single ISP o Average of three 1-Gbps or larger attacks per day over 485 days of collection o Two ~25 Gbps attacks reported by a single ISP (on same day, about one hour apart, duration of ~35 minutes) Page 12

13 21 Days Y/Y o Significant Y/Y growth o Identify additional trends: Holiday Season typically slow time for attackers Page 13

14 Attack Intensity 2-3% Backbone Traffic Page 14

15 Active Command Observation o Based on malcode analysis o Captured samples analyzed o Bots identified, C&C identified o Python tool (Bladerunner) to actively lurk in command channel o Persistent logging Page 15

16 Benefits of Active Monitoring o Overlap incomplete 13% of attack commands yielded an SP alert 2% of attacks could be traced back o Active traceback for customers, community Sometimes remediation possible o Infer motivation o Assign attribution o Study methodologies Adapt countermeasures appropriately Page 16

17 Botnet Types o Traditional IRC botnets o HTTP botnets Popular in Russia, China developed botnets o Homegrown protocols Increasingly popular in Chinese botnets Similar to original DDoS tools o Other - not addressed by Bladerunner (yet) Storm worm (p2p command channel) Other, private Page 17

18 Current Status of Active Botnet Monitoring o Currently tracking 257 active C&Cs IRC, HTTP, Other o 45 active C&Cs a day o active attacks logged a day Page 18

19 Attack Command Victims - June 2008 Page 19

20 Attacking Botnet C&C Locations - June 2008 Page 20

21 Attacker Motivations o Anger o Financial o Retribution o Economic o Political, religious o ~50% of all IRC nets we track launch at least 1 attack Page 21

22 Remediation Challenges o Whack-a-mole Command traceback 2006 stats: 2% traceback Bot identification Notification Education o Keeping our heads above water o Running out of air Scale Page 22

23 Future Thinking o Excess capacity -- bigger botnets o Rate shaping per client -- bigger botnets o Deny spoofing, no more raw sockets -- reveal actual client o SYN cookies -- connect floods o Good ISPs reponse -- bad/lazy ISPs grow Page 23

24 Points of Attack o Install Pay per install Pay per click FTC, etc o Use Spam DoS DoJ o Money transfer SEC Never will stop all motivations, attack vectors (ie F5) Page 24

25 Solved problems o Data collection Traffic summaries Attack activities Bad machines (scan, bots, etc) Botnet commands Fast flux data Spam Malicious URLs Rogue DNS servers With this (and more data), what would you do? Page 25

26 Long-Term Research Questions o Incentives - both sides o Dynamic content security o Complexity reduction Will be key to link up academic, industry, SP people Goal: Relevance of research Page 26

27 Questions? Craig Labovitz Danny McPherson Scott Ickle-Johnson Mike Hollyman SP product team ATLAS team ASERT team Page 27