高トラフィック観測・分析法に関する技術調査

Size: px

Start display at page:

Download "高トラフィック観測・分析法に関する技術調査"

ちかこえいさか
5 years ago
Views:

2 Contents PC IPv DoS DoS DDoS IDS IDS IDS Anomaly Anomaly

3 LPF IPv6 IX Reflector Pulsing DoS LAN N N N

4 1. DoS DoS

5 2 3 4 DoS DoS 5 IDS

7 ATM 1995 Vern Paxson [1] [1][2][3] 2.1. [1] ATM [1] IP - 4 -

8 Tcplib [Danzig et al 1992][2] TCP TELNET TCP FTP FTP - 5 -

9 FTP FTP 1 2 FTP TELNET [3] [3] - 6 -

10 FFT FFT Fast Fourier Transform FFT Fractional Gaussian Noise FFT Whittle H(Hurst) [3] 3-7 -

11 for [4] 4 6 IP SNMP - 8 -

13 - 10 -

14 3. Firewall IDS

15 IPv SNMP: Simple Network Management Protocol MIB: Management Information Base

16 [5] [6]

17 Attacker Back bone Victim 5 a) DDoS b) c) DDoS 4.7 WIDE

18 NLANR (National Laboratory for Applied Network Research)[7] vbns (very high performance Backbone Network Service) CAIDA (the Cooperative Association for Internet Data Analysis)[8] Skitter[9] WIDE MAWI (Measurement and Analysis on the WIDE Internet) WG[10] IP AGURI[11][12] PAM (Passive and Active measurement Workshop) [13] ACM SIGCOMM Internet measurement conference (Special Interest Group on Data Communications) [14] PC PC UNIX OS libpcap[15] tcpdump[16] libpcap tcpdump Agilent 64 UDP 50,

19 CPU Memory OS VIA C MHz 512M FreeBSD 4.8 Release 6 pcap tcpdump count tcpdump dropped by kernel Pcap dropped by kernel OS

20 C IDS [17][18] systematic

21 7 [17] 10 IETF PSAMP (Packet Sampling) WG[19] MIB RFC DoS [6][20]

22 34 Hours ms 5 Seconds [21]

23 1 (1ms-100ms) 1 1 Internet-Draft IETF [22] [11] [12] IP IP IPv6 IPv6 IPv6-20 -

24 SNORT IPv6 IPv6 IPv6 Snort IDS IPv6 128 IP IPv6 Snort IPv6 IPv6 Snort IPv IPv6 Snort IPv6 IPv6 IPv6 IPv6 (detection plug-in preprocessor ) IPv6 (output plug-in) Snort IP syslog SNMP Trap Syslog IP syslog IPv6 IPv6 Snort PostgreSQL 7.4 IPv6 IPv6 SNMP Trap snort IPv6 [23] IPv6 SNMP IPv6 SNMP IPv6 IPv6 IPv6 IPv6 IETF IPv6 RFC [24][25][26][27][28]

25 Internet-Drafts IPv6 Mobile IPv6 IPSec IPv6 IPv6 IPv6 NETWORLD + INTEROP 2003 TOKYO IPv6 Show Case [29] SNMP IPv6 Show Case SNMP IPv6 SNMP net-snmp [30] IPv6 IPv

27 4. 11 IPv

28 4.1. [31] DDoS DNS 230% 30% DDoS DDoS DNS DDOS 3 RTT RTT USC: RTT 120ms CodeRed NIMDA RTT DDoS RTT DNS DDoS DNS

29 4.2. DoS DoS DoS DoS DoS DoS DoS DoS DoS [32] TCP / ICMP / UDP 90% ICMP

30 TTL [32] ICMP ECHO DDoS [33] DDoS DoS

31 1 TCP SYN (to open port) TCP SYN (to closed port) TCP ACK TCP DATA TCP RST TCP NULL ICMP ECHO Request ICMP TS Request UDP pkt (to open port) UDP pkt (to closed port) TCP SYN/ACK TCP RST (ACK) TCP RST (ACK) TCP RST (ACK) no response TCP RST (ACK) ICMP Echo Reply ICMP TS Reply protocol dependent ICMP Port Unreach DoS IP ISP A) B) (Uniformity)

32 SYN-flood Syn-ack Syn-ack TCP-RST TCP ICMP Anderson-Darling DNS BGP IP AS DoS DoS

33 (unsolicited response) 4.3. [34] (Intrusion Detection System : IDS) IDS (NN) IDS IDS

34 IDS IDS IDS IDS MultiLayer Perceptron(MLP) IDS Jake Neural Network Intrusion Detector (NNID)[35] CPU Kymie The Application Of Neural Networks To UNIX Computer Security[36] Anup K. Ghosh Detecting Anomalous and Unknown Intrusions Against Programs[37] James Cannady Artificial Neural Networks for Misuse Detection[38] Probe DoS

35 Zheng Zhang HIDE: a Hierarchical Network Intrusion Detection System Using Statistical Preprocessing and Neural Network Classification[39] UDP Flood MLP Self Organizing Map(SOM) IDS Peter Lichodzijewski Host-Based Intrusion Detection Using Self-Organizing Maps[40] SOM SOM Anup K. Ghosh Elman Networks MLP Detecting Anomalous and Unknown Intrusions Against Programs Learning Program Behavior Profiles for Intrusion Detection[41] IDS IDS IDS IDS MLP IDS ( ) IDS IDS

36 4.4. IDS Anomaly IDS(Intrusion Detection System) IDS IDS IDS IDS [42] Anomaly (Multivariate) (SPICE ) IDS IDS IDS ( IP Port) IDS IDS IP

37 IDS Snort SPADE[43] IP Port IDS SYN FIN IDS Krugel Service Specific Anomaly Detection for Network Intrusion Detection[44] GET HEAD Matthew C. Mahoney PHAD ALAD [45] PHAD ALAD PHAD ALAD Carol Taylor NATE [46]

38 NATE IDS IDS IP SYN FIN SYN FIN IP Sekar Specification-based Anomaly Detection: A New Approach for Detecting Network Intrusion [47] W. Lee Mining in a data-flow environment: Experience in network intrusion detection [48] Anomaly IDS IDS

39 4.5. [49] OSPF BGP BGP OSPF private peering

40 2. BGP OSPF peering (BGP-MIB OSPF-MIB ) peering

41 LPF(Low Pass Filter) LPF LPF v in LPF vout LPF v v = v out v in out IPv6 IX JGN-IPv6 NSPIXP6[50] IPv IPv6 ( ) 1 14 LPF LPF

42 14 IX 4.7. CSIRT (Computer Security Incident Response Team) CSIRT IETF INCH WG[51] [52] [53] DoS Reflector DRDoS(Distributed Reflection DoS)

43 DoS DoS Reflector Source IP Reflector Source IP [54][55][56] 15 DDoS DDoS reflection SYN flooding attack Source IP IP SYN SYN TCP 3way SYN/ACK SYN Source IP( ) Reflector 3way ACK SYN/ACK SYN/ACK SYN ACK SYN/ACK SYN 3 4 SYN/ACK Reflector

44 Reflector Reflector 16 TCP-SYN 17 A R TCP-SYN R V SYN-ACK V X A TCP-SYN PPS Y V R V R RST A R SYN flood A R V RST 16 TCP-SYN

45 A V 17 Reflector DDoS Pulsing DoS DoS DeS(Degradation of Service) DoS DeS DoS DoS Pulsing DoS Queue Queue TCP TCP [57] 18 Pulse TCP l1 Queue

46 Queue Queue l2 l2 TCP Queue TCP Slow Start TCP Slow Start T TCP TCP 18 Pulsing DoS 4.9. DoS DoS

47 False Positive 19 Anomaly DOS

48 - 45 -

49 LAN

50 Catal 2950G-24 econ-sw6f Catal 2950G-24 Phbox1 econ-sw5f econ- Phbox2 Catal 2950G-24 FS716TXV2 Catalyst G econ-sw4f FS708XL Catalyst2924 Catalyst2924 Catal 2924LX Cisco7204 FPD econ-sw3f Catal 2950G-24 econ-sw2f M/C M/C Catalyst3512XL Apple Talk M/C Corega SW-HUB85W-8L Catalyst3512XL F Catalyst4006 PD CenterCom FS702FCL PD PD F FS724XJ x10 Catal 2924LX M/C PD CenterCom FS708XL PD F F M/C chuzai1 Com SuperStackII SW LAN SW-HUB SNMP 13node phbox LAN phbox2 430 LAN SW-HUB SNMP SW-HUB Ether

51 Port 1 phbox sec F FTP WWW Mail

52 FFT Wavelet 5.3. P2P

53 8 LAN LAN

54 LAN SW-HUB SW-HUB Proxy Proxy ( )

55 ( ) LAN 5.5. POP ( )

56 ( ) SW-HUB P P SW-HUB (Byte) (Byte)

57 - 54 -

58 - 55 -

59 [58][59] IP AS(Autonomous System) 1 AS

60 Top N 1 D(N) 1 Top N D ( N) = Number of packets in TopN group slot Number of packets slot Top N Top N Top 3 D(3) IP Top N

61 21 22 Top N D(N) T TH DT-(N) T T DT+(N) T TH DT-(N) DT+(N) Stable? T t 22 Stability N D(N) Top N N N 2 32 IPv4-58 -

62 Top N 2 N D ( N + 1) D( N) < C Top N N+1 C N+1 C 1% Top N N=14 23 Top N N 22 DT-(N) 2 N N DT-(N) N N

63 N N DT-(N) m 2 ( 1 i m Ni ) ,000 Ni X Y N N DT-(N) 24 10,

64 25 N N m N N N N N m m N N

65 IP TCP

66 N N

67 27 N 28 N

68 29 30 m N m 5, 10, 20, 30, 40, 50 IP m=5 m m= m N

69 30 m N N N 31 N N

70 pkt 32 ( 1000pkt )

71 33 34 N N N 33 N 30,000pkts

72 34 N 30,000pkts 6.2. IP IP IP TTL(Time To Live) ID(Identification) TCP UDP

6.1.6 20,000pkt 1000pkt 6.1.7 30 6.2.1. Internet

73 ,000pkt 1000pkt Internet Intranet 35 IP N IP N 10 IP IP (D)DoS 35 IP 36 IP IP N IP

74 36 IP 37 IP TTL TTL TTL OS IP IP TTL IP TTL DDoS

75 37 TTL 38 IP ID N 1 Top 1 1% ID ID TopN

76 38 ID 39 TCP Intranet Web(HTTP) (SMTP)

77 39 TCP 40 TCP Intranet TCP 40 TCP

78 41 TCP TCP TCP TCP N OS TCP IP ID TCP

79 42 43 TCP TCP N

80 43 44 UDP TCP UDP N 44 UDP

81 45 UDP UDP UDP 45 UDP IP N

82 46 IP 47 IP IP N N 47 IP

83 48 TTL N 48 TTL 49 ID 49 ID

84 50 TCP N 50 TCP 51 TCP TCP N 51 TCP

85 52 TCP TCP

86 54 TCP UDP

87 55 UDP 56 UDP UDP 56 UDP

88 IP IP TCP TCP TTL TCP TTL 6.4. TCP Flooding

89 TCP Pulsing DoS DeS Top N TCP Finger printing N 57 TCP TCP ACK TCP

90 57 TCP TCP AR(Ack-Rst)

91 58 (slot1 slot50) Inside Outside AR Outside

92 Outside.210 Inside SYN Half Open SW-HUB

94 7. IEEE Network July/August ASIC ASIC NP ASIC NP NP NP NP [60][61] NP NP [62] NP IDS

95 - 92 -

96 WIDE

98 WIDE Project, URL

99 1 V. Paxson and S. Floyd, Wide-Area Traffic: The Failure of Poisson Modeling.IEE E/ACM Transactions on Networking, Vol. 3 No. 3, pp , June P. Danzig and S. Jamin, tcplib: A Library of TCP Internetwork Traffic Charact eristics, Report CS-SYS-91-01, Computer Science Department, University of South ern California, 1991, Available via FTP to catatina.usc.edu as pub/jamin/tcplib/tcpl ib.tar.z 3 V. Paxson, Fast,Approximate Synthesis of Fractional Gaussian Noise for Genera ting Self-Similar Network Traffic. Computer Communications Review, V. 27 N. 5, October 1997, pp Paul Barford, Jeffery Kline, David Plonka and Amos Ron "A Signal Analysis of Network Traffic Anomalies", Proceedings of ACM SIGCOMMInternet Measuremen t Workshop M. Robinson, J. Mirkovic, M. Schnaider, S Michel and P. Reiher, Challenges an d Principles of DDoS Defense, submitted to SIGCOMM Rocky K.C. Chang, Hong Kong Polytechnic University, Defending against Floodi ng-based Distributed Denial-of-Service Attacks: Tutorial, IEEE Communications M agazine October The National Laboratory for Applied Network Research, 8 The Cooperative Association for Internet Data Analysis, 9 Huffaker, B., Fomenkov, M., Moore, D., claffy, k., Macroscopic analyses of the in frastructure: measurement and visualization of Internet connectivity and performa nce, Proceedings of PAM MAWI (Measurement and Analysis on the WIDE Internet), p/wg/active/217_mawi.html 11 Kenjiro Cho, Ryo Kaizaki, Akira Kato, Aguri: An Aggregation-Based Traffic Pr ofiler, Quality of Future Internet Services,Coimbre,Portugal,September, Ryo Kaizaki, Osamu Nakamura, Jun Murai, Characteristics of Denial of Servi ce sttacks on Internet using AGURI, The International Conference on Informatio n Networking 2003 Proceedings (vol.1),jeju Korea, Feb PAM2004, April 19-20, 2004, Antibes Juan-les-Pins, France, 4.org/ 14 Internet Measurement Conference 2004, Sponsored by ACM SIGCOMM and in cooperation with USENIX, October 25-27, 2004, Taormina, Sicily, Italy, w.icir.org/vern/imc/

100 15 Steve MaCanne, Craig Leres, Van Jacobson, Network Research Group. Packet Capturing Library, Lawrence Berkeley National Laboratory. ftp:// cap.tar.z 16 tcpdump, 17 K. C. Claffy, G. C. Polyzos, and H-W Braun. Application of Sampling Methodol ogies to Network Traffic Characterisation. In Proceedings of ACM SIGCOMM'93, San Francisco, CA, September (p 65) 18 K.C. Claffy, G.C. Polyzos, and H.-W. Braun. "Application of Sampling Methodol ogies to Network Traffic Characterization", Computer Communication Review, 23 (4): , October IETF WG, Packet Sampling (psamp), arter.html 20 Stefan Savage et.al at, Estimating Global Denial-of-Service Activity NANOG2 2, May 20-22, 2001 Scottsdale, AZ 21 Zhi-Li Zhang, Vinay J. Ribeiro, Sue Moon, and Christophe Diot, Small-Time Sc aling Behaviors of Internet Backbone Traffic: An Empirical Study, the Proceeding s of IEEE INFOCOM 2003, April Glenn MANSFIELD Keeni, The Managed Object Aggregation MIB, work in p rogress, July Management Infromation Base for IP Version 6: Textual Convensions and Gen ral Group, D. Haskin, S. Onishi, Dec. 1998, RFC IP Version 6 Management Information Base for the Transmission Control Prot ocol, M. Daniele, Dec. 1998, RFC IP Version 6 Management Information Base for the User Datagram Protocol, M. Daniele, Dec. 1998, RFC Management Infromation Base for IP Version 6: Textual Convensions and Gen ral Group, D. Haskin, S. Onishi, Dec. 1998, RFC Management Infromation Base for IP Version 6: ICMPv6 Group, D. Haskin, S. Onishi, Dec. 1998, RFC IP Version 6 Management Information Base for the Multicast Listener Discove ry Protocol, B. Haverman, R. Worzella, Jan. 2001, RFC NETWORLD + INTEROP 2003 TOKYO,IPv6 Show Case, p/events/ni2003/_exhibit/_project/ipv6.html 30 net-snmp,

101 31 Kun-chan Lan, Alefiya Hussain and Debojyoti Dutta, The Effect of Malicious T raffic on the Network, In the Proceedings of PAM 2003, April 6-8, La Jolla 32 Alefiya Hussain, John Heidemann, and Christos Papadopoulos. A Framework f or Classifying Denial of Service Attacks. In Proceedings of the ACM SIGCOMM C onference, Karlsruhe, Germany, ACM. August, D. Moore, G. Voelker & S. Savage., "Inferring Internet Denial-of-Service Activit y", USENIX Security Symp, Hussam O.mousa,A Survey and Analysis of Neural Netwrk approaches to Intr usion Detection, SANS institute, 2002/11/12 35 Jake Ryan(1), Meng-Jang Lin(2), and Risto Miikkulainen(1) (2002). Intrusion D etection With Neural Networks, In Jordan, M. I., Kearns, M. J., and Solla, S. A. (editors) Advances in Neural Information Processing Systems 10 (NIPS'97, Denve r, CO), Cambridge, MA: MIT Press, Kymie Tan, The Application Of Neural Networks To UNIX Computer Security Proc. Int. Conf. Neural Networks, ICNN Anup K. Ghosh, James Wanken, Frank Charron, Detectiong Anomalous and U nknown Intrusions Against Programs, Reliable Software Technol., Sterling, VA, US A 38 Cannady, J., Artificial Neural Networks for Misuse Detection, Proceedings of t he 1998 National Information Systems Security Conference (NISSC'98) October Arlington, VA. 39 Zheng Zhang, JunLi C.N. Manikopoulos, Jay Jorgenson, Jose Ucles, HIDE: a H ierarchical Network Intrusion Detection System Using Statistical Preprocessing and Neural Network Classification, Proceedings of the 2001 IEEE, Workshop on Infor mation Assurance and Security, United States Military Academy, West Point, NY, 5-6 June, Peter Lichodzijewski, A. Nur Zincir-Heywood, Malcolm I.Heywood, "Host-Based In trusion Detection Using Self-Organizing Maps", 14th Annual Canadian Informatio n Technology Security Symposium, May Anup K. Ghosh, Aaron Schwartzbard, and Michael Schatz, "Learning Program Behavior Profiles for Intrusion Detection", Proceedings 1st USENIX Workshop on Intrusion Detection and Network Monitoring 42 Review of Anomaly-based Network Intrusion Detection Jonathan Werrett, 2003/ 05/26, 43 Stuart Staniford, James A. Hoagland, and Joseph M. McAlerny. SPADE, Retrieve d May 20th 2003 from the World Wide Web: ice/

102 44 Christopher Krugel, Thomas Toth, and Engin Kirda. Service Specific Anomaly Dete ction for Network Intrusion Detection Proceedings of the ACM Symposium on Appli ed Computing, Matthew C. Mahoney and Philip K. Chan. Learning Nonstarationary Models of No rmal Network Traffic for Detecting Novel Attacks. Proceedings of the Eighth Internati onal Conference of Knowledge Discovery and Data Mining, pp , Retrieve d May 21st 2003 from the World Wide Web: 46 Carol Taylor and Jim Alves-Foss. NATE - Network Analysis of Anomalous Traf fic Events, A Low-Cost Approach. Proceedings of the New Security Paradigms Wo rkshop '01, pp 89-96, September R. Sekar, A. Gupta, J. Frullo, T. Shanbhad, A. Tiwari, H. Yang, and S. Zhou. Specification-based Anomaly Detection: A New Approach for Detectiong Network I ntrusions. Proceedings of the ACM Conference on Computer and Communications Security 2002, November W. Lee, S. J. Stolfo, and K. W. Mok. Mining in a data-flow environment: Expe rience in network intrusion detection. Proceedings of the ACM SIGKDD Internatio nal Conference on Knowledge Discovery & Data Mining (KDD-99), K.Koide, G.Mansfield Keeni, G.Kitagata and N.Shiratori, ``DCAA: A Dynamic Constrained Adaptive Aggregation method for Effective Network Traffic Informatio n Summarization,'' IEICE Transactions on Communications Special Issue on IPv6 Technology (to be appeared in 2004). 50 NSPIXP6: 51 Extended Incident Handling (inch) WG, arter.html 52 Yuri Demchenko, Hiroyuki Ohno, Glenn M Keeni, Requirements for Format for INcident information Exchange (FINE), work in progress, October, 2003, ww.ietf.org/internet-drafts/draft-ietf-inch-requirements-02.txt 53 J. Meijer, R. Danyliw, Y. Demchenko, The Incident Data Exchange Format Dat a Model and XML Implementation, work in progress, September 29, 2003, Steve Gibson, ``DRDoS'', 55 Vern Paxson, ``An Analysis of Using Reflectors for Distributed Denial-of-Servic e Attacks'', Computer Communication Review 31(3),July Rodney Denno ``A Next-Generation DoS Attack: Distributed Reflection'', Aleksandar Kuzmanovic, Edward W. Knightly, Low-Rate TCP-Targeted Denial

103 of Service Attacks, Proceedings of ACM SIGCOMM 2003, August 25-29, S. Uhlig and O. Bonaventure, "Implications of interdomain traffic characterist ics on traffic engineering", European Transactions on Telecommunications, special issue on traffic engineering, B. Quoitin, S. Tandel, S. Uhlig, and O. Bonaventure, "Interdomain Traffic Engi neering with Redistribution Communities", Preprint submitted to Elsevier Science 60 Mohammad Peyravian, Gordon Davis, and Jean Calvignac, Search Engine Im plications for network Processor Efficiency, IEEE Network July/August Frank T. Hady, Tony Bock, Mason Cabat, Jim Chu, Jeff Meinecke, Ken Oliver, and Wes Talarek, Platform Level Support for High Throughput Edge Application s: The Twin Cities Prototype, IEEE Network July/August Ying-Dar Lin and Yi-Neng Lin, Shun-Chin Yang and Yu-Sheng Lin, DiffServ Edge Routers over Network Processors: Implementation and Evaluation, IEEE Ne twork July/August

2004 SYN/ACK SYN Flood G01P014-6

2004 SYN/ACK SYN Flood G01P014-6 2004 SYN/ACK SYN Flood 2005 2 2 1G01P014-6 1 5 1.1...................................... 5 1.2...................................... 5 1.3..................................... 6 2 7 2.1..................................