On Implementation of Efficient Inline DDoS Detector Based on AATAC Algorithm

• Autorzy: Wiśniewski Piotr , Sosnowski Maciej , Burakowski Wojciech

Identyfikatory

DOI

10.24425/ijet.2022.143899

• Języki publikacji: EN

Abstrakty

EN

Distributed Denial of Service (DDoS) attacks constitute a major threat in the current Internet. These cyber-attacks aim to flood the target system with tailored malicious network traffic overwhelming its service capacity and consequently severely limiting legitimate users from using the service. This paper builds on the state-of-the-art AATAC algorithm (Autonomous Algorithm for Traffic Anomaly Detection) and provides a concept of a dedicated inline DDoS detector capable of real-time monitoring of network traffic and near-real-time anomaly detection. The inline DDoS detector consists of two main elements: 1) inline probe(s) responsible for link-rate real-time processing and monitoring of network traffic with custom-built packet feature counters, and 2) an analyser that performs the near-real-time statistical analysis of these counters for anomaly detection. These elements communicate asynchronously via the Redis database, facilitating a wide range of deployment scenarios. The inline probes are based on COTS servers and utilise the DPDK framework (Data Plane Development Kit) and parallel packet processing on multiple CPU cores to achieve link rate traffic analysis, including tailored DPI analysis.

Słowa kluczowe

EN

DDoS; Distributed Denial of Service; traffic anomaly detection; AATAC; performance; DPDK

• Wydawca: Polish Academy of Sciences, Committee of Electronics and Telecommunication
• Czasopismo: International Journal of Electronics and Telecommunications
• Rocznik: 2022
• Tom: Vol. 68. No. 4
• Strony: 889--898
• Opis fizyczny: Bibliogr. 17 poz., rys., tab., wykr.

Twórcy

autor

Wiśniewski Piotr

• Warsaw University of Technology, Institute of Telecommunications

autor

Sosnowski Maciej

• Warsaw University of Technology, Institute of Telecommunications

autor

Burakowski Wojciech

• Warsaw University of Technology, Institute of Telecommunications

Bibliografia

• [1] A. Zand, G. Modelo-Howard, A. Tongaonkar, S. -J. Lee, C. Kruegel and G. Vigna, “Demystifying DDoS as a Service,” in IEEE Communications Magazine, vol. 55, no. 7, pp. 14-21, July 2017, https://doi.org/10.1109/MCOM.2017.1600980.
• [2] J. J. Santanna et al., “Booters — An analysis of DDoS-as-a-service attacks,” 2015 IFIP/IEEE International Symposium on Integrated Network Management (IM), 2015, pp. 243-251, https://doi.org/10.1109/INM.2015.7140298.
• [3] Apache documentation, ServerLimit Directive [online]. Available from: https://httpd.apache.org/docs/2.4/mod/mpm_common.html#serverlimit [Accessed 21.10.2022].
• [4] M. Sikora, T. Gerlich and L. Malina, “On Detection and Mitigation of Slow Rate Denial of Service Attacks,” 11th International Congress on Ultra Modern Telecommunications and Control Systems and Workshops (ICUMT), 2019, pp. 1-5, https://doi.org/10.1109/ICUMT48472.2019.8970844.
• [5] H. Kaur, S. Behal and K. Kumar, “Characterisation and comparison of Distributed Denial of Service attack tools,” 2015 International Conference on Green Computing and Internet of Things (ICGCIoT), 2015, pp. 1139-1145, https://doi.org/10.1109/ICGCIoT.2015.7380634.
• [6] G. Roudière and P. Owezarski, “A lightweight snapshot-based DDoS detector,” in Proc. of 2017 13th International Conference on Network and Service Management (CNSM), 2017, pp. 1-7, https://doi.org/10.23919/CNSM.2017.8256014.
• [7] J. Wang, R. C. -W. Phan, J. N. Whitley and D. J. Parish, “Augmented Attack Tree Modeling of Distributed Denial of Services and Tree Based Attack Detection Method,” 2010 10th IEEE International Conference on Computer and Information Technology, 2010, pp. 1009-1014, https://doi.org/10.1109/CIT.2010.185.
• [8] Y. -C. Wu, H. -R. Tseng, W. Yang and R. -H. Jan, “DDoS Detection and Traceback with Decision Tree and Grey Relational Analysis,” 2009 Third International Conference on Multimedia and Ubiquitous Engineering, 2009, pp. 306-314, https://doi.org/10.1109/MUE.2009.60.
• [9] A. Saied, R. E. Overill, and T. Radzik, “Detection of known and unknown DDoS attacks using Artificial Neural Networks,” Neurocomputing, vol. 172, January 2016, pp. 385-393, https://doi.org/10.1016/j.neucom.2015.04.101.
• [10] X. Qin, T. Xu and C. Wang, “DDoS Attack Detection Using Flow Entropy and Clustering Technique,” 2015 11th International Conference on Computational Intelligence and Security (CIS), 2015, pp. 412-415, https://doi.org/10.1109/CIS.2015.105.
• [11] S. Ramaswamy, R. Rastogi and K. Shim, “Efficient algorithms for mining outliers from large data sets,” ACM SIGMOD Rec., vol. 29, no. 2, pp. 427-438, 2000.
• [12] R. Hofstede, V. Bartoš, A. Sperotto and A. Pras, “Towards real-time intrusion detection for NetFlow and IPFIX,” Proceedings of the 9th International Conference on Network and Service Management (CNSM 2013), 2013, pp. 227-234, https://doi.org/10.1109/CNSM.2013.6727841.
• [13] G. Roudière and P. Owezarski, “Evaluating the Impact of Traffic Sampling on AATAC’s DDoS Detection” in Proc. of the 2018 Workshop on Traffic Measurements for Cybersecurity (WTMC ‘18). Association for Computing Machinery, New York, NY, USA, 27-32. https://doi.org/10.1145/3229598.3229605.
• [14] M. Jin, C. Wang, P. Li and Z. Han, “Survey of Load Balancing Method Based on DPDK,” 2018 IEEE 4th International Conference on Big Data Security on Cloud (BigDataSecurity), IEEE International Conference on High Performance and Smart Computing, (HPSC) and IEEE International Conference on Intelligent Data and Security (IDS), 2018, pp. 222-224, https://doi.org/10.1109/BDS/HPSC/IDS18.2018.00054.
• [15] Information about the TAMA project, Exatel webpage [online]. Available from: https://exatel.pl/en/research-and-development/exatel-tama/ [Accessed 21.10.2022].
• [16] S. Bradner, and J. McQuaid, “Benchmarking Methodology for Network Interconnect Devices”, RFC 2544, https://doi.org/10.17487/RFC2544, March 1999.
• [17] S. Bradner, “Benchmarking Terminology for Network Interconnection Devices”, RFC 1242, https://doi.org/10.17487/RFC1242, July 1991.

Uwagi

1. Opracowanie rekordu ze środków MEiN, umowa nr SONP/SP/546092/2022 w ramach programu "Społeczna odpowiedzialność nauki" - moduł: Popularyzacja nauki i promocja sportu (2022-2023).

2. This work was supported by the Polish National Centre for Research and Development under Project CYBERSECIDENT/381651/II/NCBR/2018 (TAMA project). The project was realized by a consortium of EXATEL and Warsaw University of Technology.