KR100972206B1 - Method and apparatur for detecting distributed denial of service attack - Google Patents

Abstract

Disclosed is a method and apparatus for detecting a denial of service attack, which is distinguished from a flash event that is a normal user access congestion situation.

According to the present invention, firstly, a denial of service attack and a congestion situation of normal users can be detected and secondly, a general network situation and a congestion situation with one integer value (rank value of the traffic matrix) are detected. And, by expressing the situation of denial of service attack, it is easier to judge the network situation. Third, it can detect not only the attacker attacking by deceiving his own address but also the attack that does not deceive his address. It has an effect.

Network, Security, DDoS, Denial of Service Attacks, Distributed Denial of Service Attacks

Description

METHOD AND APPARATUR FOR DETECTING DISTRIBUTED DENIAL OF SERVICE ATTACK}

The present invention relates to an attack detection method and apparatus, and more particularly, to an attack detection method and apparatus for detecting a denial of service attack by distinguishing from a flash event that is a normal user access congestion situation.

Although there are many technologies such as IDS, IPS, and Firewall for detecting denial-of-service attacks on servers or networks, there has been no technology that accurately distinguishes between normal users' congestion and denial of service attacks. The situation where the congestion of normal users can gain more profits than usual, but this situation is misunderstood as a denial of service attack, which can not generate profits and leads to loss of corporate image. It can cause great damage. Since the technology can generate corporate profits by solving these problems, the market size is too large to calculate.

A denial of service attack is an act of malicious depletion of resources on a server or network, or an attack on a server or network that cannot be operated, so that the server or network cannot provide a smooth service to normal users.

In addition, the congestion situation of normal users refers to a situation in which the server or the network cannot provide a normal service because a large number of users attempt to access concurrently and the server resources are exhausted.

In terms of the situation where the server or network does not provide smooth services to users, the two situations are the same, but the service failure due to a denial of service attack is an attack that must be blocked or defended. It is a situation that must be supplemented or solved through distributed server or distributed content service.

The technology that distinguishes whether the situation of server or network is a denial of service attack or the congestion of normal users is the basis for providing smooth service to users in the congestion situation of normal users. By blocking this under the denial attack, the foundation for providing smooth service to normal users is laid.

Therefore, it is very important to distinguish between denial of service attack and normal user access congestion.

The existing techniques for detecting denial of service attacks are designed to define normal user access congestion as an abnormal server or network situation, and are also designed to detect in the same category as denial of service attacks or to treat normal user access congestion as a situation of denial of service attacks. Misleading has resulted.

When a server or network wastes excessive resources or when a service falls into a disabled state, it must distinguish between denial-of-service attacks or normal user congestion.

Denial-of-service attacks should be distinguished from distributed denial-of-service attacks, or in many cases similar to a congestion situation where a large number of users attempt to connect when disguised as multiple computers attacking an attacker's IP address.

The present invention has been conceived in response to the above-described request, and an object thereof is to provide an attack detection method and apparatus for distinguishing a denial of service attack from a congestion of normal users.

In order to achieve the above object, the attack detection method according to the present invention, the first distribution matrix showing the cluster distribution characteristics of a plurality of requests input to the first time domain starting from the network at a first time; A clustering step of generating a second distribution matrix representing cluster distribution characteristics of a plurality of requests input to a second time domain starting at a second time which is an end time of the one time domain; Processing a cluster overlapping the first distribution matrix and the second distribution matrix to generate at least one new distribution matrix; A randomness checking step of examining randomness of the plurality of cluster distributions; And an attack determination step of determining whether a denial of service attack has occurred based on the randomness.

In addition, the attack detection apparatus according to another aspect of the present invention, the first distribution matrix showing the cluster distribution characteristics of a plurality of requests input to the first time domain starting from the network at a first time, and the first time domain A clustering unit generating a second distribution matrix representing cluster distribution characteristics of a plurality of requests input to a second time domain starting at a second time that is an end time; A redundant cluster cancellation unit for generating a redundant cluster cancellation matrix by canceling matrix components overlapping the first distribution matrix and the second distribution matrix; A non-overlapping cluster cancellation unit for generating a non-overlapping cluster cancellation matrix by canceling components other than the matrix overlapping the first distribution matrix and the second distribution matrix; A randomness checker that checks randomness of the plurality of cluster distributions; And an attack determination unit determining whether a denial of service attack occurs based on the randomness.

First, the present invention has the advantage of detecting the denial of service attacks and normal congestion of normal users compared to other techniques for detecting denial of service attacks.

Second, the present invention provides a basis for more easily determining network conditions by expressing general network situations, congestion situations, and denial of service attacks using only rank values, which are simple integer values.

Third, the present invention can detect and detect not only attacks in which an attacker cheats its own address, but also attacks in which an attacker does not deceive his or her address.

Flash crowd refers to the rapid increase in the number of visitors to a particular site.

Similarly, in the present invention, the term flash event (FE) is used in a “congestion congestion” situation in which many users simultaneously access a specific computer server. The computer server where the flash event occurs is, for example, the official website of the Olympic Games or the registration server at the beginning of the semester, and the computer server is under heavy load.

The most important features of flash events are that they are caused by authorized users and that the server is subjected to abnormal overloads.

Denial of service (DoS) attacks are actions that prevent users from using resources on a particular computer. The typical method of a denial of service attack is to saturate the target computer's ability with external communication requests so that the computer cannot respond to legitimate traffic.

Further, a Distributed Denial of Service (DDoS) attack is a denial of service attack performed by a large number of computers that are distributed in a plurality of networks in cooperation.

In the present specification, unless otherwise stated, the term “attack” or “denial of service attack” shall mean “distributed denial of service attack”.

Hereinafter, an attack detection apparatus and method according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram showing the configuration of an attack detection apparatus according to an embodiment of the present invention.

As shown in FIG. 1, the attack detection apparatus 100 according to an embodiment of the present invention includes a clustering unit 110, a redundant cluster eliminating unit 120, a non-redundant cluster eliminating unit 130, and a randomness checking unit ( 140) and the attack determination unit 150 is made.

The attack detection apparatus 100 is designed to distinguish a flash event from a denial of service attack by using a randomness check of the distribution of client clusters corresponding to the matrix.

At this point, the concept of grouping input requests from host computers on a network into cluster units relating to the IP of the source can be considered.

The reason for grouping input requests in clusters is that clustering groupings can reveal differences that exist between flash event and denial of service attacks.

The cluster referred to in the present invention refers to a group of clients that are topologically adjacent and easily managed together.

During flash events, a normal congestion event, the number of different clusters is significantly less than the number of different clients. In the case of a flash event, about 80% of the input requests approximately follow Pareto's law, which is focused on about 20% of the IP address of the entire computer.

On the other hand, since the IP address of the client is randomly generated in the denial of service attack, the number of different clusters explodes as compared with the flash event.

The clustering unit 110 performs an operation of grouping input requests in cluster units.

In one embodiment of the present invention, the clustering unit 110 performs the grouping of the input requests by capturing the input requests into a matrix (hereinafter referred to as a "distribution matrix") that reflects the distribution characteristics of the cluster to which the input request belongs.

In this embodiment, a simple technique will be described as an example.

First, a four-digit IP address is divided into four octets as shown in Equation 1. At this time, each octet is 1 byte in length.

IP1.IP2.IP3.IP4

At this time, in mapping the input request with each component in the distribution matrix, in the present embodiment, the input request is simply expressed in equations 2 and 2 such that the second octet of the IP address becomes a column and the third octet becomes a raw. Map it together.

i = IP ₃ , j = IP ₂

I is a row component and j is a column component.

2 is a diagram showing a correspondence relationship between a matrix component and an input request.

2 shows the correspondence between the components of the distribution matrix and the input request.

As described above, the input request 220 corresponds to a matrix component having the second octet 222 and the third octet 223 as columns j and row i, respectively, in the distribution matrix 250.

According to such clustering, packets having a second octet and a third octet in common among the IP addresses of the input request are classified into the same cluster corresponding to the same component in the distribution matrix 250.

In this way, the clustering unit 110 generates M (t), which is a distribution matrix constructed during the predetermined time domain, at time t as the starting time for each time domain.

Each time zone may be one second, may be one minute, or may have other durations, the length of the duration being determined by the actual application environment. In this embodiment, the time domain is assumed to be 1 second.

On the other hand, the distribution matrix shown in Fig. 2 is initialized such that all components become zero at the beginning of each time domain. Thereafter, when an input request corresponding to a specific component in the matrix exists, '1' is recorded in the corresponding component of the matrix. As a result, each cell (component) of the 256x256 matrix includes a binary number of zero or one. As a result, the attack detection apparatus according to an embodiment of the present invention has an effect of using only very little memory space of 65,536 bits.

Meanwhile, clustering performed by the clustering unit 110 is not limited to the above-described technique of mapping the second and third octets to the columns and rows of the matrix.

That is, various existing clustering methods may be applied to the present invention. For example, Krishnamurthy and Wang clustering techniques may be applied to the present invention.

However, the matrix construction process should be as simple as possible so that it can be easily implemented in equipment such as a high-speed router. The technique described here has the advantage that a distribution matrix is generated with a fixed size.

Next, in the redundant cluster cancellation unit 120 and the non-redundant cluster cancellation unit 130, the processing of the overlapping cluster existing between two distribution matrices constructed in two adjacent time domains is performed.

The need for redundant cluster processing is as follows.

That is, while many of the clusters created at the time of the flash event are related to host computers that have also visited the site before the event occurred, the overwhelming majority of clusters created by the client generating the denial of service attack request Is often a new cluster that never visited the site before the attack.

Therefore, the size of the redundant cluster within the input request is closely related to the randomness of the cluster, and thus can be a measure for distinguishing a flash event from a denial of service attack.

That is, if the cluster overlaps frequently between input requests, the cluster of the next request can be predicted with a considerable probability.

The redundant cluster cancellation unit 120 generates a new matrix (duplicate cluster cancellation matrix) in which redundant clusters between two distribution matrices that are continuous in time are erased.

In order to cancel the redundant cluster, the redundant cluster cancellation unit 120 performs an exclusive OR (XOR: exclusive OR) on two time-sequential distribution matrices, for example, M (t) and M (t-1).

If a specific component of both distribution matrices is 1, the result of the exclusive OR is 0, and thus, in the redundant cluster cancellation matrix generated as the result of the exclusive OR, the redundant cluster corresponding to the corresponding component is erased. .

Similarly, the non-redundant cluster cancellation unit 130 generates a new matrix (non-duplicate cluster cancellation matrix) leaving only duplicate clusters between two time-sequential distribution matrices.

In order to leave only the redundant cluster, the redundant cluster cancellation unit 120 performs AND on the two distribution matrices M (t) and M (t-1) that are continuous in time.

Since the result of the AND is 1 only when a certain component of both distribution matrices is 1, only the duplicate clusters corresponding to the component are left in the non-overlapping cluster cancellation matrix generated as the result of the AND. have.

Next, the randomness checker 150 calculates the degree of randomness of the cluster as a numerical value.

Various techniques can be applied to test the randomness.

Among them, the technique of examining the linear dependence between fixed length substrings for the original sequence is very efficient.

In one embodiment of the present invention, the rank value of the matrix is used to check the linear dependence of the rows and columns of the matrix.

When R [M (t)] is a rank value of M (t), the rank value of the redundant cluster cancellation matrix and the rank value of the non-overlapping cluster cancellation matrix used in the embodiment of the present invention are represented by Equations 3 and 3 below. It can be expressed as Equation 4.

RXOR [M (t)] = R [M (t) XOR M (t-1)]

RAND [M (t)] = R [M (t) AND M (t-1)]

At this time, the rank value of the matrix is obtained by counting the number of nonzero columns after applying the Gaussian elimination method to the matrix.

The rank value of the matrix is a reliable indicator of randomness and can be explained mathematically.

When the rank value of an m × n matrix is r, the probability P of randomness of the matrix is expressed by the following equation.

P =

P =

At this time, the rank value r is an integer greater than or equal to 1 and less than or equal to the smaller of m and n.

For example, if a 256x256 matrix has a rank value of 252, the matrix is randomized with a probability of 99.999% according to equation (5).

The randomness checker 140 checks the randomness of these matrices by calculating rank values for three matrices such as a distribution matrix M (t), a duplicate cluster cancellation matrix, and a non-overlapping cluster cancellation matrix at time t.

3 is a block diagram illustrating in more detail the randomness checker of FIG. 1.

As shown in FIG. 3, the randomness checker 140 further includes a first rank value calculator 142, a second rank value calculator 144, and a third rank value calculator 146.

That is, in the first rank value calculator 142, the rank value (first rank value) of the distribution matrix M (t) is equal to the rank value of the redundant cluster cancellation matrix in the second rank value calculator 144. The second rank value) calculates the rank value (third rank value) of the nonredundant cluster cancellation matrix in the third rank value calculation unit 146, respectively.

The first rank value, the second rank value, and the third rank value are transmitted to the attack determination unit 150 described below. According to the relationship between these values, the attack determination unit 150 determines whether a denial of service attack has occurred. Judgment is made on whether or not.

Table 1 is a table showing the relationship between the first rank value, the second rank value and the third rank value of the matrix and the attack determination.

Network status 1st rank value Second rank value Third rank value Normal condition littleness littleness littleness Flash events Medium + middle middle- Source modulated
Distributed Denial of Service Attack Greater than (> T) Greater than (> T) littleness Source unmodulated
Distributed Denial of Service Attack Greater than (> T) littleness Greater than (> T)

The normal state is that neither a simple congestion (flash event) nor a denial of service attack occurs on the network.

In the normal state, the first rank value, the second rank value, and the third rank value are all kept small.

On the other hand, in the flash event, the first rank value which is the rank value of M (t), the second rank value which is the rank value for the exclusive logical sum of M (t) and M (t-1), M (t) and M (t There are some deviations in three rank values, such as the third rank value, which is the rank value with respect to the logical product of -1). These three rank values are larger than the three rank values in the normal state. However, even if the size of the input traffic is greatly increased, their rank value does not represent a large value beyond a certain value, that is, the “reference value T”.

This is because in a flash event, even if a large number of requests are requested from a small number of clusters, cluster duplication occurs a little and the rank value is not large.

Accordingly, the rank value of the exclusive logical sum and the rank value of the exclusive logical sum also become somewhat smaller than the rank value of M (t).

In this case, the symbols '+' and '-' are symbols added to indicate that there is a slight difference between these values.

The magnitude relationship between the first rank value, the second rank value, and the third rank value is expressed by the following equation.

1st rank value> 2nd rank value> 3rd rank value.

If the server is under a distributed denial of service attack, the first rank value becomes a large value exceeding a predetermined reference value T. This is because, in a distributed denial of service attack, the more input requests, the more clusters requesting input requests.

In the case of source-spoofed distributed denial of service attacks, cluster duplication is relatively small because the source IP address is chosen at random. Therefore, the phenomenon that cluster overlap is relatively small is reflected, so that the rank value of the exclusive logical sum of M (t) becomes a very large value, while the value of the logical product of M (t) becomes a very small value.

In the case of non-source-spoofed distributed denial-of-service attacks, there is a relatively large number of cluster redundancies. Therefore, the rank of the exclusive OR of M (t) becomes small, and the rank of M (t) of logical product. The value increases.

Accordingly, by comparing the magnitudes of the first rank value, the second rank value, and the third rank value with the reference value T, the randomness of the cluster distribution corresponding to the matrix can be determined.

On the other hand, the reference value T is obtained using the equation (5).

That is, substituting T into r with respect to Equation 5, taking the logarithm of 2 below on both sides, and arranging the equation, the following equation is derived.

(m-T) 2 = log 2 (1 / P).

Where m is the magnitude of the square distribution matrix and P is the probability that the square distribution matrix is a random matrix.

4 is a flowchart showing the flow of an attack detection method according to an embodiment of the present invention.

As shown in FIG. 4, the attack detection method includes a clustering step S110, a redundant cluster processing step S120, a randomness checking step S130, and an attack determination step S140.

In the clustering step (S110), input requests are grouped in cluster units.

That is, in the clustering step S110, a distribution matrix M (t) reflecting cluster distribution characteristics of a plurality of requests input in the corresponding time domain is generated in every time region respectively started at time t.

The clustering step S110 is performed by the clustering unit 110 of the attack detection device 100.

In the duplicate cluster processing step S120, duplicate clusters existing between two temporally adjacent distribution matrices are erased from their respective distribution matrices, or the rest except the duplicate clusters are erased.

5 is a flowchart showing the redundant cluster processing step S120 in more detail.

As shown in FIG. 5, the redundant cluster processing step S120 may further include a redundant cluster erasing step S122 and a non-redundant cluster erasing step S124.

In the redundant cluster erasing step (S122), an exclusive OR operation is performed on two temporally adjacent distribution matrices, thereby generating a redundant cluster cancellation matrix, which is a new matrix in which all redundant clusters are erased.

In the non-overlapping cluster erasing step (S124), a logical product operation is performed on two time-adjacent distribution matrices, thereby generating a non-redundant cluster erasing matrix, which is a new matrix in which only redundant clusters are left.

The redundant cluster erasing step S122 is performed by the redundant cluster erasing unit 120 of the attack detection apparatus 100, and the non-redundant cluster erasing step S124 is performed by the non-redundant cluster erasing unit 130, respectively.

Referring back to FIG. 4, in the randomness check step S130, randomness check of the cluster distribution is performed.

The randomness check of the cluster distribution is performed by measuring rank values for three matrices, a distribution matrix M (t), a redundant cluster cancellation matrix, and a non-redundant cluster cancellation matrix.

To this end, the randomness check step (S140) is a step of measuring the rank value (first rank value) of the distribution matrix (S132), the step of measuring the rank value (second rank value) of the redundant cluster cancellation matrix (S134). And measuring the rank value (third rank value) of the non-redundant cluster cancellation matrix (S136).

Steps S132, S134, and S136 include the first rank value calculator 142 and the second rank value calculator 144 inside the randomness checker 140 of the attack detection apparatus 100, respectively. And the third rank value calculator 146.

The determination of attack based on these rank values is as follows.

If both the first rank value, the second rank value, and the third rank value are larger than in the normal state and smaller than the reference value T, it is determined that a flash event has occurred.

When the first rank value and the second rank value are larger than the reference value and the third rank value is smaller than the reference value, it is determined that the source-modulated distributed denial of service attack has occurred.

If the first rank value and the third rank value are larger than the reference value and the second rank value is smaller than the reference value, it is determined that a distributed denial of service attack has not occurred.

On the other hand, the reference value T is calculated before the randomness checking step S140.

Embodiments of the present invention are not implemented only through the above-described apparatus and / or method, but may be implemented through a program for realizing a function corresponding to the configuration of the embodiments of the present invention, a recording medium on which the program is recorded, and the like. Such implementations may be readily implemented by those skilled in the art from the description of the above-described embodiments.

In addition, although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of the invention.

1 is a block diagram showing the configuration of an attack detection apparatus according to an embodiment of the present invention;

2 is a diagram showing a correspondence relationship between a matrix component and an input request;

3 is a block diagram showing in more detail the randomness check unit of FIG.

4 is a flowchart illustrating a flow of an attack detection method according to an embodiment of the present invention;

5 is a flow chart illustrating the redundant cluster processing step of FIG. 4 in more detail.

Claims (12)

delete A first distribution matrix showing cluster distribution characteristics of a plurality of requests input to a first time domain starting at a first time from a network; and a second time domain starting at a second time which is an end time of the first time domain. A clustering step of generating a second distribution matrix representing cluster distribution characteristics of a plurality of input requests; A duplicate cluster cancellation step of generating a duplicate cluster cancellation matrix by canceling matrix components overlapping the first distribution matrix and the second distribution matrix; A non-overlapping cluster erasing step of generating non-redundant cluster cancellation matrices by canceling components other than the matrix overlapping the first distribution matrix and the second distribution matrix; A randomness checking step of examining randomness of the plurality of cluster distributions; And On the basis of the randomness, attack detection method comprising an attack determination step of determining whether a denial of service attack occurs. The method of claim 2, The randomness check step, And a rank value calculation step of calculating a first rank value for the second distribution matrix, a second rank value for the redundant cluster cancellation matrix, and a third rank value for the non-redundant cluster cancellation matrix. . The method of claim 2, In the redundant cluster cancellation step, the redundant cluster cancellation matrix is generated by exclusive OR of the first distribution matrix and the second distribution matrix. The method of claim 2, In the non-overlapping cluster erasing step, the non-redundant cluster elimination matrix is generated by performing an AND operation on the first distribution matrix and the second distribution matrix. The method of claim 3, The attack determination step, And determining that a source unmodified distributed denial of service attack has occurred when the first rank value and the third rank value are larger than a reference value and the second rank value is smaller than the reference value. The method of claim 3, The attack determination step, And determining that a source-modulated distributed denial of service attack has occurred when the first rank value and the second rank value are greater than a reference value and the third rank value is less than the reference value. The method of claim 3, The attack determination step, And determining that a flash event has occurred when the first rank value, the second rank value, and the third rank value are not greater than a reference value and are larger than a normal rank value of the network. . A first distribution matrix showing cluster distribution characteristics of a plurality of requests input to a first time domain starting at a first time from a network; and a second time domain starting at a second time which is an end time of the first time domain. A clustering unit generating a second distribution matrix representing cluster distribution characteristics of a plurality of input requests; A redundant cluster cancellation unit for generating a duplicate cluster cancellation matrix by canceling matrix components overlapping the first distribution matrix and the second distribution matrix; A non-overlapping cluster cancellation unit for generating a non-overlapping cluster cancellation matrix by canceling components other than the matrix overlapping the first distribution matrix and the second distribution matrix; A randomness checker for checking a randomness of a cluster distribution by using the second distribution matrix, the redundant cluster cancellation matrix, and the non-redundant cluster cancellation matrix; And Based on the randomness, the attack detection device including an attack determination unit for determining whether a denial of service attack occurs. 10. The method of claim 9, The randomness check unit, A first rank value calculator for calculating a first rank value for the second distribution matrix of the cluster distribution; A second rank value calculator for calculating a second rank value for the redundant cluster cancellation matrix; And And a third rank value calculator for calculating a third rank value for the non-redundant cluster cancellation matrix. 10. The method of claim 9, And the distribution matrix generator generates the first distribution matrix and the second distribution matrix using a portion of four octets included in the IP address of the request. The method of claim 11, And the distribution matrix generating unit associates the request with a matrix component having a second octet of the request as a column and a third octet of the octet as a row.

Images