KR101381606B1 - Content centric network node and method of detecting denial of service therein - Google Patents

Abstract

A content centric network node and a method for detecting denial of service of the node are provided. A content concentric network node according to an embodiment of the present invention includes: a network congestion index calculation unit to detect the occurrence of service denial by comparing input or output information of interest and data with the threshold value which is a criteria for determining whether the service denial due to interest flooding is occurred or not and recalculating a return time using the exponential weighted moving average after setting a time between an interest is transmitted to the content concentric network and the corresponding data reaches as a network congestion indicator; and a threshold value correction unit to correct the threshold value using a timeout time which is a time limit which an interest transmitted to the content concentric network node is stored in the content concentric network node, the recalculated return time and weighting factor set by a user. [Reference numerals] (10) Network congestion index calculation unit; (11) Threshold value correction unit; (12) Attack detection unit; (16) First face; (17) Second face; (18) Third face; (19) N^th face

Description

CONTENT CENTRIC NETWORK NODE AND METHOD OF DETECTING DENIAL OF SERVICE THEREIN}

The present invention relates to a content-centric network node and a method for detecting a denial of service attack of the node. More specifically, the flow rate and interest flood values of Interest packets (hereinafter referred to as Interest) and Data packets (hereinafter referred to as Data) are described. Increase of normal interest by judging occurrence of denial of service attack by comparing the threshold that is the criterion of occurrence of denial of service attack due to the occurrence of denial of service attack and correcting the threshold to reflect the network congestion due to the surge of normal interest. The present invention relates to a technique for preventing a mistake in a Interest flooding attack.

Content-oriented networking is attracting attention as a new communication architecture technology that requires users to request content based on the name of the content itself, unlike the existing Internet, which requests content based on the host address.

The change to the content - centric paradigm disappears the end - to - end connectivity of the existing Internet and the contents become position - independent. Content-centric networking is actively leveraging it to focus on securing the content itself, not rapid content distribution and distribution and end-to-end connection channel protection through network caching.

The content-oriented networking communicates with a Interest packet (hereinafter referred to as Interest) for requesting a content and a Data packet (hereinafter referred to as Data) including the requested content.

Figure 1 shows the format for Interest and Data. The Interest shown in FIG. 1 (a) is composed of a content name combined with a domain address and a content name requested by a user, a Selector including a request attribute, and a nonce, which is a random value. Data shown in (b) of FIG. 1 is divided into the same area as the content name of the interest received in the request, the Signature and Signed Info for security of the content itself, and the data area for transmitting the content file.

As such, content-centric network nodes, such as routers, include a forwarding engine consisting of three components to handle different packet types than the traditional Internet.

First, the CS (Content Store) is a cache at the network level and is responsible for storing the contents of the data. When the interest corresponding to the request for the content of the same name arrives, the stored contents are stored in the data and transmitted immediately. Therefore, even if the interest is not completely different to the content distributor, the content can be delivered quickly if the content is stored in the CS of the intermediate router. However, since the cache size of CS is finite, new data is handled according to cache replacement policy such as LRU or LFU if there is insufficient space to store on arrival.

Second, the PIT (Pending Interest Table) is a kind of finite repository for the breadcrumb reverse path, where the interest is propagated and leaves a trace on its propagated path. To do this, it stores the face (interface) information of interest and the interest arriving for a while, confirms the incoming face of Interest stored at the time of the corresponding data, After transferring the data, the stored interest is erased. If Interest corresponding to the same content request is already stored, Interest Aggregation is performed to add only the arrived face number to the stored Interest. The PIT also provides anti-roofing function of Reverse Path which is generated by using Nonce to propagate Interest.

Finally, the Forwarding Information Base (FIB) is responsible for registering paces. Interest allows you to know at what pace you should be forwarded by referring to the registered face list on arrival. If multiple paces correspond to Interest, Interest is copied and delivered to all corresponding paces.

Figure 2 illustrates the process of Interest in a content-centric networking (CCN) forwarding engine. ① First, when an interest arrives through a face, CS is searched for the same content name as Interest. ② If there is a matching content, the content is put in Data and sent to the path where Interest has come. ② If not, store Interest in PIT and send Interest at the face where the content name and list of FIB are longest-prefix matching.

3 illustrates a process of processing data in a content-centric networking (CCN) forwarding engine.

① When the data arrives through the face, it searches the CS for the same content to avoid redundant storage of data, and stores it only when there is no content. ② After that, it confirms whether or not there is a stored interest in the PIT that matches the content name of this data, and if it exists, it is transferred to the corresponding face and the Interest is deleted. ② 'If it does not exist, unrequested data has arrived, so it is regarded as abnormal and discarded.

However, interest flooding attacks can occur due to structural weaknesses in the processing of content request, Interest, in content-oriented networking.

In other words, if the size of the PIT repository is finite and the stored interest remains until the data arrives and the open source provided by the CCNx project (disclosed in www.ccnx.org) is analyzed, a memory allocation These measures are not taken in case of failure.

An attacker could exploit this vulnerability to send an interesting flooding attack by sending a large amount of Interest containing different content names for a short time.

During the Interest flooding attack, due to the absence of the verification process for Interest, the PITs of intermediate routers that deliver Interest to the content server where the contents are stored are rapidly filled with the Attacker's Interest, resulting in a shortage of space. Eventually, except for a request for content that is already cached, even if normal interest arrives, there is no space for storing it. That is, a denial of service situation occurs in which a service cannot be normally provided.

A technique for detecting a denial of service attack due to such interest flooding has been proposed. In other words, the value of the flow rate of interest and data in a content-centric network node, such as a router, per unit time, for example, the value of the number of interest received and the number of data sent, and the criteria of occurrence of denial of service attacks due to interest flooding. The denial of service attack is judged by comparing the in threshold.

However, when network congestion occurs due to normal interest increase in the content-oriented network, the bandwidth of links between routers is depleted in the content-oriented network, which increases the delay time for receiving data corresponding to the interest, resulting in a denial of service attack. You will see the same pattern.

As a result, the prior art of determining a denial of service attack by comparing the flow rate ratio of Interest and Data with the threshold value, which is a criterion of occurrence of denial of service attack due to the occurrence of Interest flooding, is related to the occurrence of network congestion caused by the surge of interest, which is a normal content request. It causes a problem of mistaken case as denial of service attack due to Interest flooding.

A prior art related to the present invention is Korean Patent Publication No. 10-2013-0039652 (published on Apr. 22, 2013).

Denial of service by correcting the threshold by reflecting network congestion caused by the surge of normal interest when determining the occurrence of denial of service attack by comparing the value of the flow rate of interest and data with the threshold value that is the criterion of occurrence of denial of service attack due to the occurrence of interest flooding A content-centric network node and a denial of service attack detection method of the node are proposed to prevent an increase in normal interest from being mistaken for an Interest flooding attack by determining an attack occurrence.

The problems to be solved by the present invention are not limited to the above-mentioned problems, and other problems that are not mentioned can be clearly understood by those skilled in the art from the following description.

The content-centric network node that detects the occurrence of the denial of service attack by comparing the flow rate information of Interest and Data according to an aspect of the present invention with a threshold that is a criterion of occurrence of the denial of service attack due to Interest flooding is a content-centric network. A network congestion index calculation unit configured to set the time from when the interest is transmitted to the corresponding data to the round trip time as a network congestion index and recalculate the round trip time by an exponential weighted moving average; And a threshold correction unit configured to correct the threshold using a timeout time, a timeout time limit for storing interest transmitted to the content centric network in the content centric network node, the recalculated round trip time, and a weight set by a user. .

(Z_n은 n 시점에서 계산된 상기 왕복시간을 지수가중이동평균하여 재계산한 값(상기 재계산된 왕복시간), λ는 가중치(0≤λ≤1), L_n은 상기 왕복시간, Z_{n -1}은 n-1 시점에서 계산된 왕복시간을 지수가중이동평균하여 재계산한 값)을 이용하여 구해질 수 있다.The recalculated round trip time is

(Z _n is a value calculated by exponentially weighted moving average of the round trip time calculated at time point n (the recalculated round trip time), λ is a weight (0 ≦ λ ≦ 1), and L _n is the round trip time, Z _{n -1} can be obtained using the recalculation of the round trip time calculated at n-1 by exponentially weighted moving average.

The round trip time is a time when interest is stored in the content-centric network when the interest is discarded because the time-out time exceeds the timeout time, and a face to which Interest is transmitted to the content-centric network is not stored in the content-centric network node. Therefore, it may be '0' in the case of any one of interest discarded.

(θ_c는 상기 보정된 임계치, θ는 상기 임계치, Z_n은 상기 재계산된 왕복시간, δ는 상기 타임아웃시간, σ는 사용자가 설정한 가중치)를 이용하여 구해질 수 있다.The corrected threshold is

(θ _c is the corrected threshold value, θ is the threshold value, Z _n is the recalculated round trip time, δ is the timeout time, σ is a weight set by the user).

The correction period of the threshold may be less than or equal to the detection period of the denial of service attack.

The content-centric network node has a plurality of interfaces (Interfaces) for transmitting and receiving Interest and Data through communication with the content-centric network, the network congestion index calculation unit is the exponential weighted moving average of the round trip time for each of the plurality of faces The threshold value correction unit calculates a timeout time and a round trip time at a corresponding pace for each of the plurality of faces, the time that interest transmitted to the content centric network is stored in the content centric network node. The threshold value may be corrected by using a recalculated value by an exponential weighted moving average and a weight set by a user.

According to another aspect of the present invention, a denial of service attack detection method of a content-centric network node that detects the occurrence of a denial of service attack by comparing the flow of information of interest and data with a threshold that is a criterion of occurrence of denial of service attacks due to Interest flooding. Setting a time from when the Interest is transmitted to the content centric network until the corresponding data is reached as a round trip time which is a network congestion index; Recalculating the round trip time by an exponential weighted moving average; And calibrating the threshold value using a timeout time which is a limit time when interest transmitted to the content centric network is stored in the content centric network node, the recalculated round trip time, and a weight set by the user.

According to the content-centric network node and the denial of service attack detection method of the node according to an embodiment of the present invention, the denial of service by comparing the flow rate ratio value of Interest and Data with the threshold that is the determination criteria of the denial of service attack due to Interest flooding When determining the occurrence of an attack, the threshold is reflected by determining the denial of service attack by reflecting the network congestion caused by the surge of normal interest, thereby preventing a normal increase in interest from being mistaken as an Interest flooding attack.

1 is a diagram showing formats for Interest and Data.
2 is a diagram illustrating a process of processing interest in a content-centric networking (CCN) forwarding engine.
3 is a diagram illustrating a process of processing data in a content-centric networking (CCN) forwarding engine.
4 is a diagram illustrating a location of a content centric network node according to an embodiment of the present invention in a content centric network.
5 is a diagram showing the configuration of a content-centric network node according to an embodiment of the present invention.
6 is a diagram illustrating a Forwarding Informaiton Base (FIB).
7 is a flowchart illustrating a denial of service attack detection method of a content-centric network node according to an embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Embodiments of the present invention are provided to more fully describe the present invention to those skilled in the art, and the following embodiments may be modified in various other forms, The present invention is not limited to the following embodiments. Rather, these embodiments are provided so that this disclosure will be more thorough and complete, and will fully convey the concept of the invention to those skilled in the art.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms "a", "an," and "the" include plural forms unless the context clearly dictates otherwise. Also, " comprise "and / or" comprising "when used herein should be interpreted as specifying the presence of stated shapes, numbers, steps, operations, elements, elements, and / And does not exclude the presence or addition of one or more other features, integers, operations, elements, elements, and / or groups. As used herein, the term "and / or" includes any and all combinations of one or more of the listed items.

Although the terms first, second, etc. are used herein to describe various elements, regions and / or regions, it should be understood that these elements, components, regions, layers and / Do. These terms do not imply any particular order, top, bottom, or top row, and are used only to distinguish one member, region, or region from another member, region, or region. Thus, the first member, region or region described below may refer to a second member, region or region without departing from the teachings of the present invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings schematically showing embodiments of the present invention. In the figures, for example, variations in the shape shown may be expected, depending on manufacturing techniques and / or tolerances. Accordingly, embodiments of the present invention should not be construed as limited to any particular shape of the regions illustrated herein, including, for example, variations in shape resulting from manufacturing.

4 is a diagram illustrating a location of a content centric network node according to an embodiment of the present invention in a content centric network, and FIG. 5 is a diagram illustrating a configuration of a content centric network node according to an embodiment of the present invention.

Referring to FIG. 4, the content-centric network node according to an embodiment of the present invention may be a CCN defense router 1, which is a boundary router between an internal network to which terminals 2 of interest flooding attacks belong and an external network that does not belong. However, the present invention is not limited thereto, and may be other routers, that is, routers constituting a content-centric network. However, adding the ability to detect denial of service attacks to the CCN defense router 1, which is a boundary router, can be effective in terms of configuration cost of the content-centric network and proactive blocking of denial of service attacks.

As shown in FIG. 5, the content-centric network node 1 according to the embodiment of the present invention includes a network congestion index calculator 10, a threshold correction unit 11, an attack detector 12, and a plurality of faces. Ones 16, 17, 18, 19.

The attack detection unit 12 detects the occurrence of the denial of service attack by comparing the flow rate information of Interest and Data with a threshold that is a criterion of occurrence of the denial of service attack due to Interest flooding.

At this time, the interest and data flow-in and out information may be a ratio of the number of Interests received by the content-centric network node 1 and the number of Datas transmitted from the content-centric network node 1. However, it is not limited thereto.

The pace at which interest is received by the content-centric network node 1 and the pace at which data corresponding to the interest received at the pace are transmitted are the same, and the pace-based network 16 has a plurality of faces 16; Since 17, 18, and 19 are provided, the attack detection unit 12 may detect the occurrence of a denial of service attack for each of the plurality of faces 16, 17, 18, and 19. Accordingly, the network congestion index calculation unit 10 and the threshold correction unit 11 may also perform each operation for each of the plurality of faces 16, 17, 18, and 19.

The face is used in place of an interface in a content centric network. The reason is that unlike the interface, it refers to the passage of information to and from the application process on the host.

This is the original text mentioned by the proponent of Content Centric Networking. "We use the term face rather than interface because packets are not only forwarded over hardware network interfaces but also exchanged directly with application processes within a machine. Forwarded and directly connected to the application process within the device, where packets are exchanged).

The network congestion index calculation unit 10 sets the time from the transmission of interest to the content-centric network until the corresponding data is reached as the round trip time, which is the network congestion index, and the round trip time is the exponential weighted moving average. Recalculate The reason for applying the exponentially weighted moving average is to weight the latest data rather than the historical data. In this case, the network congestion index calculation unit 10 may obtain the recalculated round trip time Z _n using Equation 1 below.

In this case, Z _n is a value that is recalculated by exponentially weighted moving average calculated at n time point, that is, the recalculated round trip time, λ is a weight (0 ≦ λ ≦ 1), and L _n is the round trip time Z _{n -1} represents a recalculation of the round trip time calculated at n-1 by exponentially weighted moving average.

In Equation 1, a round trip time L _n , which is a network congestion index, cannot be obtained. In this case, the round trip time L _n is defined as '0'.

This round trip time cannot be obtained in the following situations.

First, when Interest is received in the content centric network node 1, the Interest is stored in a PIT (Pending Interest Table) (not shown) of the content centric network node 1. It is discarded beyond the timeout timeout, which is the request of nonexistent content. In this situation, the data cannot be reached and the existing content is requested. However, the network is very congested. Occurs when data cannot be reached in time.

Second, the case in which interest is discarded because a face to which Interest is transmitted to the content-centric network is not stored in the forwarding information base (FIB) of the content-centric network node 1. In this case, the FIB is illustrated in FIG. As shown, the face information (Outgoing Face (s)) in which Interest is to be transmitted to the content-centric network maps the name of the content holding node included in the prefix of Interest, for example, the name of the content holding node is' / ajou. In the case of ac.kr/user1/, the face (Outgoing Face (s)) of the content-centric network node 1 to which the interet including this is transmitted to the content-centric network node is mapped to the first face.

The network congestion index calculation unit 10 may store the recalculated round trip time in the exponentially weighted moving average region (EWMA of Latency) of the FIB illustrated in FIG. 6. That is, if the recalculated round trip time is for phase 1, it is stored in an exponentially weighted moving average region (EWMA of Latency) mapped to phase 1. As a result, the FIB is extended to store the round trip time recalculated for each phase, thereby reducing waste of space, and efficiently managing round trip time calculated using an exponential weighted moving average.

The threshold correction unit 11 corrects the threshold value by using a timeout time which is a limit time for the interest transmitted to the content centric network to be stored in the content centric network node, the recalculated round trip time, and a weight set by the user. do. In this case, the threshold corrector 11 may correct the threshold using Equation 2 below.

Θ _c is the corrected threshold, θ is the threshold, Z _n is the recalculated round trip time, δ is the timeout time, and σ represents a weight set by the user.

Since the correction of the threshold through Equation 2 reflects network congestion, it needs to be made at least before detection of a denial of service attack. That is, the correction period of the threshold may be less than or equal to the detection period of the denial of service attack.

7 is a flowchart illustrating a denial of service attack detection method performed by the content-centric network node 1 according to an embodiment of the present invention.

Referring to FIG. 7, the content-centric network node 1 sets the time from when interest is transmitted to the content-centric network until the corresponding data is reached as a round trip time which is a network congestion index (S10). In this case, as described above, when interest is discarded because the time stored in the content centric network exceeds the timeout time, and a face for transmitting interest to the content centric network is not stored in the content centric network node. If the interest is discarded, the round trip time may be set to '0'.

Thereafter, the content-centric network node 1 recalculates the round trip time by using an exponential weighted moving average (S20). In this case, the content-oriented network node 1 may recalculate the round trip time by exponentially weighted moving average using Equation (1).

The content-centric network node 1 uses the timeout time, the recalculated round-trip time, and the weight set by the user, which is a limit time when Interest transmitted to the content-centric network is stored in the content-centric network node. Correct (S30). In this case, the content-centric network node 1 may correct the threshold value by reflecting network congestion using Equation 2. Since the correction of the threshold through the above steps S10 to S30 reflects network congestion, it needs to be made at least before detection of a denial of service attack. That is, the correction period of the threshold may be less than or equal to the detection period of the denial of service attack.

The present invention has been described above with reference to the embodiments. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. Therefore, the scope of the present invention is not limited to the above-described embodiments, but should be construed to include various embodiments within the scope of the claims and equivalents thereof.

10: network congestion index calculation unit
11: threshold correction unit
12: attack detection unit

Claims (12)

In the content-oriented network node that detects the occurrence of the denial of service attack by comparing the flow of information of interest and data with the threshold which is a criterion for determining the denial of service attack due to the interest flooding,
Network congestion index calculation unit that calculates the time from the transmission of interest to the content-oriented network until the data is reached as the round trip time, the network congestion index, and recalculates the round trip time by the exponential weighted moving average. ; Wow
And a threshold correction unit configured to correct the threshold value using a timeout time which is a limit time stored in the content centric network node, the recalculated round trip time, and a weight set by a user. Characterized by content-centric network nodes. The method according to claim 1,
The recalculated round trip time is
expression

(Z _n is a value calculated by exponentially weighted moving average of the round trip time calculated at time point n (the recalculated round trip time), λ is a weight (0 ≦ λ ≦ 1), and L _n is the round trip time, Z _{n -1} is obtained by using the exponentially weighted moving average of the round trip time calculated at n-1). The method according to claim 1,
The round trip time is,
When Interest is discarded because the time that Interest is stored in the content centric network exceeds the timeout time, and when the Interest is transmitted to the content centric network, the interest is discarded because the content is not stored in the content centric network node. Content-centric network node, characterized in that '0' in any of the cases. The method according to claim 1,
The corrected threshold is
expression

(θ _c is the corrected threshold, θ is the threshold, Z _n is the recalculated round trip time, δ is the timeout time, σ is a weight set by the user) Network node. The method according to claim 1,
And the correction period of the threshold is less than or equal to the detection period of the denial of service attack. The method according to claim 1,
The content centric network node
And a plurality of interfaces for transmitting and receiving Interest and Data through communication with the contents center network,
The network congestion index calculation unit recalculates the round trip time by the exponential weighted moving average for each of the plurality of faces,
The threshold corrector performs an exponential weighted moving average of a time-out time and a round-trip time at a corresponding face for each of the plurality of faces, the time that interest transmitted to the content-centric network is stored in the content-centric network node through the face. And correcting the threshold value using the recalculated value and the weight set by the user. In the method of detecting a denial of service attack of a content-centric network node that detects the occurrence of a denial of service attack by comparing the flow of information of interest and data with a threshold that is a criterion for determining a denial of service attack due to interest flooding,
Setting a time from when the Interest is transmitted to the content centric network until the corresponding data is reached as a round trip time which is a network congestion index;
Recalculating the round trip time by an exponential weighted moving average; And
And correcting the threshold value using a timeout time which is a limit time when interest transmitted to the content centric network is stored in the content centric network node, the recalculated round trip time, and a weight set by the user. Denial of service attack detection method of content-centric network nodes. The method of claim 7,
The recalculated round trip time is
expression

(Z _n is a value calculated by exponentially weighted moving average of the round trip time calculated at time point n (the recalculated round trip time), λ is a weight (0 ≦ λ ≦ 1), and L _n is the round trip time, Z _{n -1} is obtained by using the exponentially weighted average of the round trip time calculated at n-1) and calculating the denial of service attack of the content-centric network node. The method of claim 7,
The round trip time is,
When Interest is discarded because the time that Interest is stored in the content centric network exceeds the timeout time, and when the Interest is transmitted to the content centric network, the interest is discarded because the content is not stored in the content centric network node. Denial of service attack detection method of the content-centric network node, characterized in that the case of any one of the cases. The method of claim 7,
The corrected threshold is
expression

(θ _c is the corrected threshold, θ is the threshold, Z _n is the recalculated round trip time, δ is the timeout time, σ is a weight set by the user) Method of detecting denial of service attack of network node. The method of claim 7,
And the correction period of the threshold is less than or equal to the detection period of the denial of service attack. The method of claim 7,
The content centric network node
And a plurality of interfaces for transmitting and receiving Interest and Data through communication with the contents center network,
And determining the round trip time for each of the plurality of phases, recalculating the round trip time, and correcting the threshold value.

Images