KR20120059914A - Method And Apparatus For Evaluating Products Of Detecting DDoS Attack - Google Patents

Abstract

The present invention provides a method and apparatus for evaluating a DDoS attack detection product. The method for evaluating a DDoS attack detection product includes measuring a connection completion message rate and a connection request rate by a normal packet, and measuring an overall connection request rate. Calculating a connection failure probability based on the measured value, comparing the calculated connection failure probability with a predetermined reference failure probability, and when the connection failure probability is greater than the reference failure probability, the evaluated product detects the DDoS attack. And determining the performance of the product to be evaluated based on the determination. According to the present invention, it is possible to accurately evaluate the performance of a product that detects an attack on a server on a network by a routing device located at a network entry point. It can be done.

Description

Evaluation Method and Apparatus for Products for Detecting Distributed Denial of Service Attacks {Method And Apparatus For Evaluating Products Of Detecting DDoS Attack}

The present invention relates to a method for protecting a server, a router, a switch, and the like on a network, and more particularly, to a method for detecting an attack on a server, a router, a switch, and the like on a network.

As network technologies, including the Internet, have evolved, more and more attacks are targeting vulnerabilities on the network. Attacks on the network are becoming increasingly indiscriminate and automated.

There are three main types of attacks: exploiting system vulnerabilities or using bugs implemented in software, using up all available resources for the target, and using up all available bandwidth. .

Especially in the case of the Internet, network security is interdependent, so it is easy to attack other hosts through the compromised security. In addition, since hosts, networks, and the like of the Internet all operate with limited resources, processing bandwidth, throughput, storage capacity, and the like are all limited, and thus are susceptible to attack. The nature of the connectionless Internet Protocol (IP) makes it difficult to track intruders.

An object of the present invention is to provide a method for accurately evaluating the performance of a product for detecting an attack on a server on a network.

The present invention can select and use a product that effectively prevents an attack on a server through a method for accurately evaluating the performance of a product that detects an attack on a server on a network by a routing device located at a network entrance. The purpose is to make sure.

According to an aspect of the present invention, there is provided a method for evaluating a DDoS attack detection product, comprising: measuring a connection completion message rate and a connection request rate by a normal packet, measuring an overall connection request rate, and a connection failure based on a measurement value Calculating a probability, comparing the calculated connection failure probability with a predetermined reference failure probability, determining whether the evaluation target product detects a DDoS attack when the connection failure probability is greater than the reference failure probability, and the judgment Based on evaluating the performance of the product under evaluation.

According to the present invention, it is possible to accurately evaluate the performance of a product that detects an attack on a server on a network.

According to the present invention, it is possible to accurately evaluate the performance of a product that detects an attack on a server on a network by a routing device located at a network entry point. It can be done.

1 is a conceptual diagram schematically illustrating an example of a DDoS attack.
2 is a flowchart schematically illustrating a connection establishment method of TCP.
3 is a conceptual diagram schematically illustrating a backlog queue state of a server subjected to a TCP SYN flooding attack.
4 is a flowchart schematically illustrating a method for evaluating a product detecting a DDoS attack by an evaluation apparatus to which the present invention is applied.
5 is a block diagram schematically illustrating a configuration of an evaluation apparatus for a product for detecting a DDoS attack to which the present invention is applied.

The present invention relates to a method for evaluating a device for detecting attacks by a server at a routing device located at an incoming end of a network providing a service.

Distributed Denial of Service (DDoS) attacks are designed to prevent an attacker from operating normally by sending a large amount of data to an attacker, such as a server on a network.

DDoS attacks are the most serious of the types of attacks on the Internet, and they are frequent. Algorithms for detecting DDoS attacks have been proposed, but their effectiveness is not easy to verify. Therefore, there is a need for a method for evaluating the performance or reliability of DDoS detection products using various algorithms.

EMBODIMENT OF THE INVENTION Hereinafter, one Embodiment of this invention is described concretely with reference to drawings. It should be noted that, in adding reference numerals to the constituent elements of the drawings, the same constituent elements are denoted by the same reference symbols as possible even if they are shown in different drawings. In addition, in describing the embodiments of the present specification, when it is determined that the detailed description of the related well-known configuration or function may obscure the subject matter of the present specification, the detailed description thereof will be omitted.

In addition, in describing the components of the present specification, terms such as first, second, A, B, (a), and (b) may be used. These terms are only for distinguishing the components from other components, and the nature, order or order of the components are not limited by the terms. If a component is described as being "connected", "coupled", or "connected" to another component, that component may be directly connected or connected to that other component, but there is another component between each component. It will be understood that may be "connected", "coupled", "connected".

1 is a conceptual diagram schematically illustrating an example of a DDoS attack.

The PCs 100 infected with the malicious virus generate a large amount of traffic through the Internet Service Provider (ISP) network 110. The general router 120 sends the incoming traffic to the network where the firewall 130 and the attack target 140 are located along the transmission path of the packet.

Due to the influx of a large amount of traffic, the firewall 130 and the target of attack 140 may not be able to bear the load, or may not function normally.

DDoS attacks include ICMP flooding, UDP flooding, TCP flooding, and TCP SYN flooding.

The Internet Control Message Protocol (ICMP) flooding method sends an ICMP Echo Request message to the broadcast address, allowing all systems to send an echo response message to the victim. The attacker consumes system resources to handle all requests, and eventually the system loses its functionality.

UDP (User Datagram Protocol) flooding method is a method of sending a large amount of UDP packets to the IP of the attack target. The attacker sends a UDP packet specifying the destination port. Hosts that receive a UDP packet start looking for an application for that port. If no corresponding application is found, an unreachable message is sent to the attack target set to the source address of the UDP packet, and a large number of messages cause the target system to lose its function.

Transmission Control Protocol (TCP) flooding is a method of sending a large amount of TCP packets to an attacking IP, basically the same method as UDP flooding.

The TCP SYN flooding method exploits a vulnerability in the TCP connection establishment method. The attacker sends a TCP packet requesting a connection to the target, and does not send an ACK message to establish the connection. The target will be waiting for the connection to be established, and the backlog queue, the memory space for the connection, will be exhausted.

Hereinafter, an example to which the present invention is applied through TCP SYN flooding, which is the most representative example of a distributed denial of service (DDoS) attack method, will be described.

TCP maintains the reliability of connection establishment according to certain rules (3 Way Handshaking). 2 is a flowchart schematically illustrating a connection establishment method of TCP according to this predetermined rule (3 Way Handshaking).

The client sends a SYN message requesting a connection to the server (S210). The server receives the SYN message of the client, and transmits a SYN message for requesting connection with the ACK message for the SYN message of the client (S220). At this time, the server queues the corresponding connection request from the client to the backlog queue.

When the client receives an ACK message and a SYN message from the server, the client establishes a connection with the server (S230). The client transmits an ACK message received from the server and an ACK message for the SYN message to the server (S240). The server receives an ACK message from the client, and establishes a connection with the client (S250).

When the server sends an ACK message and a SYN message to the client, the connection request waits half-open in the backlog queue until an ACK message from the client is received. When the server receives an ACK message from the client, a TCP connection is established and the connection request is deleted from the backlog queue. If the server does not receive an ACK message from the client for some time, the connection request is deleted from the backlog queue and no TCP connection is established.

At this time, if the attacker sends the SYN message to the server using multiple client computers, receives the SYN message and the ACK message, and then sends the SYN message continuously without transmitting the ACK message, the server's backlog queue Is filled by subsequent transfer requests. As a result, the server is unable to accept any further service connection request, which results in a denial of service.

3 is a conceptual diagram schematically illustrating a backlog queue state of a server subjected to a TCP SYN flooding attack.

The backlog queue 300 of the server has a limited capacity, i.e. a limited queue (N).

In normal state, when a client's SYN message 310 comes in, it sends an SYN message to the client requesting a connection with an ACK message to it, while the server sends the connection request from the client to the backlog queue ( Wait 300).

As the DDoS attack message 320 comes in, a DDoS attack is initiated. Receives a DDoS attack message and queues a connection request to the backlog queue 300 in a semi-open state. When the backlog queue 300 is full of connection requests for messages sent for a DDoS attack, and can no longer process the connection request, the system is in a denial of service state.

TCP SYN flooding is an attack that exploits the operational characteristics of TCP. In other words, since it follows the connection method of TCP, it is difficult to detect an attack on the network in advance. If the server detects that an attack occurred after taking damage, the response becomes that hard and the damage is greater.

Therefore, it is important to detect and respond to DDoS attacks in a timely manner, and it is important to evaluate the performance and reliability of products that detect DDoS attacks. Hereinafter, the present invention will be described in detail with reference to the formula.

You can build a Markov chain model using the number of half-opens waiting in the server's backlog queue. Half-open refers to a state before receiving an ACK packet from a client in a state in which a SYN packet is received from the client and the server sends a SYN + ACK packet.

The maximum number of half-opens that can be connected to a server is called C. The connection request to the server comes in at rate [lambda], and the time in the backlog queue follows the rate [mu]. The length of time that a normal client's connection request can wait in the backlog queue depends on the Round Trip Time (RTT) of the network.

Each state of the Markov chain can be represented by two values, N _l and N _a . N _l represents the number of connection requests from a legitimate user, and N _a represents the number of connection requests from an attacker. If _a new connection request comes in in the saturated state (N _l + N _a = C), the new connection is rejected.

λ _l is the normal user's connection request rate and μ _l is the normal user's service rate. Λ _a is the connection request rate of the attacking user, and μ _a is the service rate of the attacking user.

The transition of a Markov chain is caused by the following events:

Connection Arrival : The server receives a connection request from a client. This occurs at rate λ.

-Connection complete : It means that the connection is successfully completed because the connection is delivered to a higher level protocol. This occurs at rate μ _l .

-Connection Rejection : It means that the connection request is filled in the waiting queue and the new connection request is rejected. This occurs with probability φ _r .

Connection expiration : A server attempts to complete a connection request but exceeds the maximum time that can be in the waiting queue, causing a timeout. This occurs with probability φ _e .

-Connection failure : It means the connection is rejected or the connection expires. This occurs with probability φ = φ _r + φ _e .

In order to model the traffic of a real network, how to set the arrival rate and service rate of a normal packet becomes an important factor.

In the present invention, it is assumed that the packet arrival process is a Poisson process. This is widely used in the study of phone calls. That is, the arrival time interval of the packet follows the exponential distribution. This assumption is also used in many DDoS related studies.

In most cases, the service rate is affected by the user's interaction as well as the transmission time of the network. The arrival process of an IP packet tends to follow the Poisson process as the load increases. In the present invention, it is assumed that many packets are transmitted on a network.

Therefore, connection completion occurs after the time of exponential distribution after the packet arrives, if no connection expiration occurs. Connection expiration occurs after the timeout period has elapsed since the arrival of the SYN packet from the client.

The rate of the connection complete message (ACK packet from the client) generated by the normal packet is referred to as μ _c . Since the connection complete message must arrive before the timeout period elapses, we have a relationship of μ _l > μ _c . In other words, an incoming packet after the timeout time elapses is ignored.

Therefore, the service time of a normal connection, the probability distribution function (Gl) of G _l (t), follows the exponential distribution in the area smaller than the timeout t _out as shown in Equation 1, and the weighted delta dirac at the time t _out. Can be approximated by a weighted delta Dirac function.

Here, P _expire means the same as Equation 2.

Through Equation 1 and Equation 2, the average service time for a normal connection may be obtained as shown in Equation 3.

Through Equation 1 and Equation 2, an average service rate for a normal connection may be obtained as shown in Equation 4.

In the present invention, it is assumed that the arrival of a normal packet follows the Poisson process, but an attack packet can generally generate a packet freely according to an attacker's strategy. At this time, the attacking user tends to imitate the normal packet arrival process in order to avoid DDoS attack determination. Thus, it can be assumed that the arrival process of the attack packet also follows the Poisson process.

The service process of the attack packet can be calculated based on the strategy of the attacking user. The attacker wants to exhaust all of the server's resources with at least effort. This can be accomplished by sending the SYN packet to the server and then not sending the ACK packet again. That is, all connections made by attack packets are expired. That is, the service rate of the connection generated by the attack packet is μ _a = 1 / t _out .

In the present invention, SYN packets coming from normal users and attacking users follow a Poisson process of rates λ _l and λ _a . Therefore, it can be said that the arrival process of the entire SYN packet entering the server follows the Poisson process at _a rate λ = λ _l + λ _a .

The Markov chain model for DDoS attacks described so far distinguishes between normal and attack packets, but it is impossible to distinguish between normal and attack packets for packets that actually enter the server.

For this reason, it is necessary to analyze Markov chains using the total number N of normal users and attackers sending SYN packets to the server. In the present specification, the Markov chain model using the total number N in which normal users and attacking users send SYN packets to a server is referred to as a visible markov chain.

The probability that the visible Markov chain is in state N is equal to the sum of the probabilities of all cases where the sum of the normal packets and the number of attack packets (N _l + N _a ) equals N = N _l + N _a .

In the visible Markov chain, the connection arrival process is the sum of two Poisson processes with rates λ _l and λ _a , which is also a Poisson process and the rate is λ = λ _l + λ _a .

In the Markov chain model, load, ρ is defined as the ratio of arrival rate and service rate. The loads of normal users and those of attacking users can be defined separately, where ρ _l = λ _l / μ _l is a load made by normal users, and ρ _a = λ _a / μ _a is a load made by attacking users All.

를 이용한다.

는 상수로 고려하고 정상 패킷의 평균 서비스 타임 t_l과 공격 패킷의 서비스 타임, t_out에 각 도착 레이트 만큼의 가중치를 두어서 고려한다. 이를 통해

는 수학식 5와 같이 구할 수 있다. Overall average service time to determine overall system load,

Use

Is taken as a constant and weighted by each arrival rate to the average service time t _l of the normal packet and the service time of the attack packet, t _out . because of this

Can be obtained as shown in Equation 5.

The average service rate of the visible Markov chain is shown in Equation 6.

Using Equation 4, Equation 5 and Equation 6 can be arranged to obtain Equation 7 regarding the average rate of the visible Markov chain.

Through this, the total load generated by the normal user and the attacking user can be calculated as shown in Equation 8.

를 통해서 시스템이 스테이트 k에 있을 정상 상태(steady state) 확률을 수학식 9과 같이 구할 수 있다. 수학식 9는 도착 프로세스가 포아송 프로세스를 따르며, 패킷의 서비스 프로세스에 관한 서비스 시간이 일반적인 분포를 가지고 각 패킷에 독립적으로 적용되며, 하나하나의 서버에 대응하는 백로그 큐에 있는 패킷들이 서로 독립적으로 일정 시간 시스템에 머무르다 처리되고, 백로그 큐의 사이즈를 고려한 Queueing 모델로서, M/G/c/c를 이용하여 구할 수 있다.

Through Equation 9, the steady state probability that the system is in state k can be obtained as in Equation 9. In Equation 9, the arrival process follows the Poisson process, the service time of the packet's service process is applied to each packet independently with a general distribution, and the packets in the backlog queue corresponding to one server are independent of each other. As a queuing model that stays in a fixed time system and considers the size of the backlog queue, it can be obtained using M / G / c / c.

Because the processing of packets received by the server is done independently, an important performance measure of the system is the probability φ of normal connection failure. φ is equal to the sum of the probability φ _{r at} which the connection is rejected and the probability φ _e at which the connection will expire. In other words, φ = φ _r + φ _e .

The probability that a connection will be rejected means the probability that the system will be in a saturated state. That is, the probability that the backlog queue will become full. This is because the connection is rejected when the system is saturated when the SYN packet arrives. Therefore, the probability φ _r of connection rejection becomes equal to the probability that the state of the server becomes C.

If the system is in equilibrium, φ _r exactly matches π _i . Assuming the system is in equilibrium, φ _r = π _i .

Connection expiration occurs with the probability of P _expire if the system is not saturated when the SYN packet arrives. The probability that the connection expires φ _e can be obtained as shown in Equation 10 by using a steady state probability.

Therefore, the probability φ to fail the connection is expressed by Equation 11.

As shown in Equation 11, an algorithm of a product that detects a DDoS attack, that is, a product that detects a DDoS attack, may be evaluated based on the probability φ of the connection failure.

4 is a flowchart schematically illustrating a method for evaluating a product detecting a DDoS attack by an evaluation apparatus to which the present invention is applied.

Routers on the network are using products that detect DDoS attacks. Products that detect DDoS attacks may be built into routers. Evaluation of a product for detecting a DDoS attack to which the present invention is applied may be performed in an evaluation device embedded in a router, or may be performed in a separate evaluation device connected to the router.

When the product evaluation starts, the evaluation device measures μ _c and λ _l on the router (S410). The capacity (N) of the server's backlog queue and the time (t _out ) that a connection request can wait in the backlog queue are determined according to the product specification.

μ _c is the rate of the connection complete message generated by the normal packet, ie the ACK packet from the client. Therefore, the evaluation apparatus may obtain a μ _c value by measuring the number of times per unit time of the ACK packet from the normal user. From the values of _{c c,} equations 3 and 4 can be used to find t _l and μ _l .

λ _l is the normal user's connection request rate. The evaluation apparatus may obtain a value of λ ₁ by measuring the number of connection requests from a normal user.

The evaluation apparatus measures λ on the router (S420). λ is the total number of connection requests to the server. The evaluation apparatus continuously measures the change in the number of connection requests on the router. When the number of lambda is larger than the predetermined number or the increase in time is larger than the predetermined increase, the value of lambda _a can be obtained as _a difference between lambda and lambda _l .

The evaluation apparatus determines whether the probability of connection failure is greater than or equal to a predetermined threshold (S430). The probability φ of connection failure can be obtained by knowing the values of the TCP SYN attack rates λ _a and λ _l , t _out , μ _c , μ _l as shown in Equations 7 to 11. Using these values, we can obtain the probability φ value that the connection will fail.

The predetermined threshold α may be determined as the maximum value of the probability φ of connection failure within a range in which the user can normally use the service based on the quality of service (QoS) of the normal users. That is, if the value of φ is equal to or exceeds the value of α, it may be considered that a problem occurs in the service of a normal user.

Therefore, the evaluation apparatus can determine whether the DDoS attack has started by determining whether the value of φ is equal to or exceeds the value of α.

의 값을 수학식 12와 같이 구할 수 있다. Furthermore, φ is a function of λ, so given the threshold α

Can be calculated as in Equation 12.

이상으로 공격이 발생하면 정상 유저의 서비스에 문제가 생긴다. Where φ- ¹ represents the inverse of φ. Rate

If the above attack occurs, the service of the normal user is troubled.

를 비교하여, λ가

와 같거나

보다 큰 경우에, DDoS 공격이 시작되었다고 판단할 수도 있다.Therefore, it is not only possible to directly determine whether the DDoS attack has started by comparing the values of φ and α, but also to determine the connection request rate λ and

By comparing

Equals or

In larger cases, it may be determined that a DDoS attack has begun.

If it is determined that the DDoS attack has been started, the evaluation apparatus detects whether the product detecting the DDoS attack has detected the DDoS attack (S440). If it is determined that the DDoS attack is not started, the evaluation apparatus continues to measure the connection request rate λ (S420).

The evaluation apparatus evaluates the algorithm of the product detecting the DDoS attack, that is, the product performance and reliability based on the result of detecting whether the product detecting the DDoS attack has detected the DDoS attack (S450).

For example, when the evaluating device determines that the DDoS attack has started, when the product detecting the DDoS attack detects it, the evaluating device may evaluate that the product detecting the DDoS attack performed the detection at an appropriate time. If the evaluation device determines that the DDoS attack has started, but the product detecting the DDoS attack does not detect it, the evaluation device may evaluate that the product detecting the DDoS attack did not perform the detection in a timely manner.

5 is a block diagram schematically illustrating a configuration of an evaluation apparatus for a product for detecting a DDoS attack to which the present invention is applied.

The evaluation apparatus 500 may be mounted in a router of the network, or may be connected to the router as a separate device from the router.

The evaluation apparatus 500 includes a transceiver 510, a controller 520, and a storage 530.

The transceiver 510 may be connected with a router to receive various information for determining a DDoS attack. In addition, the transceiver 510 may receive information regarding whether a product detecting a DDoS attack, which is an evaluation target, has started detection.

The storage unit 530 may, among various pieces of information received through the transceiver unit 510, may determine information on whether a DDoS attack is performed and information that may evaluate a product that detects a DDoS attack, for example, a waiting time of a backlog queue. And capacity (t _out , N), threshold α, connection request rate λ, and the like.

The controller 520 may determine whether a DDoS attack is started based on the information stored in the storage 530 and the information received through the transceiver 510, and evaluate a product that detects the DDoS attack.

In the description of the present specification, an operation performed in a communication network is performed in a process of transmitting a data and controlling a network in a system (for example, a server or a media center) that manages the communication network, or in a terminal coupled to the network. Work can be done.

In addition, the content described as "include" a specific configuration in the present invention does not exclude a configuration other than the configuration, it means that additional configuration may be included in the scope of the technical idea of the present invention or the present invention.

In the exemplary system described above, the methods are described based on a flowchart as a series of steps or blocks, but the invention is not limited to the order of steps, and certain steps may occur in a different order or concurrently with other steps than those described above. Can be. In addition, those skilled in the art will appreciate that the steps shown in the flowcharts are not exclusive and that other steps may be included or one or more steps in the flowcharts may be deleted without affecting the scope of the present invention.

The above-described embodiments include examples of various aspects. While it is not possible to describe every possible combination for expressing various aspects, one of ordinary skill in the art will recognize that other combinations are possible. Accordingly, it is intended that the invention include all alternatives, modifications and variations that fall within the scope of the following claims.

Claims (1)

Measuring a rate of a connection complete message and a connection request rate by a normal packet;
Measuring an overall connection request rate;
Calculating a probability of connection failure based on the measured value;
Comparing the calculated connection failure probability with a predetermined reference failure probability;
Determining whether the evaluation target product detects a DDoS attack when the connection failure probability is greater than the reference failure probability; And
Based on the determination, evaluating the performance of the product to be evaluated.

Images