KR20140027585A - Detection system and method for dch starvation dos attack in 3g - Google Patents

Abstract

The present invention relates to a DCH starvation type attack detection system in the third generation mobile communication and a method thereof and, more specifically, to a DCH starved attack detection system in the third generation mobile communication and a method thereof, preventing access by grasping a wrong approach at the stage of FireWall when the system tries to connect to an internal router through multiple routers on an external network under an environment which is divided into the internal network and the external network. [Reference numerals] (AA,BB,CC,DD,EE,FF,GG) DCH allocation

Description

TECHNICAL FIELD [0001] The present invention relates to a system and a method for detecting a DCH starvation DoS attack in a 3G mobile communication system,

The present invention relates to a DCH-depleted attack detection system and method in a third generation mobile communication, and more particularly, to a system and method for detecting a DCH- The present invention relates to a system and method for detecting a DCH-depleted attack in a third generation mobile communication that prevents access by grasping the wrong access in the FireWall stage.

Generally, 2G network is a mobile communication network to provide voice and data service. As the number of subscribers of the network increases, it has developed into a 3G network that can handle more users. The 3G network is developed on the basis of the 2G network and is not suitable for the service providing a lot of data. In the early stage of the feature phone, the third generation was not used because the data cost provided by the mobile communication service provider was expensive and there was no service using data. However, with the emergence of smart phones, various applications such as internet browsers and games have emerged, and data usage of users has increased dramatically due to low data rate policies of mobile carriers. Various data services have increased the number of illegal accesses to terminals and increasing user traffic has threatened the safety of 3G networks with narrow bandwidths. For example, in November 2010, an attack occurred in China by sending a text message to the people in the contact list of the device to infect the device. Approximately 1 million terminals were infected and suffered large financial losses.

A DoS attack using a mobile communication network has a method of preventing a normal user from being allocated resources by exhausting limited resources, and a method of preventing a service from being provided by overloading a server. Smartphones use 3G or WiFi to connect to the network. Wi-Fi networks can be used without restrictions, but 3G networks have limited resources.

The 3G network can be allocated the necessary resources with small packets. This means that unlike existing DoS attacks, it is possible to attack with only small packets and that the existing DDoS (Distributed DoS) detection method can not be applied. As the proportion of smartphones increases in real life, the DoS attacks of mobile communication networks can cause direct damage to user's financial problems or personal information leakage.

As a related study, the signaling message attack is called Universal Mobile Telecommunication System (UMTS), which is composed of the 3G mobile communication network name, WCDMA, the third generation communication protocol, and GSM, the second generation communication protocol. After the terminal is connected to the 3G network, it is required to allocate resources as a channel to exchange data.

1 shows a process of connecting a mobile communication network and a terminal. That is, after receiving and sending various signaling messages, the terminal can use the data.

The attack scenario using this structure is as follows. The attacker periodically sends data to the mobile terminal to the remote host connected to the network. After that, the remote host will be called a server. In order for a mobile terminal to receive data, a connection between a terminal and a base station is required. In order to be connected, about 15 signaling messages must be exchanged. If no data is exchanged for 5 seconds after connection, the connection is released and the allocated resources are returned. It needs about 12 messages to be released. Using this structure, the attacker sends data to several mobile terminals in a time that is slightly more than 5 seconds. Since the connection is established and released for each terminal repeatedly, there is a lot of messages, and the bottleneck is experienced in the network that handles this. This attack occurs in the control plane where control signals go to control the establishment, maintenance, and release of communication links on the network. (Patrick PC Lee, Tian Bu, and Thomas Woo, "On the Detection of Signaling DoS Attacks on 3G Wireless Networks, "26th IEEE International Conference on Communications (INFOCOM), 2007.)

In addition, as for the DCH starvation attack, a DCH-depleted attack occurs in the user plane where user data is transmitted. As mentioned above, in order for the terminal to send and receive data, a connection between the network and the terminal is required. After being connected, DCH is assigned, which is the frequency band where data can be exchanged. The DCH is a limited resource assigned to each subscriber terminal. If many terminals request data service at the same time, the channel to be allocated becomes exhausted and data service can not be normally performed.

FIG. 2 shows the process of allocating and recovering the DCH. If the terminal does not send and receive data for 5 seconds, the connection between the network and the terminal is released and the DCH is recovered. The DCH exhaustion attack using this structure is as follows. An attacker periodically sends a small amount of data to several terminals within a time interval of less than 5 seconds. The terminals receiving the data from the attacker continue to occupy the DCH. If all the DCHs in the cell are exhausted, the network will not be able to provide a seamless data service because there is no DCH to allocate to the general user. FIG. 3 shows a state in which DCH is continuously occupied. If an attacker sends a packet with a size of about 40 bytes periodically to 5 million terminals, it will be able to attack a DCH exhaustion attack in a big city like Seoul (Lee Sung Won, Kim Jonghyun, Seo Dong Il, DISEo, Trends ", ETRI, 2012.)

However, the characteristic of the attack is that many terminals in the cell do not receive data services smoothly with a small number of packets. Unlike the existing method of attacking by generating a lot of traffic, it is necessary to use a new system to solve the problem because there is a problem that the conventional detection method can not be used because it attacks with a small amount of traffic.

SUMMARY OF THE INVENTION In order to solve the above problems, the present invention provides a DCH-depleted attack detection system and a method thereof in a third generation mobile communication system for detecting an attack using a weak point of a mobile communication network structure.

In order to detect an attacker with a minimum packet, the present invention includes a detection server that detects a rate of an arrival time pattern of a packet received by the terminal and a ratio of the amount of packets received to the DCH holding time of the terminal.

When the time interval is constant, the detection server finds and detects how many packets arrive within each time interval range.

The detection server increases the suspect score that is suspected of attack and detects it as an attack of the system when the score exceeds a predetermined threshold.

The suspicion score

ego,

이면 DCH 유지시간 대 받은 패킷량을 기준으로 (a1)을 이용해 계산하고,

이면 각 시간 간격의 전체 패킷량과 공격 패킷량의 비율을 이용해 (a2)로 계산한다.

(A1) based on the received packet amount versus the DCH holding time,

(A2) using the ratio of the total packet amount and the attack packet amount in each time interval.

는 시간간격에 도착한 패킷량이 차이를 보이는 기준 시간, 단말기

, 서버

사이에 데이터를 주고 받는 플로우

에서 처음 패킷을 받은 시간은

, 현재 패킷을 받은 시간은

, 시간 간격은

,

는

에서 단말기가 받은 패킷량의 합,

는

동안에 도착한 패킷 수,

는 한 플로우에서 나올 수 있는 최소한의 공격 패킷수)(

A reference time at which a packet amount arriving at a time interval shows a difference,

, server

The flow of data between

The time the first packet was received from

, The time the current packet was received

, The time interval is

,

The

The sum of the packet amounts received by the terminal,

The

≪ / RTI >

Is the minimum number of attack packets that can come out of a flow)

The detection server increases the suspicious score by dividing the time when data is sent in a short period and the time when data is sent in a long period based on a predetermined period.

When the detection server sends data in a short period, the detection server increases the suspicious score according to the ratio of the total amount of packets exchanged between the users and the time of maintaining the DCH channel.

When the detection server sends data in a long period, the suspicious score is increased by using the ratio of the minimum number of attack packets and the number of arriving packets.

The present invention provides a method for detecting a D-HUE-depleted attack in a third generation mobile communication system, comprising the steps of: detecting a arrival time pattern of a packet received by a terminal through a detection server and a ratio of a DCH holding time of the terminal to a received packet rate; .

And detecting and detecting a number of packets arriving within a time interval range when the time interval is constant through the detection server.

Increasing the suspect score suspected to be an attack through the detection server and detecting an attack of the system when the score exceeds a predetermined threshold.

The suspicion score

ego,

이면 DCH 유지시간 대 받은 패킷량을 기준으로 (a1)을 이용해 계산하고,

이면 각 시간 간격의 전체 패킷량과 공격 패킷량의 비율을 이용해 (a2)로 계산하는 단계;Through the detection server

(A1) based on the received packet amount versus the DCH holding time,

(A2) using the ratio of the total packet amount and the attack packet amount in each time interval;

.

, 서버

사이에 데이터를 주고 받는 플로우

에서 처음 패킷을 받은 시간은

, 현재 패킷을 받은 시간은

, 시간 간격은

,

는

에서 단말기가 받은 패킷량의 합,

는

동안에 도착한 패킷 수,

는 한 플로우에서 나올 수 있는 최소한의 공격 패킷수)( A reference time at which a packet amount arriving at a time interval shows a difference,

, server

The flow of data between

The time the first packet was received from

, The time the current packet was received

, The time interval is

,

The

The sum of the packet amounts received by the terminal,

The

≪ / RTI >

Is the minimum number of attack packets that can come out of a flow)

Further comprising the step of increasing the suspect score by dividing the time when data is transmitted in a short period and the time when data is sent in a long period based on a predetermined period through the detection server.

When the data is transmitted in a short period through the detection server, increasing the suspicious score according to the ratio of the total amount of packets exchanged between the users and the time of maintaining the DCH channel.

The method further comprises the step of increasing suspicious scores using the ratio of the minimum number of attack packets to the number of arriving packets when data is sent over a long period through the detection server.

According to the present invention, when an attack occurs to prevent a general user from receiving a data service on a 3G mobile communication network, an attack can be efficiently detected and a network administrator can quickly cope with an attack.

According to the present invention, a DCH resource depletion problem, which is one kind of DoS attack, is dealt with and a method of detecting the DCH resource depletion type problem is raised to enhance the reliability of the mobile communication network.

보다 작은

에 대해

를 계산한 그래프.1 is a diagram illustrating a process of connecting a mobile communication network and a terminal according to a conventional invention.
FIG. 2 shows a process of allocating and recovering a DCH according to the prior art.
FIG. 3 shows a state in which the DCH according to the prior art is continuously occupied.
4 is a diagram showing the overall configuration according to the present invention.
FIG. 5 is a graph showing an arrival time interval pattern of a packet transmitted by a general user and an attacker using data monitored by a user's packet trace-SIGCOMM 2008 protocol for about 6 hours.
Figure 6 is a graph

lesser

About

.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, a dhichty exhaustion-based attack detection system in a third generation mobile communication according to the present invention will be described in detail with reference to the drawings.

The present invention is a technology for detecting an attack using a vulnerability of a mobile communication network structure.

DoS attacks, which can occur in third generation mobile communication, send small packets every 5 seconds or so, and continue to occupy the frequency band called DCH, exhausting the DCH. By analyzing data usage patterns of existing users, most users have been able to exchange data frequently at one point in time and to receive less data during that time.

We propose a detection method using this. Detection increases suspected suspicious scoring and informs the system that an attack has occurred when the score exceeds a predetermined threshold.

Detection uses different methods to increase suspicious scores when sending data in short periods and when sending data in long periods.

The DoS attack consumes the DCH by sending a minimum number of packets, so the time to maintain the DCH is long, but the amount of packets sent and received is small. Therefore, when sending data in a short period, the suspicious score is increased according to the ratio of the total amount of packets exchanged between the users and the time of maintaining the DCH channel.

When sending data over a long period, the number of arriving packets is much smaller than the minimum number of attack packets. Therefore, the suspicious score is increased by using the ratio of the minimum number of attack packets and the number of arriving packets. An increased suspicion score detects an attack when the threshold is exceeded.

As shown in FIG. 3, in order to detect an attacker in a minimum packet, the Dish-hill Depleted Attack Detection System in the third generation mobile communication according to the present invention uses an arrival time pattern of a packet received by a terminal and a DCH And a detection server 100 that detects the packet using a ratio of a retention time to a received packet amount.

The detection server 100 detects and detects how many packets arrive within each time interval range through each of the user nodes A, B, and C and the network server 200, Increase suspected suspicious scores, detect system attacks when the score exceeds a predefined threshold, increase suspect scores by dividing data between sending a short period of data on a periodic basis and sending data over a long period .

For example, in case of sending data in a short period, the suspicious score is increased according to the ratio of the total amount of packets exchanged between users and the time of maintaining the DCH channel, and when data is transmitted in a long period, Use the ratio of the number to increase the suspicion score.

Hereinafter, the detection technique according to the present invention will be described in more detail through experiments and the like

Mostly, the attacker periodically sends packets to several terminals to exhaust DCH. In order to solve this problem, the present invention detects the arrival time pattern of the packet received by the terminal and the ratio of the amount of packets received to the DCH holding time of the terminal. The goal is to detect the attacker with a minimum of packets (about 40 bytes).

The pattern of the terminal receiving data from the server is defined as a case where the arrival time interval of the packet is constant or not. When the server sends a packet every 4.5 seconds, it sends data at regular intervals.

, 서버

사이에 데이터를 주고 받는 플로우 에서 처음 패킷을 받은 시간은

이다. 그리고 현재 패킷을 받은 시간은

고 시간 간격은

이다. 각 플로우마다

정보를 가지고 있다.

는

에서 단말기가 받은 패킷량의 합이다.terminal

, server

The flow of data between The time the first packet was received from

to be. And the time the current packet was received

The high time interval

to be. For each flow

I have information.

The

Is the sum of the amount of packets received by the terminal.

는

동안에 도착한 패킷 수이며

는 한 플로우에서 나올 수 있는 최소한의 공격 패킷수이다.A table for the number of packets arrived at each time interval as shown in Table 1 for each flow. The table entry is used to calculate the following equation (1).

The

The number of packets arriving during

Is the minimum number of attack packets that can come from a flow.

If an attacker sends a minimum number of packets for a period of 6 hours at a predetermined time interval, a minimum of 4320 packets are required as shown in Equation 2 below.

FIG. 5 is a view of an arrival time interval pattern of a packet transmitted by a general user and an attacker using data of a user's packet trace -SIGCOMM 2008 protocol monitored for about 6 hours.

The graph of FIG. 5 shows the number of packets arriving at each interval time interval of all flows present in the trace. The x axis is the time interval, and the y axis is the number of arriving packets. If the server sends a packet to the terminal for 3 seconds and the next packet for 3.4 seconds, then the time interval is 0.4 seconds and the y axis is incremented by 1. The results show that the average user sends a lot of data at intervals of less than 1.2 seconds and less data at intervals of more than 1.2 seconds and less than 5 seconds. This shows that the packets are often sent at frequent intervals.

를 기준으로 공격으로 의심되는 의심 스코어(maliciousness score)인

을 계산한다.

는 시간간격에 도착한 패킷량이 차이를 보이는 기준 시간이다.

이면 DCH 유지시간 대 받은 패킷량을 기준으로 (a1)을 이용해 계산하고,

이면 각 시간 간격의 전체 패킷량과 공격 패킷량의 비율을 이용해 (a2)로 계산한다.In Equation (3)

The maliciousness score of the suspected attack

.

Is the reference time at which the amount of packets arriving at the time interval shows a difference.

(A1) based on the received packet amount versus the DCH holding time,

(A2) using the ratio of the total packet amount and the attack packet amount in each time interval.

가 1.2초가 된다.

이후의 패킷 수는 매우 작기 때문에 공격 패킷이 들어오면 수학식3의 (a2) 에 따라

값이 커진다. 그러나

이전의 오는 전체 패킷수는 비교적 많기 때문에 공격 패킷량으로 공격 여부를 구별할 수 없다. 따라서 이 경우는 DCH를 유지한 시간은 길지만 받은 패킷량이 적을 때를 탐지 기준으로 한다.5,

Becomes 1.2 seconds.

Since the number of subsequent packets is very small, if an attack packet arrives,

The value becomes larger. But

Since the total number of previous packets is relatively large, the amount of attack packets can not distinguish the attack. Therefore, in this case, when the amount of packets received is long although the time for which the DCH is maintained is long, the detection standard is used.

보다 작은

에 대해 식 3-1을 이용해

를 계산한 그래프이다. x축은 시간이며 y축은

값이다. 1시간 간격으로 모든 패킷 수와 최소한의 공격 패킷 수를 상기 수학식3의 (a1)에 대입하여 계산한 값이다. DCH를 오래 유지하면서 적은 패킷량을 받으면

값이 커져 공격이라 탐지하게 된다. 6,

lesser

Using Equation 3-1 for

Fig. The x-axis is time and the y-axis is

Value. The total number of packets and the minimum number of attack packets are calculated by substituting (a1) in Equation (3) for the number of all packets at intervals of one hour. If you receive a small amount of packets while maintaining DCH for a long time

The value is increased and it is detected as an attack.

는 공격탐지기준으로

이 스레시홀드 (threshold)

보다 커지면 공격이라 탐지한다.

의 값을 높이면 오탐률은 줄어들지만 시간은 증가한다.. In Equation (4)

Is based on attack detection

The threshold value < RTI ID = 0.0 >

If it is bigger, it detects it as an attack.

Increasing the value reduces the false positives but increases the time.

Hereinafter, a method for detecting a DICH-based exhaustion attack in the 3G mobile communication for implementing the present invention will be described in detail.

First, it detects the arrival time pattern of the packet received by the terminal through the detection server and the ratio of the amount of packets received to the DCH holding time of the terminal.

When a time interval is constant, a number of packets arrive within a time interval, and a pattern is detected. When a suspicious score is suspected to be an attack and a score exceeds a predetermined threshold, Of the attack.

That is, the suspicious score is increased by dividing the data sent in a short period and the data sent in a long period based on a predetermined period through the detection server. In case of sending data in a short period, It is desirable to increase the suspect score according to the ratio of the time of maintaining the DCH channel and to increase the suspicious score by using the ratio of the minimum number of attack packets and the number of arrived packets.

100: detection server
200: Network server
A, B, C: User node

Claims (14)

In the third generation mobile communication, the detection server detects an attacker using the minimum packet arrival time pattern and the ratio of the received packet amount to the DCH holding time of the terminal. Desichi Depleted Attack Detection System. The method of claim 1,
The detection server comprises:
Wherein when the time interval is constant, a number of packets arrive within a time interval range, and the pattern is detected and detected. The method of claim 1,
The detection server comprises:
Characterized in that the attack is detected as an attack of the system when the suspicion score of the attack is increased and the score exceeds the predetermined threshold, in the third generation mobile communication. The method of claim 3,
The suspicion score

ego,

(A1) based on the received packet amount versus the DCH holding time,

(A2) using the ratio of the total packet amount of each time interval to the attack packet amount.
(

A reference time at which a packet amount arriving at a time interval shows a difference,

, server

The flow of data between

The time the first packet was received from

, The time the current packet was received

, The time interval is

,

The

The sum of the packet amounts received by the terminal,

The

≪ / RTI >

Is the minimum number of attack packets that can come out of a flow) The method of claim 1,
Wherein the detection server increases the suspect score by dividing the time when the data is sent in a short period and the time when the data is sent in a long period based on a predetermined period, and increases the suspicious score in the third-generation mobile communication. 6. The method according to claim 1 or 5,
The detection server comprises:
When the data is transmitted in a short period, the suspicious score is increased according to the ratio of the total amount of packets exchanged between the users and the time of maintaining the DCH channel, in the third generation mobile communication. 6. The method according to claim 1 or 5,
The detection server comprises:
Wherein the suspicious score is increased by using the ratio of the minimum number of attack packets and the number of arriving packets when data is transmitted over a long period. A method for detecting a D-HIC-depleted attack in a 3G mobile communication system,
Detecting by the detection server a ratio of the arrival time pattern of the packet received by the terminal to the DCH holding time of the terminal to the received packet amount;
DEH depletion attack detection method in the third generation mobile communication, characterized in that comprises a. 9. The method of claim 8,
Through the detection server
Detecting and detecting a number of packets in a time interval range when a time interval is constant;
The method comprising the steps of: a) detecting an attack in a third generation mobile communication; 9. The method of claim 8,
Through the detection server
Increasing suspected suspicious scores and detecting system attacks when the score exceeds a predetermined threshold;
The method comprising the steps of: a) detecting an attack in a third generation mobile communication; 11. The method of claim 10,
The suspicion score

ego,
Through the detection server

(A1) based on the received packet amount versus the DCH holding time,

(A2) using the ratio of the total packet amount and the attack packet amount in each time interval;
The method comprising the steps of: a) detecting an attack in a third generation mobile communication;
(

A reference time at which a packet amount arriving at a time interval shows a difference,

, server

The flow of data between

The time the first packet was received from

, The time the current packet was received

, The time interval is

,

The

The sum of the packet amounts received by the terminal,

The

≪ / RTI >

Is the minimum number of attack packets that can come out of a flow) 9. The method of claim 8,
Increasing the suspect score by dividing the time of sending data in a short period and the time of sending data in a long period based on a predetermined period through the detection server;
The method comprising the steps of: a) detecting an attack in a third generation mobile communication; The method according to claim 8 or 12,
Increasing suspicious scores according to a ratio of a total amount of packets exchanged between users and a time of maintaining a DCH channel when data is transmitted in a short period through the detection server;
The method comprising the steps of: a) detecting an attack in a third generation mobile communication; The method according to claim 8 or 12,
Increasing the suspicious score by using a ratio of the minimum number of attack packets and the number of arriving packets when data is sent over a long period through the detection server;
The method comprising the steps of: a) detecting an attack in a third generation mobile communication;

Images