16超高的X-Attack攻击讯务数据MonitoringICMP-国立中央大学.ppt

Susan Yang (NCU-CC) 8-27/2003 Flooding攻擊訊務的監測與阻絕 中央大學 電算中心 楊素秋 center7@.tw 大 綱 1.研究動機 2.網路訊務量測 3.Flooding攻擊訊務的監測 4.攻擊訊務的自動阻絕與通告 5.結論 1.研究動機 頻仍的網路攻擊事件 Internet wide open傳輸協定 Forged IP address Forged application port Forged protocol id. ICMP/UDP Flooding Attackers can markedly increase the volume of attack traffic congest regional networks jam the network links throughout the transmission path TCP Attack Denial of Service (DoS) attack on well-known services providing the attacker with full remote access to the servers. Distributed Flooding Attack overwhelm the transport routing resources. 2 網路訊務量測 攻擊訊務特徵 Intensive traffic volume ICMP Flooding (host-to-host) PING Storm (N * host-to-host) Intensive connection SYN Flooding host-to-M_hosts DoS/DDoS N * (host-to- M_hosts) Forged transportation attributes Spoofed Source IP address Smurf, DRDoS 採動態的 src_port, dst_port 躲避firewall及管理人員的過濾 動態的攻擊/休眠時間 Group Flooding Traffic DDoS DRDoS 網路轉送訊務log Tcpdump Snoop Broadcast packet header LAN segment Packet-based NetFlow WAN Router暫存/加總過境封包header資訊 Transport traffic log Flow-based Tcpdump 典型區域網段廣播封包的監聽應用程式 網路用戶透過tcpdump 監聽LAN傳送的封包log 網管人員得以依據監聽封包紀錄 end-to-end IP addresses, packet length,及socket ports 統計與分析連網的確切運務量與訊務特性. 協助確認與排除網路問題 Related works Kushida T. 透過Tcpdump 監聽FDDI網段packet log 量測網路的TCP,UDP訊務量與傳訊特性. Thompson K. 監聽與量測單一ATM連線承載 TCP與 UDP訊務 熱門應用訊務 FTP, WWW, DNS RealPlayer Router NetFlow轉送訊務紀錄 Source_IP.source port destination_IP. destination port source destination interface protocol identifier packet count / byte count 常見的訊務監測 Top-N 傳訊 host Traffic Source IP : 輸出訊務 list Dest. IP : 輸入訊務 list Top-N 傳訊 host Traffic www, eDonkey/eMule, 篩選/追蹤網路訊務特質 Source/Dest IP address Application port This work measures the top-N traffic volume of ICMP/UDP communication partners by accumulating the flow count, packet count and byte count with the index of the source and destination IP addresses. Monitoring/Detecting the extremely abnormal Flooding Traffic Automatically b