DDo S Detection on P 4 Smart NICs

DDo. S Detection on P 4 Smart. NICs Marinos Dimolianis, Adam Pavlidis, Vasilis Maglaris Network Management & Optimal Design Laboratory (NETMODE) School of Electrical & Computer Engineering National Technical University of Athens 1 st GEANT Telemetry and Big Data Workshop November 10 th, 2020

Distributed Denial of Service (DDo. S) Attacks § DDo. S Statistics 1 Attack Duration Attack Rate 1. https: //horizon. netscout. com/? atlas=summary (January 2020)

DDo. S Attack Detection Mechanisms § s. Flow, Net. Flow, Open. Flow q Communication overhead between Network Device and External Collector § In-Network q q q Rapid attack detection in the data plane (P 4) Push-based approach Notification to external mitigation systems

Traffic Features & Processing Traffic Features § Total Number of Unique Flows § Subnet significance i. e. Flows per destination network § Packet Symmetry for TCP/UDP per destination network Threshold-based DDo. S detection in the data plane

P 4 DDo. S Detection Pipeline (1/5) § Stage 1 q TCP/UDP parsing § Stage 2 q q Traffic isolation originating from/destined to Protected Networks (matchaction) Unique identifier matching packets to protected networks

P 4 DDo. S Detection Pipeline (2/5) § Stage 3 a q Packet association with time-based epochs (ingress timestamp) § Stage 3 b q q New Epoch Initialization (Conditionally) Counters, Epoch Index update

P 4 DDo. S Detection Pipeline (3/5) § Stage 4 q q Identification of New Flows (src. IP, dst. IP, src. Port, dst. Port, Protocol) within an epoch Total Flow Counter & Flow Counter protected network update Total number of Unique Flows Condition Subnet Significance Condition

P 4 DDo. S Detection Pipeline (4/5) § Stage 5 q q q TCP Packet Symmetry Ratio for protected subnet UDP Packet Symmetry Ratio for protected subnet Packet Symmetry Condition Evaluation

P 4 DDo. S Detection Pipeline (5/5) § Stage 6 f_d f_cn f_p q Metadata headers check q P 4 digest to external mitigation mechanisms Digest Destination IP Packet D_ID Proto Epoch

DDo. S Detection Accuracy (1/2) 1 (Booter 4 dataset – B 4) §§ Malicious Traffic – Booters Malicious Traffic § Benign Traffic – WIDE Backbone 2 q q 255 Protected Networks 1 Victim § Experimentation process (1 s epochs) q q [0 -60 s] benign traffic (alarms ignored between [0 -30 s]) [60 -90 s] attack 1. J. J. Santanna et al. "Booters—An Analysis of DDo. S-as-a-Service Attacks", Integrated Network Management (IM), 2015 IFIP/IEEE International Symposium, July 2015 2. Packet traces from WIDE backbone, available at: https: //mawi. wide. ad. jp/mawi

DDo. S Detection Accuracy (2/2)

DDo. S Detection Accuracy (2/2) 1)Total Number of Unique Flows 2) Subnet Significance 3) Packet Symmetry

Packet Processing Performance § Stress Testing using: Malicious Traffic q q Plain Forwarding (SW) Singe-Feature (F 1) Two-feature (F 2) Three-feature (F 3) § P 4 Registers Accessible in Data Plane q Problems in High Rates § P 4 Counters not accessible from data plane q

Conclusions & Future Directions Conclusions § DDo. S Detection Pipeline in P 4 q q q Rapid Attack detection, Victim Network Identification Evaluate Accuracy within realistic attack conditions Performance Experiments for high packet rates Future Work § Sampling impact on detection accuracy and performance § Attack vector identification

Marinos Dimolianis mdimolianis@netmode. ntua. gr THANK YOU!