Design of an Autonomous Anti DDOS Network A

Design of an Autonomous Anti -DDOS Network (A 2 D 2) Angela Cearns Thesis Proposal Master of Software Engineering University of Colorado, Colorado Springs

Introduction - DDo. S n n DDo. S – a threat not forgotten 3 main research areas: n Source Identification (Prevention) n n Detection n n ITRACE, Ingree/Engress Filtering More difficult with distributed attack & new tools Most effective when implemented from attackers’ networks Monitor and identify patterns Intrusion Tolerance (Response) n n Minimize attack impact, maximize Qo. S Focus of this Thesis

Existing Intrusion Tolerant Architecture – Main Shortcomings n Rate-Limiting n n IDS with high false positives dropped packets from legitimate clients Expensive & Extensive Infrastructure n Xeno. Service – dynamic duplication n n Pushback architecture n n Very expensive, all ISP need to purchase this service Require co-operations of ISPs worldwide DARPA IDIP autonomous response network n Require protocol is not standard yet

Current Thesis Proposal n UCSD research n n Significant of DDo. Ses targeted home and medium-sized businesses This Thesis Design an Autonomous Anti-DDo. S network n n Integrate/improve existing technologies Easily afforded and implemented by home and small networks

Proposed A 2 D 2 Design & Improvements Fit real-life scenario 1. Detection n Snort: new patch to detect generic flood New module plug-in 2. Autonomic Mitigation n Class-based queuing Design new multi-level rate limiting Design new interface to integrate the various methodologies to achieve autonomic response

Proposed A 2 D 2 Design & Improvements 3. Software Engineering Principle Analysis 4. Testing Evaluation n Current DDo. S research no common test matrix and test parameters

Thesis Plan & Schedule 1. Requirement Analysis (February 1, 2002 – June 30 2002) n Identify and understand the problem domain Identify the problem Evaluate possible prototypes Define requirements Present proposal and obtain official approval 2. Planning (May 25, 2002 – July 12, 2002) n n n Identify and obtain resources needed Define thesis plan and schedule 3. Design (May 25, 2002 – July 12, 2002) n n Design initial test-bed prototype and evaluate design effectiveness Refine and finalize test-bed design Refine A 2 D 2 response system design 4. Implementation & Testing (May 30, 2002 – August 30, 2002) n n n Create initial prototype Identify testing techniques before attack network is created. Create attack network Refine and create response network Refine autonomous response 5. Project Closure (August 25, 2002 –September 25, 2002) n n n n Present final data and obtain approval. Create all necessary documentation Thesis defense

Thesis Deliverables n The network test-bed n n n Attack network + response network Resemble real-life scenario The A 2 D 2 response network Thesis report Software Engineering analysis report

Questions? Suggestions? References: Please refer to Proposal Document