Malicious Packet Dropping How It Might Impact the

Malicious Packet Dropping: How It Might Impact the TCP Performance & How We Can Detect It Xiao-Bing Zhang, Felix Wu, Zhi Fu, Tsung-Li Wu, Ericsson UC Davis NC State University CCIT http: //www. cs. ucdavis. edu/~wu wu@cs. ucdavis. edu full paper: http: //www. cs. ucdavis. edu/publications/PDALong. ps 11/17/2000 IEEE ICNP'2000, Osaka, Japan 1

Outline z. Packet Dropping z. Anomaly Detection z. Evaluation 11/17/2000 IEEE ICNP'2000, Osaka, Japan 2

Packet Dropping Attacks z Maliciously drop a small portion of packets 4 e. g. , the first 20 packets in a connection z Selectively drop some important packets 4 e. g. , retransmission packets, signaling packets in IP telephony z Degrade Qo. S z Difficult to detect 4 packet loss could be due to network congestion 11/17/2000 IEEE ICNP'2000, Osaka, Japan 3

Attack Types z. Persistent 4 attack every connection between two TCP ends. z. Intermittent 4 attack some of the connections 4 e. g. , 1 of every 5 connections 11/17/2000 IEEE ICNP'2000, Osaka, Japan 4

Dropping Patterns z. Periodical Packet Dropping (Per. PD) z. Retransmission Packet Dropping (Ret. PD) z. Random Packet Dropping (Ran. PD) 11/17/2000 IEEE ICNP'2000, Osaka, Japan 5

Periodical Packet Dropping z. Parameters (K, I, S) 4 K, the total number of dropped packets in a connection 4 I, the interval between two consecutive dropped packets 4 S, the position of the first dropped packet. z Example (5, 10, 4) 4 5 packets dropped in total 4 1 every 10 packets 4 start from the 4 th packet 4 The 4 th, 14 th, 24 th, 34 th and 44 th packet will be dropped 11/17/2000 IEEE ICNP'2000, Osaka, Japan 6

Retransmission Packet Dropping z. Parameters (K, S) 4 K, the times of dropping the packet's retransmissions 4 S, the position of the dropped packet z Example (5, 10) 4 first, drops the 10 th packet 4 then, drops the retransmissions of the 10 th packet 5 times 11/17/2000 IEEE ICNP'2000, Osaka, Japan 7

Random Packet Dropping z. Parameters (K) 4 K, the total number of packets to be dropped in a connection z Example (5) 4 randomly drops 5 packets in a connection 11/17/2000 IEEE ICNP'2000, Osaka, Japan 8

Dropper Model P% 11/17/2000 IEEE ICNP'2000, Osaka, Japan Per Ret Ran (K, I, S) (K) 9

How can this happen? z. Unintentional: yill-configuration yaggressive traffic control or management z. Intentional: ycompromised packet forwarding engine yselectively-flooded routers/switches 11/17/2000 IEEE ICNP'2000, Osaka, Japan 10

How to Practice Dropping Attacks z Compromise intermediate routers 4 easy to manipulate victim's traffic 4 hard to detect 4 difficult to practice z Congest intermediate routers 4 hard to manipulate victim's traffic 4 cause more attention 4 easy to practice 11/17/2000 IEEE ICNP'2000, Osaka, Japan 11

Impacts of Packet Dropping z. Delay z. Response time z. Quality z. Bandwidth z. Throughput. . . 11/17/2000 IEEE ICNP'2000, Osaka, Japan 12

Experiment Setting FTP Client on Linux 2. 0. 36 FTP Server FTP z FTP client runs Linux 2. 0. 36 in SHANG lab xyz. zip 5. 5 M Divert Socket Attack Agent Data Packets 11/17/2000 z 4 FTP Servers across the Internet z Size of downloaded file is 5. 5 MB z Attack Agent Internet IEEE ICNP'2000, Osaka, Japan 4 runs on the same host as FTP client 4 act as on a compromised router 13

FTP Severs and Clients FTP Client SHANG FTP Servers Heidelberg NCU Sing. Net UIUC 11/17/2000 IEEE ICNP'2000, Osaka, Japan 14

FTP Severs 11/17/2000 IEEE ICNP'2000, Osaka, Japan 15

Impacts of Packet Dropping On Session Delay 11/17/2000 IEEE ICNP'2000, Osaka, Japan 16

Compare Impacts of Dropping Patterns Per. PD: I=4, S=5 Ret. PD: S=5 11/17/2000 IEEE ICNP'2000, Osaka, Japan 17

Different K, I, S for Per. PD 11/17/2000 IEEE ICNP'2000, Osaka, Japan 18

On Interval z. If Interval is extremely small (< 4), Per. PD is similar to Ret. PD. z. If Interval is larger, yif RTT is small, session delay will be smaller if the interval is also smaller (but not too small). 11/17/2000 IEEE ICNP'2000, Osaka, Japan 19

Compare Impacts of Dropping Patterns (cont. ) z Periodical Packet Dropping 4 session delay linearly increases with an increase of K 4 packet loss is repaired by fast retransmit or timeout z Random Packet Dropping 4 comparatively small damage, relating to RTT 4 session delay increases linearly when increasing K 4 packet loss is usually repaired by fast retransmit z Retransmission Packet Dropping 4 severe damage, relating to RTO 4 session delay increases exponentially when increasing K 11/17/2000 IEEE ICNP'2000, Osaka, Japan 20

The Plain DDOS Model (1999 -2000) Slaves Victim Masters Attackers : : . 11/17/2000 src: random dst: victim . . . IEEE ICNP'2000, Osaka, Japan . com ISP 21

Congestion Tools: Tribe Flood Network z Distributed Denial Of Service (DDOS) attack tools z Master 4 a host running an application called Client 4 Client initiates attacks by sending commands to Agents z Agent 4 a host running a Daemon 4 Daemon receives and carries out commands issued by a Client. z Attack 4 UDP flood, ICMP echo reply (ping), SYN flood, and TARGA 3 11/17/2000 IEEE ICNP'2000, Osaka, Japan 22

Congestion Experiment Setting FTP server fire FTP client FTP data redwing 152. 1. 75. 0 congestion bone 172. 16. 0. 0 UDP flood light 192. 168. 1. 0 TFN target air TFN master 11/17/2000 z Networks are in SHANG lab z All machines are PCs z Bone with 500 MHz Intel Pentium CPU acts as a router z Downloaded file size: 44 MB TFN agents IEEE ICNP'2000, Osaka, Japan 23

Congestion Experiment Results 11/17/2000 IEEE ICNP'2000, Osaka, Japan 24

Congestion Experiment Results (cont. ) Attack mode (flood m , stop Normal Flood 1, stop 20 Flood 1, stop 5 Flood 5, stop 10 Flood 5, stop 2 11/17/2000 n) Number of packet loss per connection 0. 9 18. 5 57. 4 62. 1 124. 4 Session delay (sec. ) 31. 7 470. 5 58. 4 67. 3 164. 5 Damage damage = (delayflood – delaynormal) / delaynormal 27. 8% 84. 5% 112. 6% 418. 9% IEEE ICNP'2000, Osaka, Japan 25

Intrusion Detection: TDSAM z TCP-Dropping Statistic Analysis Module (TDSAM) 4 run on the protected asset, e. g. , the FTP client z Expected Behavior 4 described in long-term profile 4 e. g. , the average session delay is 50 seconds z Observed Behavior 1. described in short-term profile 2. e. g. , the average session delay becomes 100 seconds 11/17/2000 IEEE ICNP'2000, Osaka, Japan 26

Intrusion Detection: TDSAM (cont. ) z. Statistic Measures 4 Position Measure: position of each packet reordering 4 Delay Measure: session delay 4 NPR Measure: number of packet reordering 11/17/2000 IEEE ICNP'2000, Osaka, Japan 27

TDSAM Experiment Setting FTP Client on Linux 2. 0. 36 FTP Server FTP p 1, p 2, p 3, p 5, p 4 max TDSAM reordering counting xyz. zip 5. 5 M Divert Socket Attack Agent Data Packets 11/17/2000 Internet IEEE ICNP'2000, Osaka, Japan 28

Long-term Profile z. Category, C-Training 4 learn the aggregate distribution of a statistic measure z. Q Statistics, Q-Training 4 learn how much deviation is considered normal z. Threshold 11/17/2000 IEEE ICNP'2000, Osaka, Japan 29

Long-term Profile: C-Training For each sample of the statistic measure, X (0, 50] (50, 75] (75, 90] (90, + ) 20% 30% 40% 10% z k bins z Expected Distribution, P 1 P 2. . . Pk , where z Training time: months 11/17/2000 IEEE ICNP'2000, Osaka, Japan 30

Long-term Profile: Q-Training (1) For each sample of the statistic measure, X (0, 50] (50, 75] (75, 90] (90, + ) 20% 40% 20% z k bins, samples fall into bin z samples in total ( ) z Weighted Sum Scheme with the fading factor s 11/17/2000 IEEE ICNP'2000, Osaka, Japan 31

Long-term Profile: Q-Training (2) z. Deviation: 4 Example: z Qmax 4 the largest value among all Q values 11/17/2000 IEEE ICNP'2000, Osaka, Japan 32

Long-term Profile: Q-Training (3) z. Q Distribution 4[0, Qmax) is equally divided into 31 bins and the last bin is [Qmax, + ) 4 distribute all Q values into the 32 bins 11/17/2000 IEEE ICNP'2000, Osaka, Japan 33

Threshold z Predefined threshold, z If Prob(Q>q) < , raise alarm 11/17/2000 IEEE ICNP'2000, Osaka, Japan 34

Q-Distribution for Position M. 11/17/2000 IEEE ICNP'2000, Osaka, Japan 35

Q-Distribution for Delay M. 11/17/2000 IEEE ICNP'2000, Osaka, Japan 36

Detect Malicious Dropping z. For each Observed Distribution 4 compares it to the Expected Distribution (calculate a Q value) 4 if the Q value falls into alarm zone, raise alarm z. Short-term profile is updated using Weighted Sum Scheme 11/17/2000 IEEE ICNP'2000, Osaka, Japan 37

Long-term Profile Update z. Update when no attacks occurs during the a period of time z. Update Expected Distribution and Q Distribution 4 weighted sum scheme 4 fading factor equals l 11/17/2000 IEEE ICNP'2000, Osaka, Japan 38

TDSAM Performance Analysis: Experiment Setting FTP Client on Linux 2. 0. 36 FTP Server FTP TDSAM Divert Socket 3 Per. PD: (10, 4, 5), . . . (100, 40, 5) 3 Ret. PD: (5, 5) 3 Ran. PD: (10), (40) z Intermittent Atk. Data Packets 11/17/2000 njcom 210. zip 5. 5 M Attack Agent z Persistent Atk. Internet IEEE ICNP'2000, Osaka, Japan 3 Per. PD (10, 4, 5) with attack period 5 and 50 39

Example z. Long-Term profile ynbin = 5, bin-width =800 yp 1=0. 194339, p 2=0. 200759, p 3=0. 197882, p 4=0. 204260, p 5=0. 202760. z. Per. PD(20, 4, 5) ydrop packets only in the first 85. yp 1=0. 837264, p 2=0. 039390, p 3=0. 043192, p 4=0. 041045, p 5=0. 039109. 11/17/2000 IEEE ICNP'2000, Osaka, Japan 40

Results: Position Measure 11/17/2000 IEEE ICNP'2000, Osaka, Japan 41

Results: Delay Measure 11/17/2000 IEEE ICNP'2000, Osaka, Japan 42

Results: NPR Measure 11/17/2000 IEEE ICNP'2000, Osaka, Japan 43

TDSAM Performance Analysis: Results (good or bad!!) z False Alarm Rate 4 less than 10% in most cases, the highest is 17. 4% z Detection Rate 4 Position: good on Ret. PD and most of Per. PD > at NCU, 98. 7% for Per. PD(20, 4, 5), but 0% for Per. PD(100, 40, 5) in which dropped packets are evenly distributed 4 Delay: good on those significantly change session delay, e. g. , Ret. PD, Per. PD with a large value of K > at Sing. Net, 100% for Ret. PD(5, 5), but 67. 9% for Ran. PD(10) 4 NPR: good on those dropping many packets > at Heidelberg, 0% for Ran. PD(10), but 100% for Ran. PD(40) 11/17/2000 IEEE ICNP'2000, Osaka, Japan 44

TDSAM Performance Analysis: Results (cont. ) z Good sites correspond to a high detection rate. 4 stable and small session delay or packet reordering 4 e. g. , using Delay Measure for Ran. PD(10): UIUC (99. 5%) > Heidelberg(74. 5%) > Sing. Net (67. 9%) > NCU (26. 8%) z How to choose the value of nbin is site-specific 4 e. g. , using Position Measure, lowest false alarm rate occurs when nbin= 5 at Heidelberg(4. 0%) and NCU(5. 4%), 10 at UIUC(4. 5%) and 20 at Sing. Net(1. 6%) 11/17/2000 IEEE ICNP'2000, Osaka, Japan 45

Conclusion z TDSAM with a single measure 4 able to detect dropping attacks 4 has weakness in identifying some malicious droppings z Combines the 3 measures 4 works well on most of the attacks 4 except for those causing very limited damages >Ran. PD with a small value of K >intermittent attacks with a large attack interval > Limitations…. 11/17/2000 IEEE ICNP'2000, Osaka, Japan 46

Future…. z. Detect Non-TCP Packet Dropping Attacks 4 choose appropriate statistic measures z. Service Level Agreement Monitoring 4 build long-term profile statistically monitoring the quality of service 4 e. g. , evaluate the DNS response time 11/17/2000 IEEE ICNP'2000, Osaka, Japan 47

Contributions z. Packet Dropping Attacks 4 Studied how to practice the attacks 4 Studied the impacts of dropping attacks 4 Implemented the Attack Agent z. Intrusion Detection 4 Implementation of TDSAM 4 TDSAM performance analysis over the real Internet 11/17/2000 IEEE ICNP'2000, Osaka, Japan 48

Thanks full paper: http: //www. cs. ucdavis. edu/publications/PDALong. ps Any questions? 11/17/2000 IEEE ICNP'2000, Osaka, Japan 49

Weighted Sum Scheme z Problems of Sliding Window Scheme 4 Keep the most recent N pieces of audit records 4 required resource and computing time are O(N) z Assume z When Ei occurs, update 4 K: number of bins 4 Yi: count of audit records falls into ith bin 4 N: total number of audit records 4 : fading factor 11/17/2000 IEEE ICNP'2000, Osaka, Japan 50