Detection of distributed denial of service attacks in autonomous system domains
A denial-of-service network attack detection system is deployable in single-homed and multi-homed stub networks. The detection system maintains state information of flows entering and leaving the stub domain to determine if exiting traffic exceeds traffic entering the system. Monitors perform simple processing tasks on sampled packets at individual routers in the network at line speed and perform more intensive processing at the routers periodically. The monitors at the routers form an overlay network and communicate pertinent traffic state information between nodes. The state information is collected and analyzed to determine the presence of an attack.
1. A method for detecting malicious communication traffic at an autonomous network domain comprising:
sampling packets of a plurality of flows at each of a plurality of routing nodes in the autonomous network domain, each of said flows including incoming packets having a common source address and outgoing packets having a common destination address;
providing in memory at each of said routing nodes an IP-mapped symmetric flow table of counters and an IP-mapped asymmetric flow table of counters, each counter of said IP-mapped symmetric flow table and said IP-mapped asymmetric flow table mapped to at least a portion of a corresponding internet protocol address;
providing in said memory at each of said routing nodes a hashed-mapped symmetric flow table of counters and a hashed-mapped asymmetric flow table of counters, each counter of said hash-mapped symmetric flow table and said hash-mapped asymmetric flow table mapped by a hashing function of said internet protocol address;
counting at each of said routing nodes said sampled packets into at least one counter mapped to an at least partially randomized distribution of said plurality of flows;
updating said counters in said IP-mapped symmetric flow table, said hash-mapped symmetric flow table, said IP-mapped asymmetric flow table and said hash-mapped asymmetric flow table responsive to said sampled packets in said counting step;
aggregating at each of said routing nodes said IP-mapped symmetric flow table and said hash-mapped symmetric flow table of others of said routing nodes;
adding at each of said routing nodes said counters of said aggregated IP-mapped symmetric flow table to corresponding said counters in said IP-mapped asymmetric flow table and said counters of said aggregated hash-mapped symmetric flow value to said hash-mapped asymmetric flow table;
determining at each of said routing nodes a residual count of said outgoing packets exceeding said incoming packets;
transmitting said count from each of said routing nodes to at least one rendezvous node;
aggregating at said rendezvous node said IP-mapped asymmetric flow table and said hash-mapped asymmetric flow table from said routing nodes; and
determining at said at least one rendezvous node at least one flow identifier of an attack flow by determining from said aggregated IP-mapped asymmetric flow table and said aggregated hash-mapped asymmetric flow table at said rendezvous node said attack flow.
2. The method for detecting malicious communication traffic as recited in claim 1 further including decrementing said counter upon receiving an incoming packet and incrementing said counter when receiving an outgoing packet.
3. The method for detecting malicious communication traffic as recited in claim 2 further decrementing said counter by a value greater than a value used for incrementing said counter.
4. The method for detecting malicious communication traffic as recited in claim 3 , where said decrementing value is a maximum allowable outgoing-to-incoming packet ratio.
5. The method for detecting malicious communication traffic as recited in claim 4 , where said decrementing is performed responsive to said incoming packet only when all values in a memory table of such counters are at least equal to said decrementing value.
6. The method for detecting malicious communication traffic as recited in claim 1 where said counting step includes:
providing a first plurality of counters each addressable in accordance with a first mapping;
providing a second plurality of counters each addressable in accordance with a second mapping;
incrementing by a first value at least one of said first counters responsive to said sampling one of said outgoing packets;
decrementing by a second value greater than said first value said first counters responsive to said sampling one of said incoming packets and all of said first counters being at least said second value; and
neither incrementing nor decrementing said first counters responsive to said sampling one of said incoming packets if less than all of said first counters are at least said second value.
7. The method for detecting malicious communication traffic as recited in claim 6 , where said providing said first plurality of counters includes respectively mapping an internet protocol address to said first counters as said first mapping and said providing said second plurality of counters includes respectively mapping by a hashing function of said internet protocol address to said second counters as said second mapping.
8. The method for detecting malicious communication traffic as recited in claim 7 , where said internet protocol address mapping includes mapping segments of said internet protocol address to a set of said first counters such that more than one of said segments is mapped to one of said first counters of said set.
9. The method for detecting malicious communication traffic as recited in Claim 1 , where said counter updating includes:
incrementing by a first value at least one of said counters in said IP-mapped symmetrical flow table and at least one of said counters in said hash-mapped symmetric flow table responsive to said sampling one of said outgoing packets;
decrementing by a second value greater than said first value said counters in said IP-Mapped symmetrical flow table and said counters in said hash-mapped symmetric flow table responsive to said sampling one of said incoming packets and all of said counters in said IP-mapped symmetrical flow table and all of said counters in said hash-mapped symmetric flow table being at least said second value;
decrementing by said second value said one of said counters in said IP-mapped asymmetrical flow table and said one of said counters in said hash-mapped asymmetric flow table responsive to:
said sampling one of said incoming packets;
less than all of said counters in said IP-mapped symmetrical flow table or less than all of said counters in said hash-mapped symmetric flow table being at least said second value; and
all of said counters in said IP-mapped asymmetrical flow table and all of said counters in said one of said counters in said hash-mapped asymmetric flow table being at least said second value; and
neither incrementing nor decrementing said counters in said IP-mapped symmetrical flow table and said counters in said hash-mapped symmetric flow table responsive to said sampling one of said incoming packets if less than all of said counters in said IP-mapped symmetrical flow table and less than all of said counters in said hash-mapped symmetric flow table are at least said second value.