Determining reputation of autonomous systems based on monitoring the unwanted traffic
This post is an abstract and a translation of the work that is done by a former student and the original in Croatian can be found here.
In this post, denial of service attacks also known as DoS attacks will be analyzed as they make a major part of unwanted traffic on the Internet. DoS attacks are classified according to sources and techniques used. Some of the known DoS attacks include teardrop attack, ICMP flood attack, smurf attack, reflection attack, SYN flood attack and DDoS attack (distributed denial of service attack). In order to determine reputation of an autonomous system by monitoring DoS attacks and other unwanted traffic, it is obligatory to figure out how they can be detected. After the incoming unwanted traffic or DoS attack can be detected, it will be discussed how to measure them in order to determine reputation of a neighbouring autonomous system from which the traffic came. The reputation system discussed here is viewed from a standpoint of an autonomous system which implemented it.
The detection of malicious traffic such as DoS attacks is done by monitoring three parameters of the network which are bandwidth, packet delay and ratio of lost packets. Measuring is usually done without the help of core routers because it would overload them, jamming the network of AS. A common way of detecting malicious traffic is achieved through edge based monitoring - following one of the two schemes: stripe-based network monitoring and distributed network monitoring. There are three main scenarios of malicious traffic that need to be detected: single-source DoS attacks with spoofed address, DDoS attacks with spoofed address and DoS attacks without spoofed address. Moreover, it is a must to take into consideration that not all unwanted traffic is necessarily malicious. For example, a packet containing an error doesnt have to originate from a malicious source but still represents unwanted traffic because it needlessly uses up resources on the Internet. More on the definition of unwanted traffic and malicious traffic can be found here. Header of a packet can be considered a fourth parameter used for detection of malicious traffic. Because there are norms about how a header of a certain protocol should look like, it is easy to select a random packet and see if it has all the fields filled out correctly. An intrusion detection system (IDS) such as Snort will be used in order to detect a DoS attack so that they could be measured.
Unwanted traffic is measured using a premade table. Each known attack or error has a value according to the damage it can do and/or danger it represents to the AS and the network. IDS hopefully detects most of the incoming attacks and alarms the reputation system, forwarding furthest known IP address from which the attack originated, which then determines ASN using Whois protocol. It is very important to note here that the true origin of an attack mostly can�t be discovered due to the nature of the Internet, but responsibility for an attack is then transferred to the closest known AS from which the attack came and so is its reputation lowered accordingly.
In order to try and apply before mentioned theory, a series of practical measurements had been made using Snort as IDS and reputation system described in the original work.
download file now