Detecting Network Attacks in the Internet via Statistical Network Traffic Normality Prediction

The information technology advances that provide new capabilities to the network users and providers, also provide powerful new tools for network intruders that intend to launch attacks on critical information resources. In this paper we present a novel network attack diagnostic methodology, based on the characterization of the dynamic statistical properties of normal network traffic. The ability to detect network anomalies and attacks as unacceptable when significant deviations from the expected behavior occurs. Specifically, to provide an accurate identification of the normal network traffic behavior, we first develop an anomaly-tolerant nonstationary traffic prediction technique that is capable of removing both single pulse and continuous anomalies. Furthermore, we introduce and design dynamic thresholds, where we define adaptive anomaly violation conditions as a combined function of both magnitude and duration of the traffic deviations. Finally numerical results are presented that demonstrate the operational effectiveness and efficiency of the proposed approach under the presence of different attacks, such as mail-bombing attacks and UDP flooding attacks.     

Network traffic fusion and analysis against DDoS flooding attacks with a novel reversible sketch

Distributed Denial of Service (DDoS) flooding attacks are one of the typical attacks over the Internet. They aim to prevent normal users from accessing specific network resources. How to detect DDoS flooding attacks arises a significant and timely research topic. However, with the continuous increase of network scale, the continuous growth of network traffic brings great challenges to the detection of DDoS flooding attacks. Incomplete network traffic collection or non-real-time processing of big-volume network traffic will seriously affect the accuracy and efficiency of attack detection. Recently, sketch data structures are widely applied in high-speed networks to compress and fuse network traffic. But sketches suffer from a reversibility problem that it is difficult to reconstruct a set of keys that exhibit abnormal behavior due to the irreversibility of hash functions. In order to address the above challenges, in this paper, we first design a novel Chinese Remainder Theorem based Reversible Sketch (CRT-RS). CRT-RS is not only capable of compressing and fusing big-volume network traffic but also has the ability of reversely discovering the anomalous keys (e.g., the sources of malicious or unwanted traffic). Then, based on traffic records generated by CRT-RS, we propose a Modified Multi-chart Cumulative Sum (MM-CUSUM) algorithm that supports self-adaptive and protocol independent detection to detect DDoS flooding attacks. The performance of the proposed detection method is experimentally examined by two open source datasets. The experimental results show that the method can detect DDoS flooding attacks with efficiency, accuracy, adaptability, and protocol independability. Moreover, by comparing with other attack detection methods using sketch techniques, our method has quantifiable lower computation complexity when recovering the anomalous source addresses, which is the most important merit of the developed method.     

基于移动代理和动态拓扑结构的入侵检测系统模型

分布式网络攻击的破坏性越来越大。网络在运行中拓扑结构又是在动态变化的。如何在拓扑结构变化的网络中去发现和阻止网络攻击，本文提出了一个基于移动代理技术的模型。模型由拓扑发现代理、拓扑计算代理、检测代理、追踪代理、阻击代理组成。拓扑发现代理和拓扑计算代理完成网络拓扑结构跟踪，检测代理、追踪代理、阻击代理完成对分布式网络攻击的探测、追踪、阻止。该模型具有适合大规模网络、占用网络带宽少、能自动跟踪网络拓扑变化、系统的入侵检测和响应与拓扑变化无关等特点。     

An autonomous defense against SYN flooding attacks: Detect and throttle attacks at the victim side independently

Distributed denial of service (DDoS) attacks seriously threaten Internet services yet there is currently no defence against such attacks that provides both early detection, allowing time for counteraction, and an accurate response. Traditional detection methods rely on passively sniffing an attacking signature and are inaccurate in the early stages of an attack. Current counteractions such as traffic filter or rate-limit methods do not accurately distinguish between legitimate and illegitimate traffic and are difficult to deploy. This work seeks to provide a method that detects SYN flooding attacks in a timely fashion and that responds accurately and independently on the victim side. We use the knowledge of network traffic delay distribution and apply an active probing technique (DARB) to identify half-open connections that, suspiciously, may not arise from normal network congestion. This method is suitable for large network areas and is capable of handling bursts of traffic flowing into a victim server. Accurate filtering is ensured by a counteraction method using IP address and time-to-live(TTL) fields. Simulation results show that our active detection method can detect SYN flooding attacks accurately and promptly and that the proposed rate-limit counteraction scheme can efficiently minimize the damage caused by DDoS attacks and guarantee constant services to legitimate users.     

Building an Identity Management Infrastructure for Today…and Tomorrow

ABSTRACT

The basis of denial of service (DoS)/distributed DoS (DDoS) attacks lies in overwhelming a victim's computer resources by flooding them with enormous traffic. This is done by compromising multiple systems that send a high volume of traffic. The traffic is often formulated in such a way that it consumes finite resources at abnormal rates either at victim or network level. In addition, spoofing of source addresses makes it difficult to combat such attacks. This paper adopts a twofold collaborative mechanism, wherein the intermediate routers are engaged in markings and the victim uses these markings for detecting and filtering the flooding attacks. The markings are used to distinguish the legitimate network traffic from the attack so as to enable the routers near the victim to filter the attack packets. The marked packets are also helpful to backtrack the true origin of the spoofed traffic, thus dropping them at the source rather than allowing them to traverse the network. To further aid in the detection of spoofed traffic, Time to Live (TTL) in the IP header is used. The mappings between the IP addresses and the markings along with the TTLs are used to find the spurious traffic. We provide numerical and simulated experimental results to show the effectiveness of the proposed system in distinguishing the legitimate traffic from the spoofed. We also give a statistical report showing the performance of our system.     

应用层洪泛攻击的异常检测

从近年的发展趋势看, 分布式拒绝服务攻击已经从原来的低层逐渐向应用层发展, 它比传统的攻击更加有效且更具隐蔽性. 为检测利用合法应用层HTTP请求发动的洪泛攻击, 本文把应用层洪泛攻击视为一种异常的用户访问行为, 从用户浏览行为的角度实现攻击检测. 基于实际网络流的试验表明,该模型可以有效测量Web用户的访问行为正常度并实现应用层的DDoS洪泛攻击检测.     

一种高效抵御SIP洪泛攻击的防御模型

根据会话初始协议(SIP)拒绝服务攻击的原理和方式,将阈值动态调整和实时动态防御相结合,提出一种抵御SIP洪泛攻击的防御模型,利用卡方流量判定模型与累计和统计模型动态调整阈值,并检测SIP洪泛攻击,通过IP防御模型动态抵御基于IP的SIP洪泛攻击。实验结果表明,该模型可以实时、高效地检测SIP洪泛攻击,在异常发生时有效防止SIP/ IMS服务器被攻击。     

Covariance-Matrix Modeling and Detecting Various Flooding Attacks

This paper presents a covariance-matrix modeling and detection approach to detecting various flooding attacks. Based on the investigation of correlativity changes of monitored network features during flooding attacks, this paper employs statistical covariance matrices to build a norm profile of normal activities in information systems and directly utilizes the changes of covariance matrices to detect various flooding attacks. The classification boundary is constrained by a threshold matrix, where each element evaluates the degree to which an observed covariance matrix is different from the norm profile in terms of the changes of correlation between the monitored network features represented by this element. Based on Chebyshev inequality theory, we give a practical (heuristic) approach to determining the threshold matrix. Furthermore, the result matrix obtained in the detection serves as the second-order features to characterize the detected flooding attack. The performance of the approach is examined by detecting Neptune and Smurf attacks-two common distributed Denial-of-Service flooding attacks. The evaluation results show that the detection approach can accurately differentiate the flooding attacks from the normal traffic. Moreover, we demonstrate that the system extracts a stable set of the second-order features for these two flooding attacks     

基于OpenFlow的云计算监控架构

云计算中网络的监控任务是一件重要和复杂的工作.在云计算网络中的安全设备不仅要监控外网流量,还要监控内网流量.现有使用SDN和OpenFlow对网络流量监控的研究都基于每种设备仅存在一台的前提,受限于安全设备的数量,性能和效率受到限制.本文在OpenFlow上提出了一种云计算网络流量监控架构和算法,支持多台同类型的设备同时工作,可以在云计算网络中,实现灵活高效的网络流量监控.     

QoS constraints-based energy-efficient model in cloud computing networks for multimedia clinical issues

For many applications of multimedia medical devices in clinical and medical issues, cloud computing becomes a very useful way. However, high energy consumption of cloud computing networks for these applications brings forth a large challenge. This paper studies the energy-efficient problem with QoS constraints in large-scale cloud computing networks. We use the sleeping and rate scaling mechanism to propose a link energy consumption model to characterize the network energy consumption. If there is no traffic on a link, we will let it be sleeping. Otherwise, it is activated and we divide its energy consumption into base energy consumption and traffic energy consumption. The former describes the constant energy consumption that exists when the link runs, while the later, which is a quadratic function with respect to the traffic, indicates the relations between link energy consumption and the traffic on the link. Then considering the relation among network energy consumption, number of active links, and QoS constraints, we build the multi-constrained energy efficient model to overcome the high energy consumption in large-scale cloud computing networks. Finally, we exploit the NSF and GEANT network topology to validate our model. Simulation results show that our approach can significantly improve energy efficiency of cloud computing networks.