hash-based ip traceback alex c. snoeren †, craig partridge, luis a. sanchez, christine e. jones,...
TRANSCRIPT
![Page 1: Hash-Based IP Traceback Alex C. Snoeren †, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, W. Timothy Strayer](https://reader036.vdocuments.us/reader036/viewer/2022083009/5697bf7c1a28abf838c84169/html5/thumbnails/1.jpg)
Hash-Based IP Traceback
Alex C. Snoeren†, Craig Partridge,
Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio,
Stephen T. Kent, W. Timothy Strayer
BBN Technologies†MIT Laboratory for Computer Science
![Page 2: Hash-Based IP Traceback Alex C. Snoeren †, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, W. Timothy Strayer](https://reader036.vdocuments.us/reader036/viewer/2022083009/5697bf7c1a28abf838c84169/html5/thumbnails/2.jpg)
Network Security Risks
• Tools readily available to attackers network server attacks performance degradation attacks
• DOS• DDOS
Single packet attacks (Stop 0A in TCPIP.sys, Teardrop, Ping-of-death)
• Accidental (unintentional) attacks
![Page 3: Hash-Based IP Traceback Alex C. Snoeren †, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, W. Timothy Strayer](https://reader036.vdocuments.us/reader036/viewer/2022083009/5697bf7c1a28abf838c84169/html5/thumbnails/3.jpg)
Approaches
• Firewalls - prevent attack packets from reaching the victim some attack packets look quite innocent hard to predict all possible attacks does not get at the source of the problem continue to consume network resources
• Traceback - identify the source of attack packets For a given packet, find the path to source
![Page 4: Hash-Based IP Traceback Alex C. Snoeren †, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, W. Timothy Strayer](https://reader036.vdocuments.us/reader036/viewer/2022083009/5697bf7c1a28abf838c84169/html5/thumbnails/4.jpg)
Why Traceback is hard
• Internet Protocol permits anonymity Attackers can “spoof” source address
• Fraggle/Smurf, etc
IP forwarding maintains no audit trails
• Some spoofing is legitimate (NATs, mobile IP, etc)
• Attacks may be short-lived• Packets change hop by hop• Routing instability
![Page 5: Hash-Based IP Traceback Alex C. Snoeren †, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, W. Timothy Strayer](https://reader036.vdocuments.us/reader036/viewer/2022083009/5697bf7c1a28abf838c84169/html5/thumbnails/5.jpg)
Why Traceback is hard (continued)
• Network may carry multiple identical packets (attacks, multicast, broadcast)
• Routers may be compromised
• Attackers may be aware they are being traced
• Increasing packet size is frowned on
• Will consume network resources
• Ingress filtering of limited value
![Page 6: Hash-Based IP Traceback Alex C. Snoeren †, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, W. Timothy Strayer](https://reader036.vdocuments.us/reader036/viewer/2022083009/5697bf7c1a28abf838c84169/html5/thumbnails/6.jpg)
Traceback Goal
• Reconstruct the attack path of a packet where the path consists of every router on the path from the source to the victim
• Reconstruct the attack graph which may result from multiple copies of an attack packet injected by different sources
• Need to be able to detect false positives with a high degree of accuracy
![Page 7: Hash-Based IP Traceback Alex C. Snoeren †, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, W. Timothy Strayer](https://reader036.vdocuments.us/reader036/viewer/2022083009/5697bf7c1a28abf838c84169/html5/thumbnails/7.jpg)
Approaches to Traceback
• Path data can be noted in several places In the packet itself [Savage et al.], At the destination [I-Trace], or In the network infrastructure
• Logging: a naïve in-network approach Record each packet forwarding event Can trace a single packet to a source router,
ingress point, or subverted router(s)
![Page 8: Hash-Based IP Traceback Alex C. Snoeren †, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, W. Timothy Strayer](https://reader036.vdocuments.us/reader036/viewer/2022083009/5697bf7c1a28abf838c84169/html5/thumbnails/8.jpg)
Log-Based Traceback
V
R
R1 R2
R3
RR
RR
R4
A R
RR7
R6R5
![Page 9: Hash-Based IP Traceback Alex C. Snoeren †, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, W. Timothy Strayer](https://reader036.vdocuments.us/reader036/viewer/2022083009/5697bf7c1a28abf838c84169/html5/thumbnails/9.jpg)
Challenges to Logging
• Attack path reconstruction is difficult Packet may be transformed as it moves
through the network
• Full packet storage is problematic Memory requirements are prohibitive at
high line speeds (OC-192 is ~10Mpkt/sec)
• Extensive packet logs are a privacy risk Traffic repositories may aid eavesdroppers
![Page 10: Hash-Based IP Traceback Alex C. Snoeren †, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, W. Timothy Strayer](https://reader036.vdocuments.us/reader036/viewer/2022083009/5697bf7c1a28abf838c84169/html5/thumbnails/10.jpg)
Solution: Packet Digesting
• Record only invariant packet content Mask dynamic fields (TTL, checksum, etc.) Store information required to invert packet
transformations at performing router
• Compute packet digests instead Use hash function to compute small digest Store probabilistically in Bloom filters
• Impossible to retrieve stored packets
![Page 11: Hash-Based IP Traceback Alex C. Snoeren †, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, W. Timothy Strayer](https://reader036.vdocuments.us/reader036/viewer/2022083009/5697bf7c1a28abf838c84169/html5/thumbnails/11.jpg)
Invariant Content
Total Length
Identification
Checksum
Ver TOSHLen
TTL Protocol
Source Address
Destination Address
Fragment OffsetMF
DF
Options
Remainder of Payload
First 8 bytes of Payload
28bytes
![Page 12: Hash-Based IP Traceback Alex C. Snoeren †, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, W. Timothy Strayer](https://reader036.vdocuments.us/reader036/viewer/2022083009/5697bf7c1a28abf838c84169/html5/thumbnails/12.jpg)
Impact of Traffic Diversity
1e-06
1e-05
0.0001
0.001
0.01
0.1
1
20 22 24 26 28 30 32 34 36 38 40
Fra
ctio
n of
Col
lided
Pac
kets
Prefix Length (in bytes)
WAN (6031 hp)LAN (2879 hp)
![Page 13: Hash-Based IP Traceback Alex C. Snoeren †, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, W. Timothy Strayer](https://reader036.vdocuments.us/reader036/viewer/2022083009/5697bf7c1a28abf838c84169/html5/thumbnails/13.jpg)
• Variable capacity Easy to adjust Page when full
Bloom Filters
• Fixed structure size Uses 2n bit array Initialized to zeros
• Insertion is easy Use n-bit digest as
indices into bit array
1n bits
2n
bits
H(P)H2(P)
Hk(P)
H3(P)
H1(P)
1
1
1
. . .
Mitigate collisions by using multiple digests
![Page 14: Hash-Based IP Traceback Alex C. Snoeren †, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, W. Timothy Strayer](https://reader036.vdocuments.us/reader036/viewer/2022083009/5697bf7c1a28abf838c84169/html5/thumbnails/14.jpg)
Mistake Propagation is Limited
• Bloom filters may be mistaken Mistake frequency can be controlled Depends on capacity of full filters
• Neighboring routers won’t be fooled Vary hash functions used in Bloom filters Each router select hashes independently
• Long chains of mistakes highly unlikely Probability drops exponentially with length
![Page 15: Hash-Based IP Traceback Alex C. Snoeren †, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, W. Timothy Strayer](https://reader036.vdocuments.us/reader036/viewer/2022083009/5697bf7c1a28abf838c84169/html5/thumbnails/15.jpg)
Adjusting Graph Accuracy
• False positives rate depends on: Length of the attack path Complexity of network topology Capacity of Bloom filters
• Bloom filter capacity is easy to adjust Required filter capacity varies with router
speed and number of neighbors Appropriate capacity settings achieve
linear error growth with path length
![Page 16: Hash-Based IP Traceback Alex C. Snoeren †, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, W. Timothy Strayer](https://reader036.vdocuments.us/reader036/viewer/2022083009/5697bf7c1a28abf838c84169/html5/thumbnails/16.jpg)
Simulation Results
0
0.2
0.4
0.6
0.8
1
0 5 10 15 20 25 30
Length of Attack Path (in hops)
Random Graph
0
0.2
0.4
0.6
0.8
1
0 5 10 15 20 25 30
Length of Attack Path (in hops)
0
0.2
0.4
0.6
0.8
1
0 5 10 15 20 25 30
Length of Attack Path (in hops)
Real ISP, 100% Utilization
0
0.2
0.4
0.6
0.8
1
0 5 10 15 20 25 30
Length of Attack Path (in hops)
Degree-Independent
Exp
ecte
d N
umbe
r of
Fal
se P
ositi
ves Real ISP, Actual Utilization
![Page 17: Hash-Based IP Traceback Alex C. Snoeren †, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, W. Timothy Strayer](https://reader036.vdocuments.us/reader036/viewer/2022083009/5697bf7c1a28abf838c84169/html5/thumbnails/17.jpg)
How long can digests last?
• Filters require 0.5% of link capacity Four OC-3s require 47MB per minute A single drive can store a whole day
• Access times are equally important Current drives can write >3GB per minute OC-192 needs SRAM access times
• Still viable tomorrow 128 OC-192 links need <100GB per minute
![Page 18: Hash-Based IP Traceback Alex C. Snoeren †, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, W. Timothy Strayer](https://reader036.vdocuments.us/reader036/viewer/2022083009/5697bf7c1a28abf838c84169/html5/thumbnails/18.jpg)
Prototype Implementation
• Implemented on a FreeBSD PC router Packet digesting on kernel forwarding path Bloom filters stored in kernel space Zero-copy kernel/user table move
• User-level query-support daemons Supports topology discovery through gated Queries automatically triggered by IDS
![Page 19: Hash-Based IP Traceback Alex C. Snoeren †, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, W. Timothy Strayer](https://reader036.vdocuments.us/reader036/viewer/2022083009/5697bf7c1a28abf838c84169/html5/thumbnails/19.jpg)
Summary
• Hash-based traceback is viable With reasonable memory constraints Supports common packet transforms Timely tracing of individual packets
• Publicly Available Implementation FreeBSD version will be available soon Linux port coming shortly thereafter….
http://www.ir.bbn.com/projects/SPIE