On implementation of efficient inline DDoS detector based on AATAC algorithm
Abstract
Distributed Denial of Service (DDoS) attacks constitute a major threat in the current Internet. These cyber‑attacks aim to flood the target system with tailored malicious network traffic overwhelming its service capacity and consequently severely limiting legitimate users from using the service. This paper builds on the state-of-the-art AATAC algorithm (Autonomous Algorithm for Traffic Anomaly Detection) and provides a concept of a dedicated inline DDoS detector capable of real-time monitoring of network traffic and near-real-time anomaly detection.
The inline DDoS detector consists of two main elements: 1) inline probe(s) responsible for link-rate real-time processing and monitoring of network traffic with custom-built packet feature counters, and 2) an analyser that performs the near-real-time statistical analysis of these counters for anomaly detection. These elements communicate asynchronously via the Redis database, facilitating a wide range of deployment scenarios. The inline probes are based on COTS servers and utilise the DPDK framework (Data Plane Development Kit) and parallel packet processing on multiple CPU cores to achieve link rate traffic analysis, including tailored DPI analysis.References
A. Zand, G. Modelo-Howard, A. Tongaonkar, S. -J. Lee, C. Kruegel and G. Vigna, “Demystifying DDoS as a Service,” in IEEE Communications Magazine, vol. 55, no. 7, pp. 14-21, July 2017,
DOI: 10.1109/MCOM.2017.1600980.
J. J. Santanna et al., “Booters — An analysis of DDoS-as-a-service attacks,” 2015 IFIP/IEEE International Symposium on Integrated Network Management (IM), 2015, pp. 243-251, DOI: 10.1109/INM.2015.7140298.
Apache documentation, ServerLimit Directive [online]. Available from: https://httpd.apache.org/docs/2.4/mod/mpm_common.html#serverlimit [Accessed 21.10.2022]
M. Sikora, T. Gerlich and L. Malina, “On Detection and Mitigation of Slow Rate Denial of Service Attacks,” 11th International
Congress on Ultra Modern Telecommunications and Control
Systems and Workshops (ICUMT), 2019, pp. 1-5,
DOI: 10.1109/ICUMT48472.2019.8970844.
H. Kaur, S. Behal and K. Kumar, “Characterisation and comparison of Distributed Denial of Service attack tools,” 2015 International Conference on Green Computing and Internet of Things (ICGCIoT), 2015, pp. 1139 1145, DOI: 10.1109/ICGCIoT.2015.7380634.
G. Roudière and P. Owezarski, “A lightweight snapshot-based DDoS detector,” in Proc. of 2017 13th International Conference on
Network and Service Management (CNSM), 2017, pp. 1-7,
DOI: 10.23919/CNSM.2017.8256014.
J. Wang, R. C. . -W. Phan, J. N. Whitley and D. J. Parish, “Augmented Attack Tree Modeling of Distributed Denial of Services and Tree Based Attack Detection Method,” 2010 10th IEEE International Conference on Computer and Information Technology, 2010, pp. 1009-1014, DOI: 10.1109/CIT.2010.185.
Y. -C. Wu, H. -R. Tseng, W. Yang and R. -H. Jan, “DDoS Detection and Traceback with Decision Tree and Grey Relational Analysis,” 2009 Third International Conference on Multimedia and Ubiquitous Engineering, 2009, pp. 306-314, DOI: 10.1109/MUE.2009.60.
A. Saied, R. E. Overill, and T. Radzik, “Detection of known and unknown DDoS attacks using Artificial Neural Networks,” Neurocomputing, vol. 172, January 2016, pp. 385–393,
https://doi.org/10.1016/j.neucom.2015.04.101.
X. Qin, T. Xu and C. Wang, “DDoS Attack Detection Using Flow Entropy and Clustering Technique,” 2015 11th International Conference on Computational Intelligence and Security (CIS), 2015, pp. 412-415, DOI: 10.1109/CIS.2015.105.
S. Ramaswamy, R. Rastogi and K. Shim, “Efficient algorithms for mining outliers from large data sets,” ACM SIGMOD Rec., vol. 29, no. 2, pp. 427-438, 2000.
R. Hofstede, V. Bartoš, A. Sperotto and A. Pras, “Towards real-time intrusion detection for NetFlow and IPFIX,” Proceedings of the 9th International Conference on Network and Service Management (CNSM 2013), 2013, pp. 227-234, DOI: 10.1109/CNSM.2013.6727841.
G. Roudière and P. Owezarski, “Evaluating the Impact of Traffic Sampling on AATAC’s DDoS Detection” in Proc. of the 2018 Workshop on Traffic Measurements for Cybersecurity (WTMC ‘18). Association for Computing Machinery, New York, NY, USA, 27–32.
DOI: 10.1145/3229598.3229605
M. Jin, C. Wang, P. Li and Z. Han, “Survey of Load Balancing Method Based on DPDK,” 2018 IEEE 4th International Conference on Big Data Security on Cloud (BigDataSecurity), IEEE International Conference on High Performance and Smart Computing, (HPSC) and IEEE International Conference on Intelligent Data and Security (IDS), 2018, pp. 222-224, DOI: 10.1109/BDS/HPSC/IDS18.2018.00054.
Information about the TAMA project, Exatel webpage [online]. Available from: https://exatel.pl/en/research-and-development/exatel-tama/
[Accessed 21.10.2022]
S. Bradner, and J. McQuaid, “Benchmarking Methodology for Network Interconnect Devices”, RFC 2544, DOI: 10.17487/RFC2544, March 1999.
S. Bradner, “Benchmarking Terminology for Network Interconnection Devices”, RFC 1242, DOI: 10.17487/RFC1242, July 1991
Downloads
Published
Issue
Section
License
Copyright (c) 2022 International Journal of Electronics and Telecommunications
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
1. License
The non-commercial use of the article will be governed by the Creative Commons Attribution license as currently displayed on https://creativecommons.org/licenses/by/4.0/.
2. Author’s Warranties
The author warrants that the article is original, written by stated author/s, has not been published before, contains no unlawful statements, does not infringe the rights of others, is subject to copyright that is vested exclusively in the author and free of any third party rights, and that any necessary written permissions to quote from other sources have been obtained by the author/s. The undersigned also warrants that the manuscript (or its essential substance) has not been published other than as an abstract or doctorate thesis and has not been submitted for consideration elsewhere, for print, electronic or digital publication.
3. User Rights
Under the Creative Commons Attribution license, the author(s) and users are free to share (copy, distribute and transmit the contribution) under the following conditions: 1. they must attribute the contribution in the manner specified by the author or licensor, 2. they may alter, transform, or build upon this work, 3. they may use this contribution for commercial purposes.
4. Rights of Authors
Authors retain the following rights:
- copyright, and other proprietary rights relating to the article, such as patent rights,
- the right to use the substance of the article in own future works, including lectures and books,
- the right to reproduce the article for own purposes, provided the copies are not offered for sale,
- the right to self-archive the article
- the right to supervision over the integrity of the content of the work and its fair use.
5. Co-Authorship
If the article was prepared jointly with other authors, the signatory of this form warrants that he/she has been authorized by all co-authors to sign this agreement on their behalf, and agrees to inform his/her co-authors of the terms of this agreement.
6. Termination
This agreement can be terminated by the author or the Journal Owner upon two months’ notice where the other party has materially breached this agreement and failed to remedy such breach within a month of being given the terminating party’s notice requesting such breach to be remedied. No breach or violation of this agreement will cause this agreement or any license granted in it to terminate automatically or affect the definition of the Journal Owner. The author and the Journal Owner may agree to terminate this agreement at any time. This agreement or any license granted in it cannot be terminated otherwise than in accordance with this section 6. This License shall remain in effect throughout the term of copyright in the Work and may not be revoked without the express written consent of both parties.
7. Royalties
This agreement entitles the author to no royalties or other fees. To such extent as legally permissible, the author waives his or her right to collect royalties relative to the article in respect of any use of the article by the Journal Owner or its sublicensee.
8. Miscellaneous
The Journal Owner will publish the article (or have it published) in the Journal if the article’s editorial process is successfully completed and the Journal Owner or its sublicensee has become obligated to have the article published. Where such obligation depends on the payment of a fee, it shall not be deemed to exist until such time as that fee is paid. The Journal Owner may conform the article to a style of punctuation, spelling, capitalization and usage that it deems appropriate. The Journal Owner will be allowed to sublicense the rights that are licensed to it under this agreement. This agreement will be governed by the laws of Poland.
By signing this License, Author(s) warrant(s) that they have the full power to enter into this agreement. This License shall remain in effect throughout the term of copyright in the Work and may not be revoked without the express written consent of both parties.
