2023_A New Low-rate DoS Attack Method Robust to Timing Skew for Short Transfers

Transcript

1. A New Low-rate DoS Attack Method Robust to Timing Skew for Short Transfers †Future University Hakodate, Japan Ryuku Hisasue†，Hiroshi Inamura†， Shigemi Ishida† July 4 – 7, 2023 ICUFN © 2023 Future University Hakodate, Ryuku Hisasue.
2. Table of Contents Key Idea Background and Purpose © 2023 Future University Hakodate, Ryuku Hisasue. 1 Verification Experiments Formulation
3. Table of Contents Key Idea Background and Purpose © 2023 Future University Hakodate, Ryuku Hisasue. 2 Verification Experiments Formulation
4. Denial of Service (DoS) is a kind of cyber attack  Occupy the target's network traffic bandwidth by sending attack traffic → Degrades Quality of Service (QoS) of the network Threats on the Internet：Cyber Attacks Normal Traffic DoS Attack Traffic ・・・・・ ・ ・・・・ bandwidth © 2023 Future University Hakodate, Ryuku Hisasue. 3
5. Flooding DoS (FDoS) Attacks  Occupy 100% of Bandwidth  Easy to detect because of large traffic amount Low-rate DoS (LDoS)  Occupy about 10 – 30 % of Bandwidth (Low-rate)  Realized by periodic pulse What is LDoS Attacks? [1] FDoS Attack Traffic LDoS Attack Traffic Focus of this study [1] W. Zhijun, et al., “Low-rate dos attacks, detection, defense, and challenges: a survey,” IEEE access, vol. 8, pp. 43 920–43 943, 2020. 𝑅 𝑡 : Traffic Rate at time 𝑡, 𝐶: Link Bandwidth, 𝑎𝑠𝑡𝑟 , 𝑎𝑒𝑛𝑑 : duration of attack 𝑅 ∶ Attack Pulse Traffic Rate, 𝐿: Attack Pulse width, 𝑇: Attack Pulse Period © 2023 Future University Hakodate, Ryuku Hisasue. 4
6. Factors of increasing the number of short transfers:  Improved transfer speed [3]  Communication facilities get high throughput → Shorter transfer time for the same amount of data  Widespread use of microservices architecture [4]  Data are transferred for each function (service) → Short transfers occur frequently The Number of Short Transfers has Increased 5 © 2023 Future University Hakodate, Ryuku Hisasue. Presentation Service Service Service API API API ・ ・ ・ Microservices architecture Data transfers Logic User Client [3] D. Lee et al., “Orbital angular momentum multiplexing technology towards the realization of tbit/s wireless transmission,” NTT Technical Review, vol. 15, no. 9, p. 9, 2017. [4] J. Lewis, “Martin fowler microservicesa definition of this new architectural term, 2014,” URL–http://martinfowler. com/articles/microservices.html (accessed Jul. 2023).
7. 1. LDoS Attack in Cloud Data Center Network[5] TCP throughput reduced up to 83 % Transfer time is long since sending data size is large, and bottleneck links change dynamically so estimation is needed 2. LDoS Attack for Unknown Bottleneck Link Characteristics[6] Over 10 Mbps throughput reduced to less than 500 kbps About 60 sec required to estimate bottleneck link bandwidth Existing Research doesn’t consider short transfers In other research as far as the authors have investigated, short transfers are not considered © 2023 Future University Hakodate, Ryuku Hisasue. [5] Z. Feng et al., “Shrew attack in cloud data center networks,” in MSN ’11, 2011, pp. 441–445. [6] Y. Takahashi et al., “A low-rate ddos strategy for unknown bottleneck link characteristics,” in PerCom Workshops ’21. IEEE, 2021, pp. 508–513. 6
8. Purpose Discover LDoS Attack method against Short Transfers © 2023 Future University Hakodate, Ryuku Hisasue. 7
9. Table of Contents Key Idea Background and Purpose © 2023 Future University Hakodate, Ryuku Hisasue. 8 Verification Experiments Formulation
10. Exploit the RTO algorithm to send attack traffic at retransmissions timing, and cause RTO processing to occur continuously ・・・ Strategies for LDoS Attacks against TCP (conventional Shrew method)[7] RTO: retransmission timer management algorithm that is used in TCP retransmission control RTO algorithm: RTO𝑛 = 2 ⋅ RTO𝑛−1 , RTO1 = minRTO (recommend minRTO value: 1sec[8]) [7] A. Kuzmanovic, et al, “Low-rate tcp-targeted denial of service attacks: the shrew vs. the mice and elephants,” in SIGCOMM ’03, 2003, pp. 75–86. [8] V. Paxson, et al., “Rfc 6298: Computing tcp’s retransmission timer,” 2011. © 2023 Future University Hakodate, Ryuku Hisasue. 9
11.  If short transfer is the target, timing estimation is required Differences from Existing Studies Long transfer (Conventional target) Short transfer (Main target of this study) No need to estimate attack timing due to long transfer time No collision between attack pulse and target traffic is highly probable due to short transfer time Attack Attack Attack Attack Attack Attack Target Traffic © 2023 Future University Hakodate, Ryuku Hisasue. 10
12.  For attacking from the transfer start timing, the estimation of the timing skew of the transfer start timing should be less than the pulse interval → Conventional methods require precise timing estimation of the start timing, thus the attack success is difficult Estimation Accuracy of Transfer Start Timing Ideal Attack Start Timing Maximum Robust Timing Skew Attack Attack Attack Target Traffic © 2023 Future University Hakodate, Ryuku Hisasue. Start End 11
13. Ideal Transfer Start Timing Start end Target Traffic Target Traffic Attack Attack Attack Init Pulse © 2023 Future University Hakodate, Ryuku Hisasue. Attack Attack 12 Fawe-Shrew: First-Attack pulse Width Expansion Shrew  Expand only the initial pulse width in the conventional Shrew method → Improved the performance of the timing skew tolerance → Increased attack traffic size of initial pulses only, thus stealthier than FDoS by keeping subsequent pulses
14. Fawe-Shrew: First-Attack pulse Width Expansion Shrew Start end Target Traffic Target Traffic Attack Attack Attack Attack Attack Init Pulse keeping subsequent pulses © 2023 Future University Hakodate, Ryuku Hisasue. 13  Expand only the initial pulse width in the conventional Shrew method → Improved the performance of the timing skew tolerance → Increased attack traffic size of initial pulses only, thus stealthier than FDoS by keeping subsequent pulses
15. Table of Contents Key Idea Background and Purpose © 2023 Future University Hakodate, Ryuku Hisasue. 14 Verification Experiments Formulation
16. [Cond. A] For more than once RTO occur by several traffic collisions:  Range of 𝑡init is ①  Range of 𝑡init is ② ∧ 𝐿r − 𝐿init > 𝑡init − 𝐿 + 𝐿f  Range of 𝑡init is ③ ∧ 𝐿init ≥ 𝑇 − 𝐿 + 𝐿f [Cond. B] For once RTO occurs by first-pulse traffic collision:  Range of 𝑡init is ④ ∧ 𝐿r − 𝐿init ≤ 𝑡init − 𝐿 + 𝐿f ∧ 𝐿init < 𝑇 − 𝐿 + 𝐿f Relationship of First-Pulse Width and RTO Condition 15 © 2023 Future University Hakodate, Ryuku Hisasue. 𝑇 𝑡0 + 𝐿0 −𝐿 + 𝐿f ① ② ③ ④ 【𝒕𝐢𝐧𝐢𝐭 range】 (Where 𝐿r > 𝐿f ). (Where 𝐿r > 𝐿f ). 𝐿r 𝐿init
17. Attack effectiveness 𝑬 is divided into two cases by whether all data transfers are "completed" or not  If the transfer is completed, attack effectiveness 𝐸 is the throughput decrease rate when 𝑛 times RTO happens: 𝐸 = 1 −  If the RTO is over 60 seconds and session timeout happens, i.e., transfer is not completed, 𝐸 is 100%: 𝐸 = 1. Definition of Attack Effectiveness 𝑬 for Evaluation 16 © 2023 Future University Hakodate, Ryuku Hisasue. 𝐿r 𝐿r + 𝑚𝑖𝑛𝑅𝑇𝑂 ⋅ (2𝑛 − 1) .
18.  In the range [−0.3, 0.1], attack effectiveness 𝐸 is high where initial pulse width 𝐿init is 0.3 Expected Result with the Conditions 17 © 2023 Future University Hakodate, Ryuku Hisasue. Attack Start Timing 𝑡init Attack Effectiveness 𝐸 Value of 𝐿init ： 0.3 0.5 0.7 0.9 Timing skew Tolerance 𝐷 Data size is 1MB Throughput is 62Mbps, transfer time is 0.12 sec (without attack ,in average).
19.  The high 𝐸 range is expanded by expanding initial pulse width Expected Result with the Conditions 18 © 2023 Future University Hakodate, Ryuku Hisasue. Attack Start Timing 𝑡init Attack Effectiveness 𝐸 Value of 𝐿init ： 0.3 0.5 0.7 0.9 Data size is 1MB Throughput is 62Mbps, transfer time is 0.12 sec (without attack ,in average).
20. Table of Contents Key Idea Background and Purpose © 2023 Future University Hakodate, Ryuku Hisasue. 19 Verification Experiments Formulation
21. 20 © 2022 Future University Hakodate, Ryuku Hisasue. Hypothesis: By expanding the initial pulse width in the proposed method, the timing skew tolerance for short transfers can be improved. Verification: Expand the initial pulse width, and shift the attack start timing for each initial pulse width to generate an extraneous skew and measure the timing skew tolerance. Hypotheses and Evaluation Methods
22. Topology Scenario 1. From the timing of when Sender starts sending data, Attacker sends attack traffic to Receiver 2. Congestion happens because of attack traffic is queued on router buffer 3. Observer node captures the packets for evaluation (𝑁 = 20) Experiment Setup © 2023 Future University Hakodate, Ryuku Hisasue. Ave. RTT between Sender and Receiver is 0.977ms (w/o attack) ※ Experiments were conducted in a real environment, not in a simulator ※ Bandwidth is virtually limited by tc command Bottleneck Link 60 300 1000 21
23. 22 © 2022 Future University Hakodate, Ryuku Hisasue. Experimental procedure: ① Start attack at 𝑡init [－0.9, 0.9] sec from start of target traffic ② The data size of target traffic are 1, 3, 5 MB ③ Initial pulse width are 0.3 sec (same as Shrew method) and 0.5, 0.7, 0.9 sec that is corresponding to the proposed method ④ Change 𝑡init by 0.1 sec, and transfer the data 20 times respectively ⑤ Calculate the timing skew tolerance 𝐷 using following equation 𝐷 = 𝑡max − 𝑡min ※ 𝑡max and 𝑡min are maximum and minimum 𝑡init in the range where 𝐸 is above a specific threshold 𝐸th = 0.7. Evaluation of Timing Skew Tolerance
24. 23 © 2022 Future University Hakodate, Ryuku Hisasue. Evaluation of Timing Skew Tolerance Experimental procedure: ① Start attack at 𝒕𝐢𝐧𝐢𝐭 [－0.9, 0.9] sec from start of target traffic ② The data size of target traffic are 1, 3, 5 MB －0.9 0.9 Regular traffic starts at 𝑡 = 0
25. 24 © 2022 Future University Hakodate, Ryuku Hisasue. Where 𝑡init = −0.5 －0.5 Evaluation of Timing Skew Tolerance Experimental procedure: ① Start attack at 𝒕𝐢𝐧𝐢𝐭 [－0.9, 0.9] sec from start of target traffic ② The data size of target traffic are 1, 3, 5 MB －0.9 0.9
26. 25 © 2022 Future University Hakodate, Ryuku Hisasue. Evaluation of Timing Skew Tolerance Experimental procedure: ① Start attack at 𝒕𝐢𝐧𝐢𝐭 [－0.9, 0.9] sec from start of target traffic ② The data size of target traffic are 1, 3, 5 MB Where 𝑡init = 0.0 －0.9 0.9
27. 26 © 2022 Future University Hakodate, Ryuku Hisasue. Evaluation of Timing Skew Tolerance Experimental procedure: ① Start attack at 𝑡init [－0.9, 0.9] sec from start of target traffic ② The data size of target traffic are 1, 3, 5 MB Where 𝑡init = 0.0 －0.9 0.9 1MB 3MB 5MB
28. 27 © 2022 Future University Hakodate, Ryuku Hisasue. Evaluation of Timing Skew Tolerance Experimental procedure: ③ Initial pulse width are 0.3 sec (same as Shrew method) and 0.5, 0.7, 0.9 sec that is corresponding to the proposed method Shrew Method Fawe-Shrew Method（Proposal） Init-Pulse
29. 28 © 2022 Future University Hakodate, Ryuku Hisasue. Evaluation of Timing Skew Tolerance Experimental procedure: ③ Initial pulse width are 0.3 sec (same as Shrew method) and 0.5, 0.7, 0.9 sec that is corresponding to the proposed method Shrew Method Fawe-Shrew Method（Proposal） Init-Pulse
30. 29 © 2022 Future University Hakodate, Ryuku Hisasue. Evaluation of Timing Skew Tolerance Experimental procedure: ④ Change 𝑡init by 0.1 sec, and transfer the data 20 times respectively ⑤ Calculate the timing skew tolerance 𝐷 using following equation 𝐷 = 𝑡max − 𝑡min ※ 𝑡max and 𝑡min are maximum and minimum 𝑡init in the range where 𝐸 is above a specific threshold 𝐸th = 0.7. Attack Start Timing 𝑡init Attack Effectiveness 𝐸
31. Similarity of Calculated and Real Data 30 © 2023 Future University Hakodate, Ryuku Hisasue. Attack Start Timing 𝑡init Attack Start Timing 𝑡init Data size：1MB Without attack ・Throughput ：62Mbps ・Transfer time：0.12 sec (in average) Data size：3MB Without attack ・Throughput ：73Mbps ・Transfer time：0.31 sec (in average) Data size：5MB Without attack ・Throughput ：79Mbps ・Transfer time：0.48 sec (in average) ※ In right figure, we used following value as 𝑛 for calculating 𝐸： [Cond. A] 𝑛 = 2，[Cond. B] 𝑛 = 1 Value of 𝐿init ： 0.3 0.5 0.7 0.9 Attack Effectiveness 𝐸 Attack Effectiveness 𝐸 Attack Effectiveness 𝐸 Test-bed network data Calculated data
32. Similarity of Calculated and Real Data 31 © 2023 Future University Hakodate, Ryuku Hisasue. Data size：1MB Without attack ・Throughput ：62Mbps ・Transfer time：0.12 sec (in average) Data size：3MB Without attack ・Throughput ：73Mbps ・Transfer time：0.31 sec (in average) Attack Start Timing 𝑡init Attack Start Timing 𝑡init Data size：5MB Without attack ・Throughput ：79Mbps ・Transfer time：0.48 sec (in average) Value of 𝐿init ： 0.3 0.5 0.7 0.9 ※ In right figure, we used following value as 𝑛 for calculating 𝐸： [Cond. A] 𝑛 = 2，[Cond. B] 𝑛 = 1 Attack Effectiveness 𝐸 Attack Effectiveness 𝐸 Attack Effectiveness 𝐸 Test-bed network data Calculated data
33. 32 © 2023 Future University Hakodate, Ryuku Hisasue. Data Size Ave. Transfer Time (w/o attack) Initial Pulse Width 𝑳𝐢𝐧𝐢𝐭 Observed 𝑫 Calculated 𝑫𝐜𝐚𝐥𝐜 Diff. (𝑫 − 𝑫𝐜𝐚𝐥𝐜 ) 1MB 0.12 𝟎. 𝟑 𝟎. 𝟒 𝟎. 𝟒 𝟎. 𝟎 0.5 0.6 0.6 0.0 0.7 𝟎. 𝟖 𝟎. 𝟖 𝟎. 𝟎 0.9 1.0 1.0 0.0 3MB 0.31 𝟎. 𝟑 𝟎. 𝟐 𝟎. 𝟐 𝟎. 𝟎 0.5 0.3 0.4 −0.1 0.7 𝟏. 𝟎 𝟏. 𝟎 𝟎. 𝟎 0.9 1.1 1.2 −0.1 5MB 0.48 𝟎. 𝟑 𝟎. 𝟎 𝟎. 𝟐 −0.2 0.5 0.4 0.4 0.0 0.7 1.1 0.6 0.5 0.9 𝟏. 𝟏 𝟏. 𝟏 𝟎. 𝟎 Timing Skew Tolerance 𝑫 with Pulse Width 𝑳𝟎 x 2 x 5 x 5 Improved Skew Tolerance in 𝑋 times over Conventional as with the Model
34. We confirmed the proposed method can expand the timing skew tolerance  Conventional Shrew is difficult to succeed attacking against short transfers  Proposed method expands the initial pulse width  Modeled and Formulated the attack effectiveness  Conducted experiment and well matched the result between formulated and actual result Conclusion 33 © 2023 Future University Hakodate, Ryuku Hisasue. Proposed Fawe-Shrew method is effective against short transfers
35. Abstract  Background : No work of LDoS Attacks against Short transfers  Purpose : Discovering LDoS method for short transfers  Research Task : Shrew method uses pulse shaped traffic, thus timing estimation is required for cause RTO  Proposal : Fawe-Shrew method, which is wide initial pulse of Shrew method, and improve timing skew tolerance Contributions  We confirmed that the proposed Fawe-Shrew method has increased the performance of timing skew tolerance in the attack initiation timing  We showed that the proposed model is correct especially in short transfer duration, using test-bed network with actual equipment Summary 34 © 2023 Future University Hakodate, Ryuku Hisasue.