Defence mechanisms against computer attacks “Distributed denial of service” type

1. Defence mechanisms against computer attacks“Distributed denial of service” type Prof. Nina Siniagina Research associate 2nd grade Stela Ruseva IPP - Bulgarian Academy of science, Sofia, Bulgaria

2. Abstract: One of the most critical and devastating classes of computer attacks is that of the type Distributed Denial of Service (DDoS), aimed at interfering in the accessibility to information resources. These attacks are accomplished by the combined actions of variety of program components available on Internet hosts. One of the current tasks in the field of computer safety is the development of relevant security methods against DDoS attacks and creating of well-grounded recommendations to choose from for the most effective means in the particular conditions.

3. DDoS attacks

4. Hackers act with the help of Masters and Daemons. Another important moment is that Masters are often servers (always switched on) and a restart of the computer is needed to clear the Master. The detecting of the Daemons follows after one or several Masters have been identified. A Daemon is a program of the Troy Horse type, which is installed on an alien machine (often using the well-known faults in the software). Having been installed on the machines, the Daemons get in touch with one of the Masters and receive commands from it. In this case the attack can be stopped by the neutralization of the Daemons. It is a problem that the computer with the Daemon in it does not suspect anything. The only possible way out of this situation is to handle the control over the Master, but in the most modern versions of software it is used for the realization of distributed attacks. The Daemon may not obey the Master’s commands after the start of the attacks. The latter increases the probability of successful realization of the attack. But there is a drawback for the hacker because he or she will not be able to use this net of Daemons for a further attack.

5. While it is enough to add only a rule for the filtration of the inter-network screen under the Denial of Service (DoS) attack, the distributed attacks need several thousand rules because the attack is carried out by several thousand Daemons simultaneously. Most inter-network screens are not able to process such quantity of rules.

6. The general approach to defense against DDoS attacks includes the realization of the following elements: • Defense against DDoS attacks; • Detection of the attack; • Identifying of the source of attacks; • Counteraction to the attack.

7. 1. Defense against DDoS attacks; The defense includes setting of inter-network screens, testing of the system to make clear the weak points, taking measures to improve the server’s protection, such as ban of all kinds of traffic uncritical to the server, optimization of the net infrastructure, etc.

8. 2. Detection of the attack; Detecting of the fact of the attack on the basis of identification of anomalies in the operation of the server or detecting of misuse, as well as determining of colossal traffic for a definite protocol, unusually high level of loading of the net.

9. 3. Identifying of the source of attacks; Different methods to track the packages are used to identify the origin of the attack when the address of the source has been substituted. It is possible to put these methods into practice when keeping the intermediate knots (in the route tables of routers) of data for passing packages.

10. 4. Counteraction to the attack. To counteract the attack, new rules of filtration are applied, obtained at the stage of identifying of the source. Attempts are made to track out and make harmless the attacking. The most advanced mechanisms for protection provide realization of all these stages.

11. Different classification schemes of the protecting mechanisms have been developed to provide security against DDoS attacks. They structure the objective field of DDoS and make easy the search of ways of protection. CERT organization has developed a number of recommendations and requirements towards Internet users and providers in order to avoid DDoS attacks and to minimize their consequences.

12. Modeling of security against attacks of the Distributed Denial of Service type The effective analysis of the attacks on the computer system and the reactions in answer require a multi-aspect modeling which analyses the structure of the computer network configuration, defining of the weak points, the possibilities for antagonistic attacks. The multi-aspect model can be used as a base for attack in real time. The modeling of the answer can be used as an instrument, estimating analytically the security of networks in the real world. The model presents the components of the network, type of servers, automated places of work, routers and protecting walls, protocols and services.

13. A team of scientists at SPIIRAS (St. Petersburg Institute for Informatics and AutomationofRussianAcademyofSciences)are solving the problem of using multi-agent systems for modeling of complex antagonistic processes in order to protect information in computer networks. A set of different models (analytical, hybrid, imitative on the level of web packets, factual and measured) are used for research modeling.

14. The basic result of the project is a creation of an integrated approach to build information protective systems, operating in aggressive, antagonistic surrounding.

15. This ontology structures the main familiar types of attacks and their relationship. It includes a macro level at which it describes the structural relations of the multitude of attacks and a micro level, at which it describes the realization of the particular attacks in the form of sequences of attacking actions. The upper level of the protective ontology mechanisms against DDoS attacks builds the knots which set the levels of protective mechanisms (system, network and global). At the lower levels of ontology these knots define the particular protective mechanisms.

16. Program and apparatus means of protection against Distributed Denial of Service types of attacks

17. A specialized solution is FloodGuard  This system has detectors on its protected walls, switches and routers. When anomalies appear, the detector instantly raises an alarm and activates the actuators, sending them information about these anomalies, the source of attack, the size of the parasite traffic and the type of the sent packages. The actuators are placed in different segments of the net, on the routers, so that they can constantly follow the traffic and receive data about parasite packets. When parasite packets have been detected, the actuator immediately sends an alarm signal to the preceding module, standing on the way of the traffic before the actuator, the recommendations being activating of filters of the corresponding routers. In this way, the barrier for the avalanche of attacking data is raised and the harmful traffic is blocked temporarily.

18. Intel offers a system, patented by the engineers David Putzolu and Todd Anderson, which modifies the routers in such a way that they automatically react to the alarm signal of the attacked computer It is supposed that the alarm signal contains a copy of the harmful packet. The routers immediately create a new profile (mask) and cut out all similar messages. If it is detected that the harmful message passes through the raised barrier then the alarm signal changes and the barrier is set in such a way that it totally blocks the parasite traffic.

19. Conclusion • Each server (web, ftp, dns) in practice is vulnerable to DDoS attacks. Efficient counteraction to attacks of such kind has not been discovered so far and specialists only give recommendations. • There is a tendency in the last years that people need less and less knowledge to realize attacks of such kind and consequently the system administrator should have more knowledge and skills to protect their net. • It is not easy to avoid DDoS attacks because of difficulties connected with their detection. Determining of the beginning of the attacks of such kind, compared to the normal operation of the server, is defined by a great number of factors, which are unlikely to be identified by a single algorithm for protection.