]> attack type unification CMCC
32, Xuanwumen West BeiJing BeiJing 100053 China chenmeiling@chinamobile.com
32, Xuanwumen West BeiJing 100053 China suli@chinamobile.com
Security Area DOTS Informational This document put forward a method to unify DDoS attack type classification and attack definition description, this will help different mitigators to mitigate DDoS attacks together.
Distributed Denial of Service (DDoS) is a type of resource-consuming attack, which exploits a large number of attack resources and uses standard protocols to attack target objects. With the cost of DDoS attack become more cheaper, DDoS attack become more and more frequently, a single mitigator unable to cope with all the DDoS attack, so DOTS come up to solve the problem. From the charter of DOTS working group, it writes that elements may be deployed as part of a wider strategy incorporating multiple points of DDoS detection, classification, traceback and mitigation, both on premise or service provider based. As so far, DDoS classification have not written to DOTS. This draft will from the perspective of the type of DDoS attack to do DDoS classification. Different understanding of DDoS attacks will result in different classification and that's why do we need uniform attack types. At present, telecom operators, cloud service providers and third-party manufacturers have their own anti-ddos solutions.The construction of DDoS attack mitigation and disposal system involves two devices, namely detection equipment and cleaning equipment. In the actual network deployment, the core nodes of the network will deploy detection equipment and cleaning equipment at the same time to detect and dispose attacks. After an alarm is given, the cleaning equipment will be triggered to carry out traffic drainage and cleaning operations. At present, the detection equipment adopts the coarse-grained attack type determination method, which greatly reduces the false alarm rate of attack.Different disposal of cleaning equipment is different for different attack types. For example, TCP attack types can be discarded directly after matching, but HTTP CC Flood can be further determined only after interactive operation is required at the disposal. Interactive operation may be redirection or verification code sending. In the actual environment, there are many manufacturers of detection equipment and cleaning equipment, and each manufacturer has its own definition method of attack type, so it is easy to lead to the same attack, but the field of attack type detected by different equipment manufacturers is different, which may easily lead to disposal confusion. The attack type is inconsistently defined, it is difficult or controversial to judge the ability of test selection of DDoS attack detection and clean equipment. Volume based distributed denial-of-service attack have many types based on different protocol layer, for the service providers to immediately protect their network services from DDoS attacks, DDoS mitigation needs to be automated. DDoS Open Threat Signaling (DOTS) is a protocol to standardize real-time signaling, threat-handling requests, when attack target is under attack, dots client send mitigation request to dots server for help, If the mitigation request contains enough messages of the attack, then the mitigator can respond very effectively. This document recommand a method for attack type unification.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in The readers should be familiar with the terms defined in The terminology related to YANG data modules is defined in In addition, this document uses the terms defined below: used to distinguish between different methods of ddos attack. General definition method, Covers most current attack types.
The existing classification of DDoS attack type is divided into multiple dimensions: by the protocol used, such as SYN Flood, HTTP Flood, ICMP Flood; by attack effect, such as bandwidth occupancy attack, Connection attack, slow attack; by the attack method, such as abnormal message attack, reflection amplification attack; In the above definition of multiple types of attacks, there is partial overlap. Combined with the existing classification of DDoS attack, the consensus of classifying DDoS attack by protocol layer is the highest. This draft of protocol layer is based on the TCP/IP model, the basic classification framework of DDoS attack as follows: Firstly, protocol layer, such as Network layer, transport layer and application layer; Secondly, Protocol and Messaging, Divide by protocol exploited by the attack, Then define the message and port involved in the protocol, User-defined (Protocol+port) format identifies attack types that are not well defined or standardized.Finally, Attack method, defined according to the method used in DDoS attack.
In view of the difference in attack definition, the method of this draft is based on the basic classification framework to standardize the format as follows. [protocol layer] [protocol name] [message name/operation name/port] [attack methods feature description field 1] [attack methods feature description field 2] [attack methods describe the standard field]. Note1: the field of [message name/operation name/port] and [attack methods feature description field 1] and [attack methods feature description field 2] are optional. Note2: [protocol name] and [message name/operation name/port] must contain at least one in the abbreviation. Note3: The fields should be distinguished by the space character. The field of [message name/operation name/port] can have many choices, such as "Get/Post/SYN/ACK/Query/Memcached"; The field of [attack methods feature description field 1 or 2] can represent by "Connection", "Fragment", "Amplification", "Reflection", "Misuse", "BandWidth", or "Slow"; The field of [attack methods describe the standard field] just have two choice, one is "Flood" and the other is "Attack".
The complete DDoS attack definition and the abbreviated definition examples shown as bellow: