한국시뮬레이션학회논문지 (Journal of the Korea Society for Simulation)

한국시뮬레이션학회 (The Korea Society for Simulation)
권호 표지
DOI QR코드

DOI QR Code

False Alarm Rate 변화에 따른 DoS/DDoS 탐지 알고리즘의 성능 분석

Performance Analysis of DoS/DDoS Attack Detection Algorithms using Different False Alarm Rates

  • 장범수 (한양대학교 전자컴퓨터통신공학과) ;
  • 이주영 (서경대학교 전자공학과) ;
  • 정재일 (한양대학교 전자컴퓨터통신공학과)
  • 투고 : 2010.10.11
  • 심사 : 2010.12.13
  • 발행 : 2010.12.31
PDF 다운로드
⟨ 이전 논문 다음 논문 ⟩

초록

인터넷은 확장성과 최선형 라우팅 서비스를 목적으로 설계되었기 때문에 보안상에 취약점을 가진다. 이에 IP spoofing과 DoS/DDoS 공격을 탐지하기 위한 다양한 공격 탐지 방법들이 제안되었다. DoS/DDoS 공격은 공격이 시작되고 짧은 시간 내에 목적을 이루기 때문에 공격 탐지 알고리즘들은 빠른 시간 내에 정확한 탐지를 하는 것이 중요하다. 공격 탐지 알고리즘들은 미탐지율과 오탐지율로 이루어진 오경고율을 가지며 공격 탐지 알고리즘의 성능을 평가하는 중요한 요소가 된다. 본 논문에서는 공격 탐지 알고리즘의 특징을 살펴보고 그 성능을 분석하였다. 공격 탐지 알고리즘의 성능은 미탐지율과 오탐지율을 변화시켰을 시, 공격 트래픽 및 일반 트래픽에 미치는 영향을 시뮬레이션을 통해 각각 분석하였다. 이를 통해 전송되는 공격 패킷의 수는 미탐지율에 비례하며, 전송되는 일반 패킷의 수는 일정 치 이하의 미탐지율과 오탐지율에 반비례하는 것을 확인하였다. 또 공격 탐지 알고리즘의 미탐지율 변화에 따른 오탐지율의 변화를 분석하여 미탐지율과 오탐지율의 관계를 도출하고 공격탐지 알고리즘의 한계를 분석하였다. 이러한 한계를 극복하기 위해 정확한 네트워크 상태를 판단하여 공격 탐지 알고리즘의 한계를 줄이고 성능을 개선하는 방안을 제안하였고 그 결과, 공격 탐지 알고리즘의 성능이 보다 향상됨을 확인하였다.

Internet was designed for network scalability and best-effort service which makes all hosts connected to Internet to be vulnerable against attack. Many papers have been proposed about attack detection algorithms against the attack using IP spoofing and DoS/DDoS attack. Purpose of DoS/DDoS attack is achieved in short period after the attack begins. Therefore, DoS/DDoS attack should be detected as soon as possible. Attack detection algorithms using false alarm rates consist of the false negative rate and the false positive rate. Moreover, they are important metrics to evaluate the attack detections. In this paper, we analyze the performance of the attack detection algorithms using the impact of false negative rate and false positive rate variation to the normal traffic and the attack traffic by simulations. As the result of this, we find that the number of passed attack packets is in the proportion to the false negative rate and the number of passed normal packets is in the inverse proportion to the false positive rate. We also analyze the limits of attack detection due to the relation between the false negative rate and the false positive rate. Finally, we propose a solution to minimize the limits of attack detection algorithms by defining the network state using the ratio between the number of packets classified as attack packets and the number of packets classified as normal packets. We find the performance of attack detection algorithm is improved by passing the packets classified as attacks.

키워드

참고문헌

  1. Tao PENG, Christopher Leckie, and Kotagiri Ramamo hanarao, "Survey of Network-Based Defense Mechanisms Countering the DoS and DDoS Problems," ACM Computing Surveys, vol. 39, no. 1, 2007.
  2. Jelena Mirikovic, and Peter Reiher, "A Taxonomy of DDoS Attack and DDoS Defense Mechanisms," ACM SIGCOMM Computer Communications Review, vol. 34, no. 2, pp. 39-53, Apr. 2004. https://doi.org/10.1145/997150.997156
  3. Rocky K. C. Chang, "Defending against Flooding-Based Distributed Denial-of-Service Attacks: A Tutorial," Communications Magazine, IEEE, vol. 40, no. 10, pp. 42-51, Oct. 2002. https://doi.org/10.1109/MCOM.2002.1039856
  4. Glenn Carl, George Kesidis, Richard R. Brooks, and Suresh Rai, "Denial-of-Service Attack-Detection Techniques," IEEE Internet Computing, vol. 10, no. 1, pp. 82- 89, Jan.-Feb. 2006.
  5. Amey Shevtekar, Karunakar Anantharam, and Nirwan Ansari, "Low Rate TCP Denial-of-Service Attack Detection at Edge Routers," IEEE Communications Letters, vol. 9, no. 4, pp. 363-365, Apr. 2005. https://doi.org/10.1109/LCOMM.2005.1413635
  6. Wei Chen, Dit-Yan Yeung, "Defending Against TCP SYN Flooding Attacks Under Different Types IP Spoofing," Proceedings of the International Conference on Networking, International Conference on Systems and International Conference on Mobile Communications and Learning Technologies, pp. 38, 2006.
  7. Michael Collins, Michael K. Reiter, "An Empirical Analysis of Target-Resident DoS Filters," Proceedings of IE EE Security and Privacy, pp. 103-114, May 2004.
  8. P. Ferguson, and D. Senie, "Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing," RFC 2827, May 2000
  9. Ghosh A, Wong L, Di Crescenzo G, and Talpade R, "In- Filter: predictive ingress filtering to detect spoofed IP traffic," Proceedings of Distributed Computing Systems Workshops, pp. 99-106, Jun. 2005.
  10. Mirkovic J, and Prier G,Reiher P, "Attacking DDoS at the source," Proceedings of IEEE International Conference on Network Protocols, pp. 312-321, 2002.
  11. Haggerty J, Qi Shi, and Merabti M, "Early detection and prevention of denial-of-service attacks: a novel mechanism with propagated traced-back attack blocking," IEEE Selected Areas in Communications, vol. 23, no. 10, pp. 1994-2002, Oct. 2005. https://doi.org/10.1109/JSAC.2005.854123
  12. Tu Xu, Da Ke He, and Yu Zheng, "Detecting DDOS Attack Based on One-Way Connection Density," Proceedings of IEEE International Conference on Communication systems, pp. 1-5, Oct. 2006.
  13. Bremler-Barr, and A,Levy, H, "Spoofing prevention method," Proceedings of IEEE INFOCOM 2005, vol. 1, pp. 536-547, Mar. 2005.
  14. Siaterlis C, and Maglaris V, "Detecting incoming and outgoing DDoS attacks at the edge using a single set of network characteristics," Proceedings of IEEE Symposium on Computers and Communications, pp. 469-475, Jun. 2005.