attack type unification
draft-chen-dots-attack-type-unification-00

Abstract

This document put forward a method to unify DDoS attack type classification and attack definition description, this will help different mitigators to mitigate DDoS attacks together.

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on April 19, 2020.

Copyright Notice

Copyright (c) 2019 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

Table of Contents

• 1. Introduction
• 2. Terminology
• 3. DDoS Attack Type Classification Framework
• 4. DDoS Attack Definition Description
• 5. Security Considerations
• 6. IANA Considerations
• 7. Acknowledgement
• 8. References
• 8.1. Normative References
• 8.2. Informative References
• Authors' Addresses

1. Introduction

Distributed Denial of Service (DDoS) is a type of resource-consuming attack, which exploits a large number of attack resources and uses standard protocols to attack target objects. With the cost of DDoS attack become more cheaper, DDoS attack become more and more frequently, a single mitigator unable to cope with all the DDoS attack, so DOTS come up to solve the problem.

From the charter of DOTS working group, it writes that elements may be deployed as part of a wider strategy incorporating multiple points of DDoS detection, classification, traceback and mitigation, both on premise or service provider based. As so far, DDoS classification have not written to DOTS. This draft will from the perspective of the type of DDoS attack to do DDoS classification.

Different understanding of DDoS attacks will result in different classification and that's why do we need uniform attack types. At present, telecom operators, cloud service providers and third-party manufacturers have their own anti-ddos solutions.The construction of DDoS attack mitigation and disposal system involves two devices, namely detection equipment and cleaning equipment. In the actual network deployment, the core nodes of the network will deploy detection equipment and cleaning equipment at the same time to detect and dispose attacks. After an alarm is given, the cleaning equipment will be triggered to carry out traffic drainage and cleaning operations. At present, the detection equipment adopts the coarse-grained attack type determination method, which greatly reduces the false alarm rate of attack.Different disposal of cleaning equipment is different for different attack types. For example, TCP attack types can be discarded directly after matching, but HTTP CC Flood can be further determined only after interactive operation is required at the disposal. Interactive operation may be redirection or verification code sending. In the actual environment, there are many manufacturers of detection equipment and cleaning equipment, and each manufacturer has its own definition method of attack type, so it is easy to lead to the same attack, but the field of attack type detected by different equipment manufacturers is different, which may easily lead to disposal confusion. The attack type is inconsistently defined, it is difficult or controversial to judge the ability of test selection of DDoS attack detection and clean equipment.

Volume based distributed denial-of-service attack have many types based on different protocol layer, for the service providers to immediately protect their network services from DDoS attacks, DDoS mitigation needs to be automated. DDoS Open Threat Signaling (DOTS) is a protocol to standardize real-time signaling, threat-handling requests[I-D.ietf-dots-signal-channel], when attack target is under attack, dots client send mitigation request to dots server for help, If the mitigation request contains enough messages of the attack, then the mitigator can respond very effectively. This document recommand a method for attack type unification.

2. Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]

The readers should be familiar with the terms defined in [I-D.ietf-dots-requirements] [I-D.ietf-dots-use-cases]

The terminology related to YANG data modules is defined in [RFC7950]

In addition, this document uses the terms defined below:

Attack Type:

used to distinguish between different methods of ddos attack.

Attack type definition:

General definition method, Covers most current attack types.

3. DDoS Attack Type Classification Framework

The existing classification of DDoS attack type is divided into multiple dimensions: by the protocol used, such as SYN Flood, HTTP Flood, ICMP Flood; by attack effect, such as bandwidth occupancy attack, Connection attack, slow attack; by the attack method, such as abnormal message attack, reflection amplification attack;

In the above definition of multiple types of attacks, there is partial overlap. Combined with the existing classification of DDoS attack, the consensus of classifying DDoS attack by protocol layer is the highest.

This draft of protocol layer is based on the TCP/IP model, the basic classification framework of DDoS attack as follows: Firstly, protocol layer, such as Network layer, transport layer and application layer; Secondly, Protocol and Messaging, Divide by protocol exploited by the attack, Then define the message and port involved in the protocol, User-defined (Protocol+port) format identifies attack types that are not well defined or standardized.Finally, Attack method, defined according to the method used in DDoS attack.

.....................................................................
Protocol layer                     |        
+-------------+     +---------------+      +-----------------+
|Network layer|-----|Transport layer|------|Application layer|
+-------------+     +---------------+      +-----------------+
              |                    |                       |
..............|....................|.......................|.........
Protocol and  |                    |                       |
Messaging     |                    |                       |  
 +---+   +----+         +---+   +---+   +---+      +----+  +---+  +---+
 |...|---|ICMP|         |TCP|---|UDP|---|...|      |HTTP|--|DNS|--|...|
 +---+   +----+         +---+   +---+   +---+      +----+  +---+  +---+
              |                    |                       |
..............|....................|.......................|.........
Attack Method |                    |                       |
              |                    |                       |
+--------------+       +---------------+      +--------------+
|Flood         |       |Flood          |      |Flood         |
|Fragment Flood|       |Fragment Flood |      |Slow attack   |
|...           |       |...            |      |...           |
+--------------+       +---------------+      +--------------+
.....................................................................
            
          

Figure 1: Basic classification framework

4. DDoS Attack Definition Description

In view of the difference in attack definition, the method of this draft is based on the basic classification framework to standardize the format as follows.

[protocol layer] [protocol name] [message name/operation name/port] [attack methods feature description field 1] [attack methods feature description field 2] [attack methods describe the standard field]. Note1: the field of [message name/operation name/port] and [attack methods feature description field 1] and [attack methods feature description field 2] are optional. Note2: [protocol name] and [message name/operation name/port] must contain at least one in the abbreviation. Note3: The fields should be distinguished by the space character.

The field of [message name/operation name/port] can have many choices, such as "Get/Post/SYN/ACK/Query/Memcached"; The field of [attack methods feature description field 1 or 2] can represent by "Connection", "Fragment", "Amplification", "Reflection", "Misuse", "BandWidth", or "Slow"; The field of [attack methods describe the standard field] just have two choice, one is "Flood" and the other is "Attack".

..........................................................................................
|Protocol layer  |Protocol|message name   |attack methods |attack methods |attack methods| 
|                |Name    |/operation name|feature field 1|feature field 2|describe the  |
|                |        |/port          |               |               |standard field|
..........................................................................................
|Network_Layer    | ICMP  |  ------       |  ------       |  ------       | Flood        |
..........................................................................................
|Transport_Layer  | TCP   | SYN           |  ------       |  ------       | Flood        |
..........................................................................................
|Transport_Layer  | UDP   | Memcached     | Reflection    | Amplification | Flood        |
..........................................................................................
|Application_Layer| HTTP  | GET           |  ------       |  ------       | Flood        |
..........................................................................................
            
          

Figure 2: Attack Definition Example

The complete DDoS attack definition and the abbreviated definition examples shown as bellow:

..........................................................................................
| complete DDoS attack definition                              |  abbreviated definition |
..........................................................................................
|Network_Layer ICMP Flood                                      |  ICMP Flood             |
..........................................................................................
|Transport_Layer TCP SYN Flood                                 |  TCP SYN Flood          |
..........................................................................................
|Transport_Layer UDP Memcached Reflection Amplification Flood  |  UDP Memcached Flood    |
..........................................................................................
|Application_Layer HTTP GET Flood                              |  HTTP GET Flood         |
..........................................................................................
            
          

Figure 3: Attack Definition and Abbreviated Definition Example

5. Security Considerations

TBD

6. IANA Considerations

TBD

7. Acknowledgement

TBD

8. References

8.1. Normative References

8.2. Informative References

Authors' Addresses