Извините, этот техт доступен только в “Американский Английский”. For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.
NETWORK ANOMALY DETECTION BASED ON FLOW INTENSITY MEASURING IN THE DECAY MODEL FOR DDOS PROTECTION
Dmitriy A. Yakovlev, MTUCI, Moscow, Russia, bombermag@gmail.com
Irina S. Sineva, MTUCI, Moscow, Russia, iss@mtuci.ru
Abstract
This article discusses the problem of detecting network anomalies in the context of protecting a web server against (D)DoS attacks aimed at the exhaustion of the server resources. The solution of the problem is necessary to ensure the correct performance of network applications. At one stage in a multi-step security process, it is necessary to monitor the intensity of incoming requests and pay special attention to cases where the intensity exceeds a specified threshold. To measure the intensity, a decay model was chosen, which is a kind of exponential moving average and describes the phenomenon of decay of a radioactive substance, therefore so named.
Among the criteria for the selection of the algorithm, speed and economy of RAM consumption were important, because evaluation should be possible in real time and for a large number of different request types. The selected algorithm allows to store only one counter value in RAM for the flow, and the intensity estimate is made at the required time point by the accumulated value. In the absence of events, the counter value for the flow decreases exponentially in time and approaches zero, which is used to remove data with flow information from memory.
To speed up the calculations, the counter update operation uses a table of the function’s pre-calculated values. In the software implementation, the counter updating procedure consumes ~14 clock cycles of the CPU. To test the algorithm, incoming requests of different visitors were selected on the basis of expert analysis from the web server access logs: active legitimate users, search robots and attackers. For these sessions, an estimate of the intensity of queries based on the decay model was calculated. The result allows us to say that this algorithm can be used for the task in hand. In order to protect against attacks, abnormal sessions can be directed to an additional classifier designed to determine user legitimacy based on other criteria.
Keywords: network anomaly, rate detection, decay model, web server, DDoS attacks, network attacks detection.
References
1. ‘Q3 2017 State of the Internet – Security Report’ (2017) Akamai. Available at: https://www.akamai.com/de/de/multimedia/documents/state-of-the-internet/q3-2017-state-of-the-internet-security-report.pdf (Accessed: 2 February 2018).
2. Halimenko A., Kupreev O., Ilganaev K. (2017). DDoS attacks in the third quarter of 2017. Kaspersky Lab. Available at: https://securelist.ru/ddos-attacks-in-q3-2017/87918/ (Accessed: 2 February 2018).
3. Shvorin A. (2017). Rate detection, or incoming event stream intensity measuring in the decay model. Qrator Labs. Available at: https://medium.com/@qratorlabs/rate-detector-21d12567d0b5 (Accessed: 30 January 2018).
4. Yakovlev D.A., Sineva I.S. (2016). Building virtualized system using Intel DPDK for filtering spoofed network packets. T-Comm.
Vol. 10. No.8, pð. 30-35.
5. Sheluhin O.I., Sakalema D.J., Filinova A.S. (2013). Intrusion detection into computer networks. Network anomalies. Moscow: Hotline – Telecom. 220 p.
6. Yakovlev D.A., Sineva I.S. (2015). DoS-attack detection using genetic algorithm and fuzzy logic. Fundamental probles of radioelectronics. Proceedings of the International Scientific and Technical Conference «INTERMATIC-2015». Vol. 15. No. 5, pp. 288-291.
7. Yakovlev D.A., Sineva I.S. (2017). Web robots detection based on Bayesian network’. Information Society Technologies. Proceedings of the XI-th International Industrial Scientific and Technical Conference «Information Society Technologies. Moscow: Media Publisher,
pp. 292-293.
Information about authors:
Dmitriy A. Yakovlev, post graduate student of MTUCI, Moscow, Russia
Irina S. Sineva, associate professor of MTUCI, Moscow, Russia