銆愬璇汇?澶氭暟鐨勮拷韪妧鏈兘鏄粠鏈?帴杩憊ictim鐨勮矾鐢卞櫒寮?锛岀劧鍚庡紑濮嬫鏌ヤ笂娴佹暟鎹摼锛岀洿鍒版壘鍒版敾鍑绘祦閲忓彂璧锋簮銆?br />
Chain-level test (Link Testing)
澶氭暟鐨勮拷韪妧鏈兘鏄粠鏈?帴杩憊ictim鐨勮矾鐢卞櫒寮?锛岀劧鍚庡紑濮嬫鏌ヤ笂娴佹暟鎹摼锛岀洿鍒版壘鍒版敾鍑绘祦閲忓彂璧锋簮銆?Ideally, this process can be recursive implementation of the attack until you find the source. This technique assumed attack remains active until the completion of tracking, it is difficult after the attack, intermittent attacks or attacks on the track adjustment to track. Including the following two chain-level testing:
1銆両nput debugging
Many routers offer Input debugging features, which allow administrators to filter certain number of exit data packets, and can decide who can reach the entrance.杩欑鐗规?灏辫鐢ㄦ潵浣渢raceback锛氶鍏堬紝victim鍦ㄧ‘瀹氳鏀诲嚮鏃讹紝瑕佷粠鎵?湁鐨勬暟鎹寘涓弿杩板嚭鏀诲嚮鍖呮爣蹇椼? Through these signs in the upper reaches of the outlet manager configuration suitable Input debugging. This filter will reflect the relevant input port, the filtration process can continue in the upper class, until to reach the original source. Of course, a lot of this work by hand, some foreign ISP tools for the joint development of their network can automatically follow-up.
浣嗘槸杩欑鍔炴硶鏈?ぇ鐨勯棶棰樺氨鏄鐞嗚姳璐广? Multiple ISP links and cooperation with them will take time. Therefore, this approach requires a lot of time, and almost impossible.
2, Controlled flooding
Burch and Cheswick proposed method.杩欑鏂规硶瀹為檯涓婂氨鏄埗閫爁lood鏀诲嚮锛岄?杩囪瀵熻矾鐢卞櫒鐨勭姸鎬佹潵鍒ゆ柇鏀诲嚮璺緞銆?First of all, there should be an upper road map, when under attack, they can start from the victim's upstream routers in accordance with road map on the upstream routers to control the flood, because the data packets with attack-initiated packet router also shared, thus increasing the possibility of the router packet loss. Through this continued up along the road map for, we can close the source of attacks launched.
This idea is very creative but also very practical, but there are several drawbacks and limitations. The biggest drawback is that this approach is itself a DOS attack, it will also carry out some of the trust path DOS, this shortcoming is also difficult procedure.鑰屼笖锛孋ontrolled flooding瑕佹眰鏈変竴涓嚑涔庤鐩栨暣涓綉缁滅殑鎷撴墤鍥俱? Burch and Cheswick also pointed out that this approach could be used for DDOS attacks on the track. This method can only be effective on the ongoing situation in the attack.
CISCO router is CEF (Cisco Express Forwarding) is actually a kind of chain-level test, that is, to use CEF up to the final source, then the link on the router had to use CISCO routers, and support CEF. Must be Cisco 12000 or 7500 series router has. (Do not know how, do not check the latest CISCO document), but the use of this feature is very cost resources.
In the CISCO router (ip source-track support for the router) the IP source tracking in order to achieve the following steps:
1, when the purpose was found to be attacked, opened on the router the destination address of the track, enter the command ip source-track.
2銆佹瘡涓狶ine Card涓鸿杩借釜鐨勭洰鐨勫湴鍧?垱寤虹壒瀹氱殑CEF闃熷垪銆傚浜巐ine card鎴栬?绔彛閫傞厤鍣ㄧ敤鐗瑰畾鐨凙SIC浣滃寘杞崲锛孋EF闃熷垪鐢ㄤ簬灏嗗寘缃叆line card鎴栬?port adapter鐨凜PU銆?br />
3, each line card CPU collect information to track the purpose of communication
4, the timing data generated by export to the router. Be realistic summary of the flow of information, enter the command: show ip source-track summary. Each input interface to display more detailed information, enter the command show ip source-track
5, statistical tracking of IP addresses is a breakdown. This can be used to analyze the upstream router. You can close the current router IP source tracker, enter the command: no ip source-track. And then re-open at the upstream router on this feature.
6, repeat steps 1 through 5, until you find the attack source.
This almost answers securitytest to mention the bar.
Logging
Through this method to record the main data packet router, and then through the data collection techniques to determine the path packets through. While this approach can be used to track the data after the attacks, it also has obvious disadvantages, such as may require significant resources (or sampling), and to deal with large amounts of data synthesis.
ICMP tracking
This approach mainly rely on self-generated ICMP router tracking information. Each router has a very low probability (for example: 1 / 200000), the contents of the packet will be copied to an ICMP message in the package, and contains the information near the source address of the router. When the flood attacks beginning, victim can use ICMP messages to reconstruct the attacker path. In this way comparison with the above description, there are many advantages, but there are some disadvantages.姣斿锛欼CMP鍙兘琚粠鏅?娴侀噺涓繃婊ゆ帀锛屽苟涓旓紝ICMP杩借釜娑堟伅杩樿鍚宨nput debugging鐗规?锛堝皢鏁版嵁鍖呭悓鏁版嵁鍖卛nput绔彛鍜?鎴栬?瑕佸埌杈剧殑MAC鍦板潃鍏宠仈鐨勮兘鍔涳級鐩稿叧锛屼絾鏄紝鍙兘涓?簺璺敱鍣ㄥ氨娌℃湁杩欐牱鐨勫姛鑳姐? At the same time, this approach also must be a way to deal with an attacker could send a forged ICMP Traceback message. In other words, we can approach this way, used in conjunction with other tracking mechanisms to allow more effective. (IETF iTrace)
杩欏氨鏄痽awl璇寸殑IETF鐨勫伐浣滅粍鐮旂┒鐨勫唴瀹癸紝褰撴椂鎴戠粰Bellovin鎻愬嚭涓?簺鎰忚锛屼絾鏄病鏈夊緱鍒扮瓟妗堛? For example:
1, although a random 1 / 20000 to track packages sent, but the package for forgery TRACEBACK cases, the efficiency of the router will have some effect.
2, track packages, and can not solve the counterfeit problem of authentication. To determine whether it is fake because the package, you must go to certification, and increased workload.
3, even with NULL authentication, also serve the purpose of (a certified case). And will not be much affected.
4, itrace purpose is to deal with the original DOS source of the problem of deception, but now the design seems to make us more concerned about the path and not the source. Is the path is more than the source of our problem to solve DOS useful?
绛夌瓑锛岃繕鏈変竴鍫嗛棶棰橈紝閮芥槸鎴戣寰梚Trace灏嗕細闈复鐨勫緢闅惧鐞嗙殑闂銆?br />
Packet Marking
The technology concept (because there is no practical) is to the existing agreement on the basis of changes, and changes very little, not like the idea of iTrace, think better than iTrace.杩欑杩借釜鎶?湳鏈夊緢澶氱粏鑺傜爺绌讹紝褰㈡垚澶氱鏍囪绠楁硶锛屼絾鏄渶濂界殑杩樻槸缁忚繃鍘嬬缉鐨勮竟缂樺彇鏍风畻娉曘?
Principle of this technique is a change in IP header, in which the identification heavy domain. That is, if not used to the identification domain, then this field is defined as the tag.
The 16bit of idnetification into: 3bit the offset (allows 8 slice), 5bit the distance, and the edge of 8bit slice. 5bit the distance allows 31 routes, which for the current network is already enough.
Marking and path reconstruction algorithm is:
Marking procedure at router R: let R'' = BitIntereave(R, Hash(R)) let k be the number of none-overlappling fragments in R'' for each packet w let x be a random number from [0..1) if xlet o be a random integer from [0..k-1] let f be the fragment of R'' at offset o write f into w.frag write 0 into w.distance wirte o into w.offset else if w.distance=0 then let f be the fragment of R'' at offset w.offset write f?w.frag into w.frag increment w.distance Path reconstruction procedure at victim v: let FragTbl be a table of tuples(frag,offset,distance) let G be a tree with root v let edges in G be tuples(start,end,distance) let maxd:=0 let last:=v for each packet w from attacker FragTbl.Insert(w.frag,w.offset,w.distance) if w.distance>maxd then maxd:=w.distance for d:=0 to maxd for all ordered combinations of fragments at distance d construct edge z if d!=0 then z:= z?last if Hash(EvenBits(z))=OddBits(z) then insert edge(z,EvenBits(z),d) into G last:=EvenBits(z); remove any edge(x,y,d) with d!=distance from x to v in G extract path(Ri..Rj) by enumerating acyclic paths in G聽
Under laboratory conditions only victim of such markers can be caught from 1000 to 2500 package will be able to reconstruct the entire path, and should be said that the result is good, but not put to practical, mainly manufacturers and ISP router support needed .
Ip traceback's been almost a practical technology and laboratory techniques, or inanimate, on the main these, although there are other.
For a long time did not engage in a DDOS against it, and the domestic like product have a black hole, previously know some foreign, such as floodguard, toplayer, radware so.鍙梥ecuritytest鎻愮ず锛屽張浜嗚В鍒皉iverhead鐨勶紝鎴戝氨绔嬪埢鐪嬩簡鐪嬩粬浠殑鐧界毊涔︺?
Bigfoot made since the previous main ip traceback subject, securitytest also went to the defense. DDOS problem for ip traceback and Mitigation is not the same, ip traceback main track, mainly because of DDOS spoof, which is difficult to determine the real source of attack, and if the attack is easy to find the real source, not just to deal with DDOS, attacks against the other is also helpful, such as legal issues.鑰孧itigation鏄粠鍙楀鑰呯殑瑙掑害锛屽洜涓簐ictim涓?埇鏄病鏈夎兘鍔涘幓璋冩煡鏁翠釜缃戠粶锛屾壘鍑簊ource锛岃?涓旓紝鍗充究鑳藉鎵惧埌source锛屼篃寰楁湁娉曞緥鎴栬?涓?簺娌熼?鐨勬墜娈垫潵璁﹕ource鍋滀笅鏉ワ紙鏀诲嚮鐨剆ource骞朵笉鏄痵ource鐨勬敾鍑昏?锛夛紝杩欑鎰忓懗鐫?ぇ閲忕殑娌熼?銆佽法ISP銆佽法杩囩瓑绫讳技鐨勯潪鎶?湳闂锛屾墍浠ワ紝閫氬父寰堥毦澶勭悊銆?But from the victim's point of view, have to be a solution, so we need to Mitigation.
杩欏張姝ｅソ鏄垜浠ュ墠鐮旂┒鐨勮寖鍥达紝鎵?互锛屽張浼氳鍑轰竴澶у爢銆傚浜嶮itigation锛屽叾瀹烇紝鎶?湳鐨勬牴鏈氨鏄鑳戒粠浼楀鐨勬祦閲忎腑灏嗘敾鍑诲寘鍜屽悎娉曞寘鍒嗙鍑烘潵锛屾妸鏀诲嚮鍖呮姏寮冩帀锛岃鍚堟硶鍖呴?杩囧氨鎬т簡銆?This is not, so the actual use of technology is to identify how the attack packets as possible, but as small as possible to affect the normal package. This is again to analyze the DDOS (or DOS) of the methods and principles. Basic has the following forms:
1, the system hole formation DOS. This feature fixed, detection and prevention are also easy to
2, protocol attacks (some deal with system-related, some related with the agreement). Such as SYN FLOOD, debris, etc..鐗瑰緛杩樺ソ璇嗗埆锛屾娴嬪拰闃插尽鐩稿瀹规槗銆?Such as SYN COOKIE, SYN CACHE, debris can be discarded. Such as land attack, smurf, teardrop, etc.
3, bandwidth FLOOD. Waste flow plug-bandwidth, feature poor recognition, defense is not easy
4, the basic legal FLOOD. More difficult than three, such as distribution of Slashdot.
Real DDOS, usually combining a variety of ways. For example SYNFLOOD, may also be bandwidth FLOOD.
The main factors that affect the defense is to see whether the features available, such as 1,2 relatively easy to solve, some of the basic does not affect the use of the FLOOD, it can well be abandoned, such as ICMP FLOOD. However, the attack packets if contracting tools to better package disguised as legitimate, it is difficult to identify out.
Mitigation methods in general is:
1, Filter. For obvious characteristics, such as some worms, the router can handle that. Of course, the filter is the ultimate solution, as long as the identification of the attack packets, it is to filter out these packets.
2, random packet loss. Associated with the random algorithm, a good algorithm can make the legitimate packets are less affected
3, SYN COOKIE, SYN CACHE other specific defensive measures. For some regular means of defense and attack filtering. For example ICMP FLOOD, UDP FLOOD. SYN COOKIE are all to avoid spoof, at least there are three TCP handshake, so better to judge SPOOF
4, passive neglect. It can be said to be deceived is also a way to confirm that. The normal connection fails will try again, but the attackers generally do not try.鎵?互鍙互涓存椂鎶涘純绗竴娆¤繛鎺ヨ姹傝?鎺ュ彈绗簩娆℃垨鑰呯涓夋杩炴帴璇锋眰銆?br />
5, take the initiative to send a RST. Against SYN FLOOD, such as on a number of IDS.褰撶劧锛屽疄闄呬笉鏄湁鏁堢殑銆?br />
6, statistical analysis and fingerprints. It would have been the main content, but in the end the algorithm into a dead end, because the main problem is an algorithm. Through statistical analysis point of view to get the fingerprint, and then to abandon the attack fingerprint package is also a anomaly detection technology. Very simple, but it is not easy to affect the legal package, and will not become a random packet loss. 锛堝叾瀹炲綋鏃惰?铏戝お杩囧鏉傦紝闈炲緱瑕佽缁嗗垎鏋愬嚭鏀诲嚮鍖呭拰鍚堟硶鍖咃紝瀹為檯涓嶉渶瑕侊紝鍙杩囨护鎺夎冻澶熺殑鏀诲嚮鍖咃紝鍗充究璁╂敾鍑诲寘閫氳繃锛屼絾鍙涓嶉?鎴怐OS灏卞彲浠ヤ簡銆傦級杩欎篃鏄緢澶氱爺绌惰?鐮旂┒鐨勪富瑕佽棰橈紝鐩殑涔熷氨鏄瘑鍒敾鍑诲寘銆?br />
Now back to securitytest mentioned riverhead. On the riverhead of the technology, I have just learned from their white paper on, but based on my analysis methods did not exceed the above-mentioned range.
riverhead's core program is the detection of Detection, transfer Diversion and mitigation Mitigation, which is to detect attacks, and then transferred to the traffic guard on their products, and then guard for Mitigation.
瀹冪殑瀹炵幇姝ラ锛屽氨鏄細
鍥犱负娌℃湁鍥撅紝鎵?互鍏堝畾涔変竴涓嬶紝鎵嶈兘璇存竻妤氾細
# Source close to distributed denial of service for the remote router routers
# Close to the victim's router to router proximal
#Riverhead鐨凣uard璁惧闄勫睘瀹夎鐨勮矾鐢卞櫒涓?闄勫睘璺敱鍣?br />
Defense steps
1, first detected in a DDOS place and understand the victim
2銆丟uard鍙戦?BGP閫氬憡鍒拌繙绔矾鐢卞櫒锛堝湪victim鐨凚GP閫氬憡璁剧疆鍓嶇紑锛屽苟寰楀埌姣斿師濮婤GP閫氬憡鏇撮珮鐨勪紭鍏堟潈锛夛紝琛ㄧず浠庤繙绔矾鐢卞櫒鍒皏ictim鏈夋柊鐨勮矾鐢憋紝骞朵笖璺敱鍒癎uard鐨刲oopback interface锛屾墍鏈夊埌victim鐨勯兘缁忚繃闄勫睘璺敱鍣ㄨ浆绉诲埌浜咷uard涓?br />
3, Guard inspection flow, and remove one of the attack traffic, and then forwarded to the traffic safety sub router, in the back victim
The core is the Guard, technology is described in the MVP architecture white paper (Multi-Verification Process), which is five levels below
Filter (Filtering): This module contains the static and dynamic DDOS filtering.闈欐?杩囨护锛屾嫤鎴猲on-essential娴侀噺锛屽彲浠ユ槸鐢ㄦ埛瀹氫箟鐨勶紝鎴栬?鏄痳iverhead榛樿鎻愪緵鐨勩? Dynamic filtering is based on the details of behavior analysis and flow analysis, by increasing the flow of the recognition of suspicious or malicious traffic blocking has been confirmed to be real-time updates
Anti-cheat (Anti-Spoofing): This module verify whether the packet into the system to be deceived. Guard uses a unique, patented source verification mechanism to prevent cheating. Also adopted a mechanism to confirm the legitimate flow of legitimate data packets to be discarded to eliminate
Anomaly detection (Anomaly Recognition): The module monitors all anti-cheat has not been filtered and discard the flow module, the flow records with the normal baseline behavior, it is found abnormal.鍩烘湰鍘熺悊灏辨槸閫氳繃妯″紡鍖归厤锛屽尯鍒潵鑷猙lack-hat鍜屽悎娉曢?璁箣闂寸殑涓嶅悓銆?The principle used to identify the attack source and type, and proposed guidelines for interception of such traffic.
寮傚父妫?祴鍖呮嫭锛?鏀诲嚮娴侀噺閫熺巼澶у皬 鍖呭ぇ灏忓拰绔彛鐨勫垎甯?鍖呭埌杈炬椂闂寸殑鍒嗗竷 骞跺彂娴侀噺鏁?楂樼骇鍗忚鐗瑰緛 鍑恒?鍏ョ殑閫熺巼 娴侀噺鍒嗙被锛?婧怚P 婧愮鍙?鐩殑绔彛 鍗忚绫诲瀷 杩炴帴閲忥紙姣忓ぉ銆佹瘡鍛級
鍗忚鍒嗘瀽锛圥rotocol Analysis锛夛細鏈ā鍧楀鐞嗗紓甯告娴嬩腑鍙戠幇鐨勫彲鐤戠殑搴旂敤鏂归潰鐨勬敾鍑伙紝姣斿http鏀诲嚮銆?Protocol analysis also detected a number of agreements misconduct.
Traffic restrictions (Rate Limiting): mainly those who consume too many resources dealing with the source of traffic.
So, in fact the most important content is in the statistical analysis of anomaly detection, but it seems not much to see from the above special place, but must have a good algorithm. Such as FILTER, actually deal with some very familiar features of obvious attacks, anti-cheating is against syn flood like this, perhaps also a syn cookie module, but may have more patented technologies. Protocol analysis should in fact is relatively weak, but can be common agreement on some specific attacks, protocol error detection and identification of some acts simply agreed to check that this is very simple. Traffic restrictions are that a random packet loss, the most helpless way, so the final level.
Because this product is mainly for Mitigation, not ip traceback. But can be determined or there are important issues, such as:
1銆佸浣曞浠樼湡姝ｇ殑bandwidth flood銆?If the router is gigabit, but attacks have accounted for 90% of the traffic, only to shed 10% of the legitimate use, the router has first started with random packet loss of the Guard. (No way, this is the bottleneck of all defense technology)
2, the real attack. The real attack is difficult or not identifiable.姣斿锛屽熀鏈窡姝ｅ父褰㈠紡涓?牱鐨勶紝濡傛灉鍜岀粺璁℃暟鎹緢鎺ヨ繎锛岄偅涔堝緢闅惧尯鍒嚭鏉ャ? Some attacks, such as reflective of the e-mail attacks, it is perfectly legal, but very hard to classify them.
相关链接:
Convert .flac to mp3
Swf file
Ninth Zhongguancun Computer Festival was OFFICIALLY opened
How to convert m4v to mp4
Simple Site ADMINISTRATION
Review Password Managers
Issuing 3G licenses will be postponed to the end of 2007
LIU: a play from the acting to the private equity fund non-plague
"Two-way referral" good medical care Recovery mode
Produced Using Flash MX Components Quiz
Iphone Video Format
JSP tag library analysis
TechTarget BtoB Magazine named "Media 50" ranked sixth
CES Show for the first time to advertise IN Facebook and YouTube
FTP CLIENTS Directory
No comments:
Post a Comment