Intro. to Attack Traceback

1
Intro. to Attack Traceback

• By Fang Yu
• Email yu.320_at_osu.edu
• Office Boltz 118

2
Internet Attacks

• Denial-of-Attack
• Most prominent/damaging attack on Internet
• Ex Feb. 2000, Yahoo, eBay, Amazon were brought
  down for hours by DDoS attacks
• Worm
• The famous Morris worm in 1988
• Attack on DNS
• Attack on/using routers
• Botnet
• Virus/Spam/Trojan horse
• LOTS of others

3
Security is a top 10 problem of Internet today

• Why is Internet a such insecure environment?
• Well, it was designed this way (not intentionally
  of course)
• What can do?
• Well, trace back and catch the bad guy, that will
  effectively deter other attackers
• Easy said and a LOT harder to do

4
Why a LOT harder to do?

• Internet is a stateless environment
• Attackers can
• Easily spoof source IP address
• Launch attack through a series of
  stepping-stone
• Also, firewall, NAT, mobile IP, etc.
• Tracing the Source of Network Attack A
  Technical, Legal and Societal Problem

5
Traceback problem

• Def. Correctly and quickly identify the origin
  of an (attack) packet.
• Two types of Traceback problem
• IP traceback
• Traceback across stepping-stone
• Attack
• Interactive vs. Machine-driven
• Sporadic vs. Persistent
• Traceback scheme
• Network-base vs. Host-based
• On-line vs. Off-line
• Active vs. Passive

6
Nothing is impossible

• A lot of work in the literature
• Ingress filtering
• Input debugging
• Probabilistic Packet Marking
• Logging (Bloom filter)
• ICMP-traceback messaging
• Active probing
• Note almost all
• Deal with Denial-of-Service attack
• Ask intermediate routers to do extra traceback
  processing of some form

7
We are looking at a very different Traceback
problem

• Distinctions between our work and pervious ones
• NOT on DoS attack, single packet/small number of
  packets attack
• No modification on router, why?
• It is actually harder than dealing with DoS
• Very little work has been done Great opportunity

8
Interested? Get more info.

• Networking Research Lab
• http//www.cse.ohio-state.edu/lee/NRL/
• Internet Security
• http//faa.cse.ohio-state.edu/mediawiki-1.7.1/inde
  x.php/Main_Page
• Traceback Survey
• http//www.cse.ohio-state.edu/yufa/security/trace
  back/traceback.html
• Google it!