Cindy WANG CNNIC 5 Nov. 2009, Beijing

Transcription

1 Cindy WANG CNNIC 5 Nov. 009, Beijing

2 Agenda Motivation What we want to earn? How we do it? Concusions and Future work Discussions

3 Agenda Motivation What we want to earn? How we do it? Concusions and Future work Discussions

4 This study is motivated by DNS is important. Compex system made up o thousands o service nodes interacting with each other. Imperect and not error ree. So many known and unknown vunerabiities Decentraized and distributed, uy contro is impossibe.

5 However, we need to Know more about the operation states and situations. Evauate the perormance and reiabiity Predict growth Identiy overoading and abuse Perceive and orecast risks and attacks. At some goba, strategic point, which is easy to depoy.

6 Fortunatey, we have rich data Queries targeting.cn domains Responses rom.cn authoritative name servers Traic data obtained rom some DNS Cache servers Activey probed data

7 Agenda Motivation What we want to earn? How we do it? Concusions and Future work Discussions

8 Is there something unusua reected by DNS? Can we identiy what is happening? Anything wrong or unusua use o the DNS service? Such as name servers as we as Cache servers. Any DNS reated attacks? Important events on both Internet and Web eves. For exampe, the DNS coapse on May, 19, 009. Other events that attract pubic to communicate on the Internet. Can we ocate the source and prevent it rom getting worse? Based on the queries made to.cn root servers, which are easy or coection and depoyment.

9 Agenda Motivation What we want to earn? How we do it? Concusions Discussions

10 Mutivariate covariance anaysis Compare the parameters o the observed query stream with the norma DNS query stream. The anomay is decared once a deviation rom a norma traic is observed. Does not rey upon any presumptions on the norma network packets distributions o DNS.

11 Rationae Characteristics o an inormation system such as DNS coud be described by the correations among its eatures. In terms o correation, the norma patterns wi be dierent rom the abnorma ones. Thereore, the correation may be seected as a change indicator, and any changes or abnorma activities wi deinitey change the correation coeicients o these eatures in the norma situations. The correations are expected to be sensitive enough to ag some changes.

12 OVERVIEW OF COVARIANCE ANALYSIS METHOD There are m eatures,. which compose a random vector X ' = (. 1, Let x, ),, x n are the n observed 1 m i i ' vectors, x i = ( 1,, m) is the observed vectors. j, i is the vaue o in the i th observation during the time interva. T,, 1 m j th i th y We deine a new variabe y or time sot : =,1 1,1,1 m, n 1, n, n m

13 OVERVIEW OF COVARIANCE ANALYSIS METHOD (1) = m m m m m m M y σ σ σ σ σ σ σ σ σ The covariance to characterize Distance measuring the change, or the anomay ( ) y y z M E M =

14 Then, how to do it? Characterizes the behavior o the system by choosing appropriate parameters or eatures; Describe the behavior using the covariance matrix or each time interva. Compare the current observed patterns with the norma patterns (mean covariance matrix). I the distance exceeds some threshod, anomay coud be decared.

15 Background: the Baoeng Event Starting rom 1:50 on May 19, 009 Internet users in Jiangsu, Anhui, Henan, Gansu, and Zhejiang, etc severa provinces, reported that they suered sow Internet speed or were unabe to visit some websites. The network aiure was due to a domain name system aiure or the website o a Chinese music payer. The aiure urther caused a surge o DNS server visits and decreased processing perormance or the network.

16 Detais Queries made to.cn authoritative root servers during the period o : :00. Source IP addresses are conversed to originating provinces using Maxmind Geoocation Database. Six (m=6) eatures are constructed: overa query rate, number o queries originated rom Anhui, Jiangsu, Shanxi, Hebei, Zhejiang provinces (the most aected regions reported.) during each time sice.

17 ovariance Matrix Distance cacuated Distances between the covariance matrix and the mean o a covariance matrices under norma situations Change points (Peaks) coincide with the time o the event reported. Around 10pm on 19 May. Major anomaies are identiied by both settings o T. 1 1 T=0 mins T=30 mins Covariance change 6 4 Covariance change : : : : : :00 Beijing time : : : : : :00 Beijing time

18 he query rates o the six provinces Overa Anhui Jiangsu 14 x x Query / min 8 Query / min Query / min : : : : : :00 Beijing time : : : : : :00 Beijing time : : : : : :00 Beijing time Shanxi Hebei Zhejiang x x Query / min Query / min Query / min : : : : : :00 Beijing time : : : : : :00 Beijing time : : : : : :00 Beijing time

19 Another event on 5 th Juy,009 Queries made to.cn authoritative root during the period o : :00. IP addresses are conversed to the originating regions using Maxmind Geoocation Database. Three (m=3) eatures are constructed: number o queries originated rom recursive name servers distributed in Xinjiang, China and word regions outside China. Covariance matrices or each ixed time sice T=0 and T=30 are constructed respectivey.

20 ovariance Matrix Distance Distances between the covariance matrix and the mean o a covariance matrices under norma situations Change points (Peaks) occurred with a deay instead o simutaneousy. Major anomaies are identiied by both settings o T T=0 mins T=30 mins Covariance change 6 4 Covariance change : : : : : : :00 Beijing time : : : : : : :00 Beijing time

21 uery oad by Cache Name servers rom Xinjiang 50 Query / min China Outside China : : : : : : :00 Beijing time 5 x x Query / min 3.5 Query / min : : : : : : :00 Beijing time : : : : : : :00 Beijing time

22 What can be done i the anomaies were detected in rea-time? DNS Important recursive servers ocated in the aected regions coud be traced, monitored and anomaies ound. Further more, backup DNS services coud be aunched in time. Web eve Web advertisers woud be happy by attracting much more eyebas during the ush period. For Web governance

23 Agenda Motivation What we want to earn? How we do it? Concusions and Future work Discussions

24 Concusions Mutivariate correation anaysis on the detection o anomaies. In terms o correation, the norma patterns wi be dierent rom the abnorma ones. Detecting the correation changes among dierent eatures coud determine the occurrence o the anomaies. The compexity o the method is inear and makes the on-ine detection practica. Advantage o independence rom packet distribution assumption.

25 Future work Further investigations on which eatures are vaid or suicient or DNS DDoS / Anomay detection. Extensive simuation experiments needed or evauating the detection rate o various known abnormaities or DNS-reated DDos attacks. On the seection o the appropriate observed time interva.

26