Journal of Convergence for Information Technology (융합정보논문지)

Convergence Society for SMB (중소기업융합학회)
권호 표지
DOI QR코드

DOI QR Code

Response System for DRDoS Amplification Attacks

DRDoS 증폭 공격 대응 시스템

  • Kim, Hyo-Jong (Dept. of Computers & Media Engineering, Tongmyong University) ;
  • Han, Kun-Hee (Division of Information & Communication Engineering, Baekseok University) ;
  • Shin, Seung-Soo (Dept. of Software Convergence Security, Tongmyong University)
  • 김효종 (동명대학교 컴퓨터미디어공학과) ;
  • 한군희 (백석대학교 정보통신공학부) ;
  • 신승수 (동명대학교 SW융합보안학과)
  • Received : 2020.11.16
  • Accepted : 2020.12.20
  • Published : 2020.12.28
Download PDF
⟨ Previous Next ⟩

Abstract

With the development of information and communication technology, DDoS and DRDoS continue to become security issues, and gradually develop into advanced techniques. Recently, IT companies have been threatened with DRDoS technology, which uses protocols from normal servers to exploit as reflective servers. Reflective traffic is traffic from normal servers, making it difficult to distinguish from security equipment and amplified to a maximum of Tbps in real-life cases. In this paper, after comparing and analyzing the DNS amplification and Memcached amplification used in DRDoS attacks, a countermeasure that can reduce the effectiveness of the attack is proposed. Protocols used as reflective traffic include TCP and UDP, and NTP, DNS, and Memcached. Comparing and analyzing DNS protocols and Memcached protocols with higher response sizes of reflective traffic among the protocols used as reflective traffic, Memcached protocols amplify ±21% more than DNS protocols. The countermeasure can reduce the effectiveness of an attack by using the Memcached Protocol's memory initialization command. In future studies, various security-prone servers can be shared over security networks to predict the fundamental blocking effect.

정보통신기술의 발전에 따라 DDoS와 DRDoS은 지속적으로 보안상 이슈가 되고, 고도화된 기법으로 점차 발전하고 있다. 최근에는 정상 서버의 프로토콜을 이용하여 반사 서버로 악용하는 DRDoS 기법으로 IT 기업들을 위협하고 있다. 반사 트래픽은 정상적인 서버에서 발생되는 트래픽으로 보안장비에서 판별하기가 어렵고 실제 사례에서도 최대 Tbps 까지 증폭되었다. 본 논문에서는 DRDoS 공격에서 사용되는 DNS증폭과 Memcached증폭을 비교 분석한 뒤 공격의 효과를 감소시킬 수 있는 대응방안을 제안한다. 반사 트래픽으로 사용되는 프로토콜은 TCP와 UDP, 그리고 NTP, DNS, Memcached등이 존재한다. 반사 트래픽으로 이용되는 프로토콜 중에서 반사 트래픽의 응답크기가 높은 DNS 프로토콜과 Memcached 프로토콜을 비교분석결과, Memcached 프로토콜은 DNS 프로토콜보다 ±21% 증폭된다. 대응방안은 Memcached 프로토콜의 메모리 초기화 명령어를 사용하여 공격의 효과를 감소시킬 수 있다. 향후 연구에서는 보안에 취약한 다양한 서버들을 보안 네트워크를 통해 공유하여 원천적 차단효과를 전망할 수 있다.

Keywords

References

  1. I. J. Choi, S. C. Na & T. Y. Shim. (2015). Mixed Responses Techniques for Intelligent DDoS Attacks. Proceedings of KIIT Conference, June, 65-67.
  2. N. K. Baik, S. T. Park, S. M. Jin & W. S. Yi. (2003). A study on the network node for guaranteeing availability against traffic overload attack. Korea Institute Of Communication Sciences, 1917-1921.
  3. S. Y. Choi, I. S. Kang & Y. M. Kim. (2013). One-time Session Key based HTTP DDoS Defense Mechanisms. Journal of the Korea Society of Computer and Information, 18(8), 95-104. DOI : 10.9708/jksci.2013.18.8.095
  4. H. S. Lee & J. P. Park. (2016). Respond System for Low-Level DDoS Attack. Korea Academy Industrial Cooperation Society, 17(10), 732-742. DOI : 10.5762/KAIS.2016.17.10.732
  5. H. W. Lee. (2005). Design and Implementation of Traceback Simulator for Distributed Reflector DoS Attack on Computer Network. The Korean Association Of Computer Education, 8(1), 65-72.
  6. M. J. Kim & K. R. Seo. (2014). A Detect and Defense Mechanism of Stateful DRDoS Attacks. Journal of the Institute of Electronics and Information Engineers, 51(5), 127-134. DOI : 10.5573/ieie.2014.51.5.127
  7. M. Kuhrer, T. Hupperich, C. Rossow. T & Holz. (2014). Hell of a Handshake: Abusing TCP for Reflective Amplification DDoS Attacks. USENIX Workshop on Offensive Technologies(WOOT 14).
  8. Y. A. Hur & K. H. Lee. (2015). A Study on Countermeasures of Convergence for Big Data and Security Threats to Attack DRDoS in U-Healthcare Device. Journal of the Korea Convergence Society, 6(4), 243-248. DOI : 10.15207/JKCS.2015.6.4.243
  9. S. J. Choi & J. Kwak. (2018). Enhanced Server Availability for DDoS Amplification Attack Using CLDAP Protocol. Korea Information Processing Society, 7(1), 19-26. DOI : 10.3745/KTCCS.2018.7.1.19
  10. H. S. Choi. H. D. Park & H. J. Lee. (2015). A Study on Amplification DRDoS Attacks and Defenses. Journal of Korea Institute of Information, Electronics, and Communication Technology, 8(5), 429-437. DOI : 10.17661/jkiiect.2015.8.5.429
  11. K. O. Park, D. S. Park & J. K. Lee. (2017). A Countermeasure Structure for Attack of SSDP Amplification Used Mac Address authorization, The Korean Institute of Information Scientists and Engineers, 1109-1111.
  12. D. H. Choi, M. H. Park & Y. I Joo. (2018). DNS Amplification Attacks Defense System for Software-Defined Networks. Korea Institute Of Communication Sciences, 1959-1966.
  13. Y. J. Kim, H. S. Lee & H. K. Choi. (2015). A Study on the Preventing Method against NTP Amplification Attacks. Proceedings of Symposium of the Korean Institute of communications and Information Sciences, 157-158.
  14. K. T. Lee, S. S. Baek & S. J. Kim. (2015). Study on the near-real time DNS query analyzing system for DNS amplification attacks. Journal of the Korea Institute of Information Security And Cryptology, 25(2), 303-311. DOI : 10.13089/JKIISC.2015.25.2.303
  15. W. J Park, K. S. Cho & K. H. Lee. (2015). Platform for collecting and processing the message in real time using the Memcached and MySQL Cluster. Proceedings of Symposium of the Korean Institute of communications and Information Sciences, 1203-1204.
  16. H. J. Kim, J. H. Lee. & S. S. Shin. (2020). A study on Dynamic Analysis for DRDoS Amplification Attacks. Korea Multimedia Society, 23(2), 106-107.