• KIPS Transactions on Computer and Communication Systems
• /
• v.4 no.4
• /
• pp.135-140
• /
• 2015

The WDSS improves defensive capacity against web application layer DDoS attack by using web cache server and L7 switch which are added on the DDoS shelter system. When web DDoS attack occurs, security agents divert traffic from backbone network to sub-network of the WDSS and then DDoS protection device and L7 switch block abnormal packets. In the meantime, web cache server responds only to requests of normal clients and maintains stable web service. In this way, the WDSS can counteract the web DDoS attack which generates small traffic and depletes server-client session resource. Furthermore, the WDSS does not require IP tunneling because it is not necessary to retransfer the normal requests to original web server. In this paper, we validate operation of the WDSS and verify defensive capability against web application layer DDoS attacks. In order to do this, we built the WDSS on backbone network of an ISP. And we performed web DDoS tests by using a testing system that consists of zombie PCs. The tests were performed by three types and various amounts of web DDoS attacks. Test results suggest that the WDSS can detect small traffic of the web DDoS attacks which do not have repeat flow whereas the formal DDoS shelter system cannot.

• Annual Conference of KIPS
• /
• 2013.05a
• /
• pp.614-617
• /
• 2013

DDoS 대피소 시스템은 백본 네트워크의 연동구간에서 공격 대상 서버로 유입되는 DDoS 트래픽의 경로를 변경하여 공격성 패킷은 차단하고 정상적인 패킷은 원래의 경로로 전송함으로써 서비스의 연속성을 보장하는 보안 시스템이다. 본 논문에서는 일반적인 DDoS 대피소 시스템의 구성에 L7 스위치와 웹 캐시서버를 추가적으로 구성하고 클라이언트의 요청을 웹 캐시서버에서 처리하도록 하여 소규모 트래픽을 이용한 웹 어플리케이션 계층 세션 고갈형 DDoS(Web DDoS) 공격을 효과적으로 방어할 수 있으며, IP 터널링 없이도 서비스를 지속할 수 있는 L7 계층 Web DDoS 대피소 시스템을 제안한다.

• The KIPS Transactions:PartC
• /
• v.10C no.3
• /
• pp.253-264
• /
• 2003

This paper presents the analytic model of Distributed Denial-of-Service (DDoS) attacks in two settings: the normal Web server without any attack and the Web server with DDoS attacks. In these settings, we measure TCP flag rate, which is expressed in terms of the ratio of the number of TCP flags, i.e., SYN, ACK, RST, etc., packets over the total number of TCP packets, and Protocol rate, which is defined by the ratio of the number of TCP (UDP or ICMP) packets over the total number of W packets. The experimental results show a distinctive and predictive pattern of DDoS attacks. We wish our approach can be used to detect and prevent DDoS attacks.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2022.05a
• /
• pp.125-128
• /
• 2022

As the number of online systems based on the internet gradually increases, cyber-scale attacks that interfere with the normal operation of web services are also on the rise. In particular, distributed denial-of-service attacks (DDoS) that interfere with normal web service operations are also increasing. Therefore, this paper presents an efficient DDoS attack defense technique utilizing Equal Cost Multi-Path (BGP ECMP) routing techniques in networks of Anycast type by operating PoP basis of major attack sources and describes how high-availability web services can be operated.

• Proceedings of the Korean Information Science Society Conference
• /
• 2012.06c
• /
• pp.283-285
• /
• 2012

2009년 7.7 DDoS 공격을 기점으로 DDOS 공격에 HTTP-GET 프로토콜이 공격에 주로 사용되고 있다. 본 논문에서는 클라이언트에서 개인사용자의 웹 브라우징 패턴을 분석함으로써 HTTP-GET 공격을 탐지하는 방법을 제안한다. 웹 브라우징 패턴 분석에는 Markov Model을 사용하여 사용자의 정상적인 행동패턴을 계산하고, 공격을 탐지하는데 사용한다. 제안한 방법은 클라이언트에서 개인사용자에 대한 개별적인 웹 브라우징 패턴을 분석하기 때문에 서버에서보다 계산량이 적으며, 클라이언트 레벨에서 DDoS 공격을 조기에 탐지/차단함으로써 서버에서의 DDoS 공격 탐지에 의한 부하를 줄일 수 있다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.20 no.5
• /
• pp.99-110
• /
• 2010

Recently, network based DDoS attacks have been changed into application layer DDoS attacks which are targeted at the web services. Specially, an attacker makes zombie PCs generate small traffic and its traffic pattern has been similar to the normal user's pattern. So, existing HTTP PPS based Threshold cannot defend the DDoS attacks effectively. In this paper, we displayed all the GET Flooding attack types and propose three DDoS attack defense mechanisms which are simple and very powerful. Proposed mechanisms can defend all the existing GET Flooding DDoS attacks and be deployed in the real environment immediately with little resource consumption.

• Proceedings of the Korean Information Science Society Conference
• /
• 2010.06d
• /
• pp.26-29
• /
• 2010

네트워크 대역폭 소모 위주로 발생했던 DDoS 공격이 최근에는 웹서비스 대상 시스템 부하 유발을 통해 가용성을 떨어뜨리는 응용계층에서의 DDoS 공격 위주로 발생하고 있다. 이러한 DDoS 공격에 대응하기 위해 History, IP 분산도, GRT, Behavior 기반 등 다양한 대응 메커니즘이 연구되고 있지만 연구초기 단계에 머물러 있다. 본 논문에서는 Admission Control 기반 DDoS 공격대응 메커니즘을 제안하고, 시스템 개발을 통해 성능을 검증하였다. 제안된 메커니즘은 지금까지 발생한 모든 응용계층 DDoS 공격유형에 대응 가능하며, 기존 Behavior 기반 대응기법은 오탐지 가능성이 있으나 제안하는 메커니즘은 오탐지가 발생하지 않는 장점이 있어, 상용 환경에 바로 적용할 수 있을 것으로 예상된다.

• Convergence Security Journal
• /
• v.12 no.6
• /
• pp.101-106
• /
• 2012

As the existing strategy of preventing DDoS(Distributed Denial of Service) attacks has limitations, this study is intended to suggest the more effective method of preventing DDoS attacks which reduces attack power and distributes attack targets. Currently, DDoS attacks have a wide range of targets such as individuals, businesses, labs, universities, major portal sites and financial institutions. In addition, types of attacks change from exhausting layer 3, network band to primarily targeting layer 7. In response to DDoS attacks, this study suggests how to distribute and decrease DDoS threats effectively and efficiently using Proxy Server Group and Dynamic DNS.

• KIPS Transactions on Computer and Communication Systems
• /
• v.2 no.3
• /
• pp.125-132
• /
• 2013

In this paper, We send DDoS(Distributed Denial of Service) attack traffic to real homepages in real networks. We analyze the results of DDoS attack and propose mitigation method against DDoS Attacks. In order to analyze the results of DDoS Attacks, We group three defense level by administrative subjects: Top level defense, Middle level defense, Bottom level defense. Also We group four attack methods by feature. We describe the results that average of attack success rate on defense level and average of attack success rate on attack categories about 48ea homepages and 2ea exceptional cases. Finally, We propose mitigation method against DDoS attack.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2010.05a
• /
• pp.642-645
• /
• 2010

본 논문에서는 DDoS(Distribute Denial of Service) 공격 상황에서의 효율적인 iptables 정책 설계 방법에 대해 제안한다. 현재 구축된 인터넷 상황에서는 누구나 손쉽게 DDoS Attack 환경을 구축하여 특정 사이트를 공격할 수 있다. 이를 극복하기 위해 DDoS 방어전용 장비 등을 사용 할 수 있지만 고가라는 단점 때문에 개인 혹은 소규모 서비스 시스템에서 사용하기에 어려운 점이 많다. 본 논문은 이러한 상황을 극복하기 위해 개인 및 소규모 시스템에 적용 가능한 효율적인 iptables 정책을 제안한다. 제안한 각 정책별 성능 평가는 웹 서비스 환경과 DDoS 유형별 공격 시나리오를 가정하여 시행하였고, 이는 실제적으로 효과가 있음을 확인하였다.