Two-Tier GCT Based Approach for Attack Detection
- 1 Xi’an Jiaotong University
- 2 Xi’an Jiaotong University
- 3 Xi’an Jiaotong University
Abstract
The frequent attacks on network infrastructure, using various forms of denial of service attacks, have led to an increased need for developing new techniques for analyzing network traffic. If efficient analysis tools were available, it could become possible to detect the attacks and to take action to weaken those attacks appropriately before they have had time to propagate across the network. In this paper, we propose an SNMP MIB oriented approach for detecting attacks, which is based on two-tier GCT by analyzing causal relationship between attacking variable at the attacker and abnormal variable at the target. According to the abnormal behavior at the target, GCT is executed initially to determine preliminary attacking variable, which has whole causality with abnormal variable in network behavior. Depending on behavior feature extracted from abnormal behavior, we can recognize attacking variable by using GCT again, which has local causality with abnormal variable in local behavior. Proactive detecting rules can be constructed with the causality between attacking variable and abnormal variable, which can be used to give alarms in network management system. The results of experiment showed that the approach with two-tier GCT was proved to detect attacks early, with which attack propagation could be slowed through early detection.
- M. Thottan and C. Y. Ji, “Anomaly detection in IP networks,” IEEE Transactions on Signal Processing, 51(8): pp. 2191–2204, 2003.
- M. Roesch, “Snort-lightweight intusion detection for networks,” in USENIX LISA 1999, Seattle, WA, November 1999.
- P. Barford et al., “A signal analysis of network traffic anomalies,” in ACM SIGCOMM Internet Measurement Workshop, November 2002.
- A. Hussein, J. Heidemann, and C. Papadopoulus, “A framework for classifying denial of service attacks,” in ACM SIGCOMM, August 2003.
- A. Lakhina, M. Crovella, and C. Diot, “Diagnosing network-wide traffic anomalies,” in ACM SIGCOMM, September 2004.
- D. Plonka, “FlowScan: A network traffic flow reporting and visualization tool,” in USENIX LISA 2000, New Orleans, LA, December 2000.
- J. Mirkovic, G. Prier, and P. Reiher, “Attacking DDoS at the source,” in IEEE International Conference on Network Protocols, November 2002.
- A. Garg and A. L. N. Reddy, “Mitigation of DoS attacks through QoS regulation,” in Proceedings of IWQOS, May 2002.
- J. Ioannidis and S. M. Bellovin, “Implementing pushback: Router-based defense against DDoS attacks,” in Proceedings of Network and Distributed System Security Symposium, February 2002.
- Y. Zhang, L. Breslau, V. Paxson, and S. Shenker, “On the characteristics and origins of internet flow rates,” in ACMSIGCOMM, August 2002.
- Smitha, I. Kim, and A. L. N. Reddy, “Identifying long term high rate flows at a router,” in Proceedings of High Performance Computing, December 2001.
- I. Kim, “Analyzing network traces to identify long-term high rate flows,” M. S. thesis, TAMU-ECE-2001-02, May 2001.
- R. Mahajan, et al., “Controlling high bandwidth aggregates in the network,” ACM Computer Communication Review, Vol. 32, No. 3, July 2002.
- C. Estan and G. Varghese, “New directions in traffic measurement and accounting,” in ACM SIGCOMM, August 2002.
- A. Medina et al., “Traffic matrix estimation: Existing techniques and new directions,” in ACM SIGCOMM, August 2002.
- D. Tong and A. L. N. Reddy, “QOS enhancement with partial state,” in Proceedings of IWQOS, June 1999.
- Packeteer, “PacketShaper Express,” white paper, 2003, http://www. packeteer. Com / resources / prod-sol/Xpress_ Whitepaper.pdf.