[Docs] [txt|pdf|xml|html] [Tracker] [Email] [Nits]

Versions: 00

DOTS                                                             M. Chen
Internet-Draft                                                    Li. Su
Intended status: Informational                                      CMCC
Expires: April 19, 2020                                 October 17, 2019


                        attack type unification
               draft-chen-dots-attack-type-unification-00

Abstract

   This document put forward a method to unify DDoS attack type
   classification and attack definition description, this will help
   different mitigators to mitigate DDoS attacks together.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on April 19, 2020.

Copyright Notice

   Copyright (c) 2019 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.





Chen & Su                Expires April 19, 2020                 [Page 1]


Internet-Draft              dots-attack-type                October 2019


Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . .   3
   3.  DDoS Attack Type Classification Framework . . . . . . . . . .   3
   4.  DDoS Attack Definition Description  . . . . . . . . . . . . .   4
   5.  Security Considerations . . . . . . . . . . . . . . . . . . .   6
   6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   6
   7.  Acknowledgement . . . . . . . . . . . . . . . . . . . . . . .   6
   8.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   6
     8.1.  Normative References  . . . . . . . . . . . . . . . . . .   6
     8.2.  Informative References  . . . . . . . . . . . . . . . . .   6
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .   7

1.  Introduction

   Distributed Denial of Service (DDoS) is a type of resource-consuming
   attack, which exploits a large number of attack resources and uses
   standard protocols to attack target objects.  With the cost of DDoS
   attack become more cheaper, DDoS attack become more and more
   frequently, a single mitigator unable to cope with all the DDoS
   attack, so DOTS come up to solve the problem.

   From the charter of DOTS working group, it writes that elements may
   be deployed as part of a wider strategy incorporating multiple points
   of DDoS detection, classification, traceback and mitigation, both on
   premise or service provider based.  As so far, DDoS classification
   have not written to DOTS.  This draft will from the perspective of
   the type of DDoS attack to do DDoS classification.

   Different understanding of DDoS attacks will result in different
   classification and that's why do we need uniform attack types.  At
   present, telecom operators, cloud service providers and third-party
   manufacturers have their own anti-ddos solutions.The construction of
   DDoS attack mitigation and disposal system involves two devices,
   namely detection equipment and cleaning equipment.  In the actual
   network deployment, the core nodes of the network will deploy
   detection equipment and cleaning equipment at the same time to detect
   and dispose attacks.  After an alarm is given, the cleaning equipment
   will be triggered to carry out traffic drainage and cleaning
   operations.  At present, the detection equipment adopts the coarse-
   grained attack type determination method, which greatly reduces the
   false alarm rate of attack.Different disposal of cleaning equipment
   is different for different attack types.  For example, TCP attack
   types can be discarded directly after matching, but HTTP CC Flood can
   be further determined only after interactive operation is required at
   the disposal.  Interactive operation may be redirection or
   verification code sending.  In the actual environment, there are many



Chen & Su                Expires April 19, 2020                 [Page 2]


Internet-Draft              dots-attack-type                October 2019


   manufacturers of detection equipment and cleaning equipment, and each
   manufacturer has its own definition method of attack type, so it is
   easy to lead to the same attack, but the field of attack type
   detected by different equipment manufacturers is different, which may
   easily lead to disposal confusion.  The attack type is inconsistently
   defined, it is difficult or controversial to judge the ability of
   test selection of DDoS attack detection and clean equipment.

   Volume based distributed denial-of-service attack have many types
   based on different protocol layer, for the service providers to
   immediately protect their network services from DDoS attacks, DDoS
   mitigation needs to be automated.  DDoS Open Threat Signaling (DOTS)
   is a protocol to standardize real-time signaling, threat-handling
   requests[I-D.ietf-dots-signal-channel], when attack target is under
   attack, dots client send mitigation request to dots server for help,
   If the mitigation request contains enough messages of the attack,
   then the mitigator can respond very effectively.  This document
   recommand a method for attack type unification.

2.  Terminology

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
   "OPTIONAL" in this document are to be interpreted as described in
   [RFC2119]

   The readers should be familiar with the terms defined in
   [I-D.ietf-dots-requirements] [I-D.ietf-dots-use-cases]

   The terminology related to YANG data modules is defined in [RFC7950]

   In addition, this document uses the terms defined below:

   Attack Type:  used to distinguish between different methods of ddos
      attack.

   Attack type definition:  General definition method, Covers most
      current attack types.

3.  DDoS Attack Type Classification Framework

   The existing classification of DDoS attack type is divided into
   multiple dimensions: by the protocol used, such as SYN Flood, HTTP
   Flood, ICMP Flood; by attack effect, such as bandwidth occupancy
   attack, Connection attack, slow attack; by the attack method, such as
   abnormal message attack, reflection amplification attack;





Chen & Su                Expires April 19, 2020                 [Page 3]


Internet-Draft              dots-attack-type                October 2019


   In the above definition of multiple types of attacks, there is
   partial overlap.  Combined with the existing classification of DDoS
   attack, the consensus of classifying DDoS attack by protocol layer is
   the highest.

   This draft of protocol layer is based on the TCP/IP model, the basic
   classification framework of DDoS attack as follows: Firstly, protocol
   layer, such as Network layer, transport layer and application layer;
   Secondly, Protocol and Messaging, Divide by protocol exploited by the
   attack, Then define the message and port involved in the protocol,
   User-defined (Protocol+port) format identifies attack types that are
   not well defined or standardized.Finally, Attack method, defined
   according to the method used in DDoS attack.

 .....................................................................
 Protocol layer                     |
 +-------------+     +---------------+      +-----------------+
 |Network layer|-----|Transport layer|------|Application layer|
 +-------------+     +---------------+      +-----------------+
               |                    |                       |
 ..............|....................|.......................|.........
 Protocol and  |                    |                       |
 Messaging     |                    |                       |
  +---+   +----+         +---+   +---+   +---+      +----+  +---+  +---+
  |...|---|ICMP|         |TCP|---|UDP|---|...|      |HTTP|--|DNS|--|...|
  +---+   +----+         +---+   +---+   +---+      +----+  +---+  +---+
               |                    |                       |
 ..............|....................|.......................|.........
 Attack Method |                    |                       |
               |                    |                       |
 +--------------+       +---------------+      +--------------+
 |Flood         |       |Flood          |      |Flood         |
 |Fragment Flood|       |Fragment Flood |      |Slow attack   |
 |...           |       |...            |      |...           |
 +--------------+       +---------------+      +--------------+
 .....................................................................


                 Figure 1: Basic classification framework

4.  DDoS Attack Definition Description

   In view of the difference in attack definition, the method of this
   draft is based on the basic classification framework to standardize
   the format as follows.

   [protocol layer] [protocol name] [message name/operation name/port]
   [attack methods feature description field 1] [attack methods feature



Chen & Su                Expires April 19, 2020                 [Page 4]


Internet-Draft              dots-attack-type                October 2019


   description field 2] [attack methods describe the standard field].
   Note1: the field of [message name/operation name/port] and [attack
   methods feature description field 1] and [attack methods feature
   description field 2] are optional.  Note2: [protocol name] and
   [message name/operation name/port] must contain at least one in the
   abbreviation.  Note3: The fields should be distinguished by the space
   character.

   The field of [message name/operation name/port] can have many
   choices, such as "Get/Post/SYN/ACK/Query/Memcached"; The field of
   [attack methods feature description field 1 or 2] can represent by
   "Connection", "Fragment", "Amplification", "Reflection", "Misuse",
   "BandWidth", or "Slow"; The field of [attack methods describe the
   standard field] just have two choice, one is "Flood" and the other is
   "Attack".

..........................................................................................
|Protocol layer  |Protocol|message name   |attack methods |attack methods |attack methods|
|                |Name    |/operation name|feature field 1|feature field 2|describe the  |
|                |        |/port          |               |               |standard field|
..........................................................................................
|Network_Layer    | ICMP  |  ------       |  ------       |  ------       | Flood        |
..........................................................................................
|Transport_Layer  | TCP   | SYN           |  ------       |  ------       | Flood        |
..........................................................................................
|Transport_Layer  | UDP   | Memcached     | Reflection    | Amplification | Flood        |
..........................................................................................
|Application_Layer| HTTP  | GET           |  ------       |  ------       | Flood        |
..........................................................................................


                    Figure 2: Attack Definition Example

   The complete DDoS attack definition and the abbreviated definition
   examples shown as bellow:
















Chen & Su                Expires April 19, 2020                 [Page 5]


Internet-Draft              dots-attack-type                October 2019


..........................................................................................
| complete DDoS attack definition                              |  abbreviated definition |
..........................................................................................
|Network_Layer ICMP Flood                                      |  ICMP Flood             |
..........................................................................................
|Transport_Layer TCP SYN Flood                                 |  TCP SYN Flood          |
..........................................................................................
|Transport_Layer UDP Memcached Reflection Amplification Flood  |  UDP Memcached Flood    |
..........................................................................................
|Application_Layer HTTP GET Flood                              |  HTTP GET Flood         |
..........................................................................................


      Figure 3: Attack Definition and Abbreviated Definition Example

5.  Security Considerations

   TBD

6.  IANA Considerations

   TBD

7.  Acknowledgement

   TBD

8.  References

8.1.  Normative References

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119,
              DOI 10.17487/RFC2119, March 1997,
              <https://www.rfc-editor.org/info/rfc2119>.

   [RFC7950]  Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language",
              RFC 7950, DOI 10.17487/RFC7950, August 2016,
              <https://www.rfc-editor.org/info/rfc7950>.

8.2.  Informative References

   [I-D.ietf-dots-requirements]
              Mortensen, A., K, R., and R. Moskowitz, "Distributed
              Denial of Service (DDoS) Open Threat Signaling
              Requirements", draft-ietf-dots-requirements-22 (work in
              progress), March 2019.




Chen & Su                Expires April 19, 2020                 [Page 6]


Internet-Draft              dots-attack-type                October 2019


   [I-D.ietf-dots-signal-channel]
              K, R., Boucadair, M., Patil, P., Mortensen, A., and N.
              Teague, "Distributed Denial-of-Service Open Threat
              Signaling (DOTS) Signal Channel Specification", draft-
              ietf-dots-signal-channel-37 (work in progress), July 2019.

   [I-D.ietf-dots-use-cases]
              Dobbins, R., Migault, D., Moskowitz, R., Teague, N., Xia,
              L., and K. Nishizuka, "Use cases for DDoS Open Threat
              Signaling", draft-ietf-dots-use-cases-20 (work in
              progress), September 2019.

Authors' Addresses

   Meiling Chen
   CMCC
   32, Xuanwumen West
   BeiJing , BeiJing   100053
   China

   Email: chenmeiling@chinamobile.com


   Li Su
   CMCC
   32, Xuanwumen West
   BeiJing   100053
   China

   Email: suli@chinamobile.com





















Chen & Su                Expires April 19, 2020                 [Page 7]


Html markup produced by rfcmarkup 1.129d, available from https://tools.ietf.org/tools/rfcmarkup/