Transcript ppt - Computer Science & Engineering

Slide Background Graphics by Paul Sagona
Overview
•
•
•
•
•
•
Introduction
Related Work
Proposed Approach
Experiment
Results
Conclusion
Introduction: Honeypot
• Etymology: Winnie-the-Pooh, who
was lured into various predicaments
by his desire for pots of honey[1]
• A trap set to detect, deflect or in some
manner counteract attempts at
unauthorized use of information
systems[2]
Introduction: Honeypots
• Serve as decoys used to distract adversaries from
more valuable machines and resources on a
network
• Valuable as a surveillance and early-warning tool
• Coupled with IDS, can be effective in detecting
systems with Internet worms and random port
scanners
• Personal experience with Offensive Security using
Honeypots (IIS, SSH)
Denial-of-Service (DoS) Attack
• DoS attacks aim at disrupting the
legitimate utilization of network and
server resources
• Threat to both high traffic public services,
such as Google, and private services, i.e.
subscription –based business services
Denial-of-Service (DoS) Attack
• Difficult to prevent due to inevitable software
vulnerabilities
• Adversaries directly attack victim machine or
use zombies (any number of compromised
machines used to attack a victim’s resources)
Network level DoS Attack
• Purpose of network DoS is to congest
network resources like router buffers and
link capacity
• Good Defensives:
– D-WARD[19]: detects and stops abnormal oneway flows
– Ingress Filtering [9] Stops most spoofed attacks
Service-level DoS Attack
• A large number of attack machines acquire
service from a victim server
• Consumes server memory and processing, as
well as networking resources along the out path
from server
• Not possible using a spoofed source address as
a three-way handshake is required for the TCP
service
• Honeypots can provide a way to mitigate these
attacks by tricking adversaries
Related Works
Honeynet [4]
• High-interaction honeypot designed to
capture extensive information on threats
• Network that contains one or more honeypots
• Network of real computers for attackers to
interact with
• All captured activity is assumed to be
unauthorized or malicious
Related Works
Honeynet Architecture[4]
• Honeywall is the key to the honeynet
Archietecture
• It’s a gateway device that separates
honeypots from the rest of the world
• 2-layer bridging device
Related Works
Honeynet [4]: Basic Jobs
• Data Control: Containment of risk, Safeguard
that non-honeynet systems are safe
• Data Capture: detect and capture attackers
activities
• Data Analysis: to analyze and thus prevent
further attacks
Related Works
Honeynet [4]: Risks
• Harm when a honeynet system is used to
attack a non-honeynet system
• If attackers detect that a system is used as
honeypot, this system’s value is dropped
dramatically
• Risk of disabling honeynet functionality
• System compromised to house illegal data
(anonymous FTP)
Related Works
Virtual Honeypots [5]
• Deploying a physical honeypot can be intensive
and expensive
• Different operating systems require specialized
hardware and every honeypot requires its own
physical system
• Honeyd is a framework for virtual honeypots that
simulates virtual computer systems at the
network level
Related Works
Virtual Honeypots [5]
• Require fewer computer systems, thus reducing
costs
• Possible to populate a network with hosts
running numerous OS’s
• Honeyd simulates virtual networks that consist of
arbitrary routing topologies
• For example, if a networking mapping tool like
traceroute were used, it would only discover the
topologies simulated by Honeyd
Related Works
Virtual Honeypots [5]
• Honeyd is used for system security in detecting
and disabling worms, distracting adversaries,
and/or preventing the spread of spam email
• Honeyd is a low-interaction virtual honeypot that
only simulates the network layer
• Coupled with tools like Vmware, high-interaction
can be simulated
Related Works
Virtual Honeypots [5]
• Honeyd mimics the network stack behavior of
operating systems to deceive fingerprinting
tools like Nmap and Xprobe
• Honeyd’s personality engine can modify
packets to match the fingerprints of other
operating systems and creates arbitrary virtual
routing topologies
Related Works
Server Roaming (Work from their previous paper)
• Proactive server roaming to mitigate the
effects of Denial-of-Service (DoS) attacks
• The active server changes its location within a
pool of servers to defend against
unpredictable and undetectable attacks
• Only legitimate clients can follow the active
server as it roams
Related Works
• Proactive Server Roaming Limitations
– Handles only one server active at a time
– Requires offline service subscription, which is not
a flexible service model
– Servers must keep track of all subscribed client
addresses to send them roaming update messages
(reduces flexibility)
– Requires changes in client software
– Easy to compromise client and discover service
secrets or eavesdrop to find server address
Problem with Honeypots
• Problem with standard honeypots is that they
are deployed at fixed locations.
• Sophisticated attacks can avoid the decoys
and thus focus back on legitimate servers
Proposed Approach
• Roaming Honeypots can mitigate service-level
DoS attacks against back-end private services
• Achieved by a pool of back-end servers
unpredictably changing from service
providers to acting as honeypots
• The service is subscription-based; that is,
clients need subscribe through front-ends to
gain access to the service
Roaming Honeypots
• Benefits against service-level:
– Filtering effect: Detect attacker addresses so that
their future attempts are filtered out. Good for
attacks outside the firewall.
– Connection-dropping: When server switches from
idle to active, it drops all current (attack)
connections, opening and window for legitimate
users before attack build up. Good for attacks
inside the firewall.
Service Model
• AGN (Access Gateways Network)
– Keeps track of current active servers
– Clients contact AG’s to subscribe and request
services
– After the request is authenticated and authorized,
AG redirect the request to one of the active
servers
– Also support dynamic-Load balancing
Service Model
• AGN
Service Model
• AGN Handles Spoofed Attacks
– Legitimate requests are tunneled through the AGN
– For this attack to be successful an attacker needs
to spoof an AG’s address
– An AG can easily detect that it is under such an
attack (all its requests are being dropped) and can
respond by changing its IP address.
– The AG updates its address registration with the
new IP address
Attack Model
• Two attack models types
– Fixed-target attacks
– Follower attacks
• Fixed-Target Attack
– The attacker selects few servers and attacks them
continuously
• Follower Attacks
– The attacker tries to continuously direct the
attack into active servers
Simulation
• They used a ns-2(Network Simulator)
• A ns is a discrete event simulator for doing
network research
• Supports simulation of TCP, routing and
multicast protocols over both wired or
wireless networks
Simulation Model
• Used FTP server and client modules to be used as
test bed application for simulation
• Code works on top of socket layer, where
roaming and TCP agent management takes place
• FTP connection stays active until FTP request is
filled or roaming occurs
• If roaming is scheduled to cause server to be idle
during an active connection, client module will
record current FTP state (remaining bytes) to
resume state on new randomly selected server
Simulation Topology
Simulation
• To study the connection-dropping effect
separately, they also modeled a roaming scheme
in which no filtering takes place
• Roaming honeypots scheme as filter-roaming (or
FR),
• The full replication scheme as non-roaming
• The scheme with no filtering as roaming (or R).
• They refer to the migration interval as M-interval
(or just M)
Results
Results
Results: Mitigation Values
• There exists a critical value of M
• Below Critical Value
– Roaming overhead is dominant
– M increases -> frequency of connection reestablishment decreases resulting in a decreased ART.
• Beyond Critical Value
– M increases -> ART increases.
– Two reasons:
• Connection-dropping effect occurs less frequently
• More client requests are issued to attacked server
Results
Results
Results: Attack Load
• Filter Roaming:
– Keeps the ART stable with increasing attack loads
• Non-roaming:
– ART is less for small loads
– Art increases for large loads
• Roaming:
– ART increases with increasing attack load
Results
Results
Results: Follow Delay
• FR:
– ART decreases as follow delay increases
• R:
– ART decreases as follow delay increases
• Non-roaming:
– ART is same for follower and fixed-target attacks
Conclusion: Limitations
• This scheme has an overhead that causes
performance degradation
• It occurs both in the absence of attacks and
under low attack.
• This is mainly because the load is distributed
over k instead of all N servers
• During Active to idle state switch, all the active
connections have to be re-established
Conclusion: Future Work
• The exact mitigation value depends on the
types of services
• Authors see need for mechanism that
adaptively changes the number of concurrent
active servers depending on attack loads and
client loads
Conclusion
• This scheme is described as a subset of servers
that are active and providing service while rest
are acting as honeypots, mitigating attacks
• All legitimate requests are directed by the
Access Gateway Network
• Although the scheme requires an overhead
time for connections, it shows a high
performance gain during high attack loads
Questions?
• My opinion? Interesting idea, but I believe it is
pointless. Internal DoS attacks is a failure of proper
security at an organization. IDS and Firewalls are the
choke point of a DoS. Filtering would be done at this
point. Honeypots could be used to find zombies?
• Forcing clients to drop connection and reinstate
services is unacceptable, too much overhead.
• Honeypots are used for gathering information, not
mitigating DoS.
References
• [1] Wikipedia: Honeypot,
http://en.wikipedia.org/wiki/Honeypot_%28computing%29
2007
• [2] Mosse,
http://oldwww.cs.pitt.edu/~mosse/courses/cs2001/melhe
m_fall06.ppt, 2006
• [3] Previous presentation by Nikhil Mahajan and Sriharsha
Hammika
• [4] Honeynet, http://www.honeynet.org/papers/honeynet/
• [5] Provos, Niels , A Virtual Honeypot Framework
http://www.citi.umich.edu/u/provos/papers/honeyd.pdf