SDN과 허니팟 기반 동적 파라미터 조절을 통한지능적 서비스 거부 공격 차단
Blocking Intelligent Dos Attack with SDN
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
네트워크 기술의 발달로 그 적용 영역 또한 다양해지면서 다양한 목적의 프로토콜이 개발되고 트래픽의 양이 폭발적으로 증가하게 되었다. 따라서 기존의 전통적인 스위칭, 라우팅 방식으로는 네트워크 관리자가 망의 안정성과 보안 기준을 충족하기 어렵다. 소프트웨어 정의 네트워킹(SDN)은 이러한 문제를 해결하기 위해 제시된 새로운 네트워킹 패러다임이다. SDN은 네트워크 동작을 프로그래밍하여 효율적으로 네트워크를 관리할수 있도록 한다. 이는 네트워크 관리자가 다양한 여러 양상의 공격에 대해서 유연한 대응을 할 수 있는 장점을 가진다. 본 논문에서는 SDN의이러한 특성을 활용하여 SDN 구성 요소인 컨트롤러와 스위치를 통해 공격 정보를 수집하고 이를 기반으로 공격을 탐지하는 위협 레벨 관리 모듈,공격 탐지 모듈, 패킷 통계 모듈, 플로우 규칙 생성기를 설계하여 프로그래밍하고 허니팟을 적용하여 지능형 공격자의 서비스 거부 공격(DoS)을차단하는 방법을 제시한다. 제안 시스템에서 공격 패킷은 수정 가능한 플로우 규칙에 의해 허니팟으로 빠르게 전달될 수 있도록 하였으며, 공격패킷을 전달받은 허니팟은 이를 기반으로 지능적 공격의 패턴을 분석하도록 하였다. 분석 결과에 따라 지능적 공격에 대응할 수 있도록 공격 탐지모듈과 위협 레벨 관리 모듈을 조정한다. 제안 시스템을 실제로 구현하고 공격 패턴 및 공격 수준을 다양화한 지능적 공격을 수행하고 기존 시스템과비교하여 공격 탐지율을 확인함으로써 제안 시스템의 성능과 실현 가능성을 보였다.
Abstract
With the development of network technology, the application area has also been diversified, and protocols for various purposes havebeen developed and the amount of traffic has exploded. Therefore, it is difficult for the network administrator to meet the stability andsecurity standards of the network with the existing traditional switching and routing methods. Software Defined Networking (SDN) is a newnetworking paradigm proposed to solve this problem. SDN enables efficient network management by programming network operations. Thishas the advantage that network administrators can flexibly respond to various types of attacks. In this paper, we design a threat levelmanagement module, an attack detection module, a packet statistics module, and a flow rule generator that collects attack information throughthe controller and switch, which are components of SDN, and detects attacks based on these attributes of SDN. It proposes a method toblock denial of service attacks (DoS) of advanced attackers by programming and applying honeypot. In the proposed system, the attackpacket can be quickly delivered to the honeypot according to the modifiable flow rule, and the honeypot that received the attack packetsanalyzed the intelligent attack pattern based on this. According to the analysis results, the attack detection module and the threat levelmanagement module are adjusted to respond to intelligent attacks. The performance and feasibility of the proposed system was shown byactually implementing the proposed system, performing intelligent attacks with various attack patterns and attack levels, and checking theattack detection rate compared to the existing system.
참고문헌 (30)
- K. Kirkpatrick, "Software-defined networking", Communitcations of ACM, 56(9), pp.16~19 (2013)
- 최준성, "지능형 지속 위협 공격 (APT) 특성 분석 - 2009 ~ 2012 년, 국내 방위산업계 공격을 중심으로 -", 한국방위산업학회지, 19(2), pp.73~89 (2012), 한국방위산업학회
- Q. Yan, "Software-defined networking (SDN) and distributed denial of service (DDoS)attacks in cloud computing environments: A survey, some research issues, and challenges", IEEE Communications Surveys & Tutorials, 18(1), pp.602~622 (2015)
- N. Provos, "A virtual honeypot framework", USENIX Seurity Symposium, pp.1~14 (2004), USENIX Association
- "ONOS"[URL]
- "OpenvSwitch"[URL]
- P. Berde, "ONOS: towards an open, distributed SDN OS", Proceedings of the Third Workshop on Hot Topics in Software Defined Networking, pp.1~6 (2014), Association for Computing Machinery
- B. Pfaff, "The design and implementation of open vswitch", 12th {USENIX} Symposium on Networked Systems Design and Implementation, pp.117~130 (2015), USENIX Association
- N. McKeown, "OpenFlow: Enabling innovation in campus networks", ACM SIGCOMM COmputer Communication Review, 38(2), pp.69~74 (2008)
- "tshark"[URL]
- "Mininet"[URL]
- K. Kaur, "Mininet as software defined networking testing platform", International Conference on Communication, Computing & Systems, pp.139~142 (2014), IEEE
- "Hping3"[URL]
- M. Agiwal, "Next generation 5G wireless networks: A comprehensive survey", IEEE Communications Surveys & Tutorials, 18(3), pp.1617~1655 (2016)
- H. Kim, "Improving network management with software defined networking", IEEE COmmunicatinos Magazine, 51(2), pp.114~119 (2013)
- M. Casado, "Ethane: Taking control of the enterprise", ACM SIGCOMM Computer Communication Review, 34(4), pp.1~12 (2007)
- D. Moore, "Inferring internet denial-of-service activity", ACM Transactions on Computer Systems, 24(2), pp.115~139 (2006)
- S. T. Zargar, "A survey of defense mechanisms against distributed denial of service (DDoS)flooding attacks", IEEE Communications Surveys &Tutorials, 15(4), pp.2046~2069 (2013)
- T. Haq, "U.S. Patent No. 9,628,507", U.S. Patent and Trademark Office, ~ (2017)
- Y. Choi, "Implementation of content-oriented networking architecture (CONA): a focus on DDoS countermeasure", Proceedings of European NetFPGA Developers Workshop (2010), NetFPGA
- X. You, "Packet In message based DDoS attack detection in SDN network using OpenFlow", 2017 Fifth International Symposium on Computing and Networking, pp.522~528 (2017), IEEE
- T. Sanguankotchakorn, "Hybrid Controller for Securing SDN from Switched DDoS and ARP Poisoning Attacks", 2019 20th Asia-Pacific Network Operations and Management Symposium, pp.1~6 (2019), IEEE
- H. Wang, "SDN-based hybrid honeypot for attack capture", 2019 IEEE 3rd Information Technology, Networking, Electronic and Automation Control Conference, pp.1602~1606 (2019), IEEE
- X. Liu, "Design of the multi-level security network switch system which restricts covert channel", 2011 IEEE 3rd International Conference on Communication Software and Networks, pp.233~237 (2011), IEEE
- T. Lotlikar, "A defense mechanism for DoS attacks in SDN (Software Defined Network)", 2019 International Conference on Nascent Technologies in Engineering, pp.1~7 (2019), IEEE
- Y. Kim, "ARP poisoning attack detection based on ARP update state in software-defined networks", 2019 International Conference on Information Networking, pp.366~371 (2019), IEEE
- C. Y. J. Chiang, "ACyDS: An adaptive cyber deception system", 2016 IEEE Military Communications Conference, pp.800~805 (2016), IEEE
- Z. Zha, "Instrumenting open vSwitch with monitoring capabilities:designs and challenges", Proceedings of the Symposium on SDN Research, pp.1~7 (2018), Association for Computing Machinery
- Y. Tian, "DOS attack mitigation strategies on SDN controller", 2019 IEEE 9th Annual Computing and Communication Workshop and Conference, pp.701~707 (2019), IEEE
- M. Kuerban, "FlowSec: DOS attack mitigation strategy on SDN controller", 2016 IEEE International Conference on Networking, Architecture and Storage, pp.1~2 (2016), IEEE