Real-time DDoS attack detection for Cisco IOS using NetFlow

Abstract

Flow-based DDoS attack detection is typically performed by analysis applications that are installed on or close to a flow collector. Although this approach allows for easy deployment, it makes detection far from real-time and susceptible to DDoS attacks for the following reasons. First, the fact that the flow export process is timeout-based and that flow collectors typically provide data to analysis applications in chunks, can result in detection delays in the order of several minutes. Second, by the nature of flow export, attack traffic may be amplified by the flow export process if the original packets are small enough and are part of small flows.We have shown in a previous work how to perform DDoS attack detection on a flow exporter instead of a flow collector, i.e., close to the data source and in a real-time fashion, which however required access to a fully-extendible flow monitoring infrastructure. In this work, we investigate whether it is possible to operate the same detection system on a widely deployed networking platform: Cisco IOS. Since our ultimate goal is to identify besides the presence of an attack also attackers and targets, we rely on NetFlow. In this context, we present our DDoS attack detection prototype that has shown to generate a constant load on the underlying platform -even under attacks -underlining that DDoS attack detection can be performed on a Cisco Catalyst 6500 in production networks, if enough spare capacity is available.

Comparison of Hash Functions for Network Traffic Acquisition Using a Hardware-Accelerated Probe

“…Flow-based network monitoring is today the most widespread technology, and Net-Flow [11][12][13] is a widely used tool in network measurement and analysis. It is now gradually evolving into one of the most important means of ensuring network cybersecurity.…”

COP2: Continuously Observing Protocol Performance

“…Operators often also collect statistics about the tra c itself, usually using NetFlow/ [38,67,75]. These provide more detailed information about the ows crossing the network (e.g., layer-4 5-tuples, volumes in bytes and packet), and enable various management applications [52] (e.g., identifying major source/destination pairs [83], heavy-hitters [31], or detecting DDoS attacks [69,79]). Finally, operators monitor key performance metrics which are important for many end-to-end * O. Tilmans is supported by a grant from F.R.S.-FNRS FRIA applications, such as delays, packet losses, and retransmissions.…”

Dynamic Reconfiguration in 5G Mobile Networks to Proactively Detect and Mitigate Botnets

“…In a real network environment, Daniël van der Steeg and colleagues presented a prototype to detect these DDoS botnet attacks using NetFlow. 9 In addition to the aforementioned concerns, the large number of 5G subscribers' UEs with high mobility skills will require researchers //or who?// to adapt the existing detection and reaction algorithms to face botnets. 10 When bots move, the detection and reaction capabilities also have to be moved, "following" the bots, to continue performing their procedures accordingly.…”