Network security defense model based on firewall and IPS

2.1 Overall defense strategy

A network host can use Raw Socket to make network data message with false source IP address [4]. However, the network data packets with false source protecting IP address are usually related to malicious network behaviors such as distributed denial of service (DDoS) attack. Through the method of forging the source IP address, DDoS, attack has become a very difficult Internet security problem and a serious threat to Internet services [5–7]. DDoS attacks block the network access of legitimate users by consuming the system resources of the attacked host or occupying the network bandwidth [8].

Attackers often fill the random 32 bit binary number into the source IP address field of IP data packets, and create spurious source IP address data packets [9, 10] in this way to hide the controlled host that launched the attack and avoid tracking. Due to some design defects of the current IP protocol system, the router does not verify the legitimacy of the source of data packets when forwarding data packets, so that the forged source IP address can be successfully forwarded by the router. Because of this system defect, it is difficult to trace and detect the source of DDoS attack. Some DDoS attacks, such as Smurf [11] and recent DRDOS attacks [12, 13], rely entirely on the manufacture of false source IP address data packets to launch attacks.

When an attacker uses software such as TFN2k to launch a DDoS attack on the target host, the victim host will receive a large number of flood packets of false source IP address constructed by IP Spoof technology. Traditional defense methods, such as filtering the specific IP address or port on the firewall, random packet loss, cannot effectively distinguish the legitimate access traffic and illegal access traffic, so it is difficult to effectively protect the victim host and maintain the normal service of the victim host to the legitimate users.

To sum up, how to solve the problem of effective identification of IP Spoof network traffic during DDoS attack is the key for network intrusion prevention system to effectively prevent DDoS attacks and ensure the normal operation of networkhosts [14, 15].

Because there is no very effective means to effectively identify the data flow of IP Spoof, the current DDoS attack defense technologies are all passive defense means without distinction, which are either discarded without distinction or allocated system resources for processing without distinction. However, when the denial of service attack comes, the number of malicious packets is very large, and the access requests of legitimate users are submerged in the ocean of malicious packets; therefore, if there is no effective means to distinguish between them, the consequences will be disastrous whether they are handled or not.

But the discrimination itself is very complex, and the more accurate the algorithm is, the more complex it is. Therefore, it is the main starting point for the author of this paper to design a DDoS defense system to balance performance and cost by adopting appropriate overall defense strategy.

This system uses the system model based on the state control strategy and the hierarchical protection strategy in the attack period to defend the cooperative control distributed denial of service attack using IP Spoof technology.

2.2 Two states of IPS system

The main characteristics of DDoS attacks are short duration, destructive and difficult to prevent. Attack defense algorithm is a special attack mitigation algorithm designed according to the special harm of DDoS attack. Due to the limitation of system overhead, it is difficult to realize the absolute and accurate algorithm to distinguish malicious traffic from normal network traffic, so the approximate algorithm is used to achieve the balance between performance and cost. However, the approximate discrimination algorithm may filter some legitimate network access as attack traffic. Although a small amount of misjudgment is tolerable in large-scale network intrusion, but in non-attack period, calling such algorithms will have a negative impact on legitimate network access. Two working states of IPS system against DDoS attack is shown in Fig. 1.

OPEN IN VIEWER

Fig.1

Two working states of IPS system against DDoS attack.

In the period of DDoS attack, a variety of approximate discrimination algorithms are used to distinguish the received data traffic and perform corresponding filtering or forwarding operations. Due to the different balance point between performance and cost and the different accuracy of differentiation, the hierarchical protection strategy is adopted for DDoS attack defense.

Hierarchical protection strategy refers to the use of three-level defense strategy model to process packets in defense system. First, the data preprocessing technology is used for simple filtering to separate some abnormal and abnormal packets; then the DDoS defense technology based on data flow fingerprint recognition is used for filtering. In most cases, after these two levels of filtering processing, it can play a good defense effect. For some special DDoS attacks, such as DDoS attacks with small attack source granularity and wide distribution, if the effect is not obvious after the first two levels of defense strategy processing, the HCF based deep defense technology will be used for processing. The three-level defense strategy model is shown in Fig. 2.

OPEN IN VIEWER

Fig.2

Three level defense strategy model for IP Spoof DDS.

Through the hierarchical protection strategy, the algorithm with the simplest processing process and the highest processing efficiency is regarded as the first level filtering strategy, and simple filtering is carried out, which can greatly reduce the workload of the subsequent filtering algorithm and improve the processing efficiency; the algorithm with the most complex processing process but the most accurate is regarded as the third level filtering strategy, so as to ensure the overall effectiveness of the defense strategy. In this way, by using the hierarchical protection strategy from simple to complex, from coarse to fine, it not only ensures the accuracy and effectiveness of the processing process, effectively distinguishes malicious traffic from normal traffic, but also meets the requirements of processing efficiency when large-scale DDoS attacks occur.

3.1 Data preprocessing technology

When DDoS attacks occur, because the attack packets are artificially created by the attacker through program methods, there will be a large number of malformed and abnormal packets in the network. Through protocol verification and data preprocessing technology based on routing feature anomaly recognition, a large number of malformed and abnormal packets can be divided and filtered, so as to reduce the workload of subsequent defense algorithms.

(1) Protocol verification technology

Protocol verification technology can check protocol domains of different layers to find illegal or suspicious content, such as unused domains, illegal values, inappropriate options, irregular serial numbers, CRC modifications, etc. At present, many scholars have done in-depth research on protocol verification technology, which will not be covered in this paper.

(2) Data preprocessing technology based on routing feature anomaly recognition

TTL (time to live) is a value in the IP protocol package, which tells the network router whether the time in the network is too long and should be discarded. There are many reasons why a package cannot be delivered to its destination for a certain period of time. For example, an incorrect routing table can cause an infinite loop of packets. One solution is to discard the packet after a period of time, and then send a message to the sender, who decides whether to resend or not. The original idea of TTL is to determine a time range beyond which packets are discarded. Since each router must reduce the TTL value by 1, TTL usually indicates the maximum number of routers that a packet can pass before it is discarded. When the count reaches 0, the router decides to discard the packet and send an ICMP message to the original sender.

The initial value of TTL is usually the system default value, which is an 8-bit field in the package header. Using the IP protocol of multiplexing, TTL value indicates the range of a packet to be forwarded. The default initial value of TTL is usually 255, 128, 64, 60, 32, 30. At present, the number of routing hops of network hosts in the Internet environment is usually less than 25. Therefore, the TTL value of the received packets is usually in the range of 235–255, 108–128, 40–64 and 10–32.

According to the intrusion prevention system architecture, when DDoS attacks occur, the detection and analysis component of IPS system will trigger the state switch, which drives the DDoS hierarchical protection policy in the policy execution component to work. At this point, the packet will first arrive at the data preprocessing module. After primary filtering, most abnormal and abnormal packets in the data stream will be filtered out.

The following shows the implementation of data preprocessing algorithm based on routing feature exception recognition:

{

if (ips_proc_mod==A TTACK_MODE)

(

ipchns = ma lloc (100)

strcpy (ipchns, ” iptables -A forward)

system (ipchns)

strcpy (ipchns, ” iptables -A forward -mtfl-ttl 230:255"): -m ttl-ttl 103:128”);

system (ipchns)

strcpy (ipchns. “ iptables-A forward -m tfl-tt/35:64")

system (ipchns)

strcpy (ipchns, ” iptables -A forward –m ftl-ttl5:32")

system (ipchns)

ttl_preprocjist (ttl_blockjist)

system_procjog (BLOCK_FORfMRD, TTL. ttl_blockjist)

checkjnode (& ips rocjnod)

}

3.2 Defense Technology Based on fingerprint recognition of data stream

When a DDoS attack occurs, the attack source will send a large number of packets to the target host continuously to submerge the target host. According to the statistical analysis of common attack software, according to the different performance of the host, each attack host will usually produce thousands to tens of thousands of packets per second to send to the target host, and some high-performance network servers can even produce 100000 packets per second. Through the statistics of the source of attack packets, it is easy to find the IP addresses of attack sources, and filter the packets from these IP addresses. The principle is similar to the separation of stone and fine sand with a sieve. According to the aggregation effect of the source IP address, the coarse stone is blocked out of the network, while the fine sand can pass through.

However, the new generation of DDoS attacks use IP Spoof technology to forge DDoS attack packets with source IP address, whose source IP address field is filled with 32-bit binary number generated randomly. Packet source IP address will be randomly distributed in the whole IP address space. Therefore, the new attack data flow will flood through the “screen mesh” to wash down the system that uses the traditional IP address filtering of the attacksource.

In the IP protocol definition of IP packet header information, the source address and destination address fields indicate the end-to-end digital characteristics of the packet, and are also the most direct digital characteristics to find the source of attack and filter the packet. Although in IP Spoof DDoS attacks, this end-to-end digital feature can no longer be used to indicate the legitimacy of data packets; however, there are still some “fingerprint information” in malicious data traffic, which cannot be used to determine the exact source of the sender, but as a basis for distinguishing between malicious traffic and normal traffic, it is enough. In this paper, a set of distinguishing / defending algorithm is designed and implemented by using the route “fingerprint information” provided by TIL value in IP Spoof DDoS malicious traffic. The algorithm consists of two parts: analysis of route “fingerprint information”and defense.

The algorithm filters the malicious traffic generated by the IP Spoof DDoS attack by submitting the routing “fingerprint information” representing the malicious attack traffic to the attack defense module in the policy execution component.

3.3 Algorithm validity analysis

The algorithm filters according to TTL characteristic value of malicious attack traffic. When the attack occurs, because the algorithm detects the routing “fingerprint information” of data traffic, it is very effective to prevent the IP Spoof DDoS attack with forged source IP address, and its missed detection rate is close to 0. There are some shortcomings in false detection, which can filter out the legitimate traffic with the same TTL value as the attack traffic, and is sensitive to the distribution of the attack source in the TTL value domain space. However, under the normal DDoS attack scale, when the number of hosts initiating the attack does not exceed 100 or the coverage in the TTL domain space is less than 20%, the access of more than 50% of normal users will not be affected. In this case, the defense algorithm based on data stream fingerprint recognition is veryeffective.

4.2 Preconditions to ensure the effectiveness of the algorithm

The effectiveness of the algorithm is based on the following two prerequisites:

(1) Verification of the stability of Hop-count

In more than 50 days since September 1, 2004, more than 9000 one-way path measurement data randomly selected from 113 network hosts’ traceroute measurement data every 10 minutes were analyzed. It was found that less than 5% of the paths had changed their hop count value more than 3 times.

This experiment proves that the value of Hop-count between hosts on the Internet is stable enough to support the work of HCF algorithm effectively.

(2) Verification of distribution characteristics of Hop-count

The distribution characteristics of Hop-count need to meet certain distribution characteristics to ensure that the system can distinguish illegal Spoof IP packets through the corresponding relationship between source IP and Hop-count values. Figure 3 shows the statistical distribution of Hop-count on Yahoo website. Figure 4 shows the statistical distribution of hop count of a trace route gateway from Stanford Univ.

OPEN IN VIEWER

Fig.3

The statistical distribution of Hop-count on Yahoo website.

OPEN IN VIEWER

Fig.4

The statistical distribution of hop count of a trace route gateway from Stanford University.

Based on the statistics of Hop-count values of visitors to multiple trace route gateways on the Internet, we found the following statistical characteristics:

The distribution of Hop-count values is Gaussian

This distribution has met the need of the effectiveness of HCF algorithm

The algorithm compares the actual number of routing hops of each packet (calculated by TTL value in the packet) with the standard value in the Hop-count table established in advance by the system to determine the validity of the packet. For the remote attacker, because it is impossible to match the appropriate TTL initial value for each randomly generated false IP address, it is impossible to evade detection by camouflage. According to statistics, only less than 10% of the packets in the attack data stream are missed by HCF because the random IP address is exactly the same as the number of Hop-count of the real IP.

For the packets sent by legal users, because the Hop-count calculated by the source IP and TTL values is consistent with the Hop-count value in the comparison table, it can almost guarantee that they pass the HCF system filter 100%.

Based on the above analysis, we find that HCF algorithm has a very good performance in defending against IP Spoof DDoS attacks, because it guarantees almost zero false alarm rate and keeps the false alarm rate within the tolerable range. Because the false alarm rate is not more than 10%, in many cases it can even be as low as 5%, and the false alarm rate is close to 0. If we use appropriate methods to combine it with traditional defense means (such as SYN, cookie, load balance, etc.), we can improve the working efficiency of traditional defense methods by 10 to 20 times. The related problems are worth further study in the future.

5.1 System defense against unknown Spoof IP DDoS attack tools

In this experiment, TFN2K and its modified version v1.0 are used to test the effectiveness of IPS system and the impact of unknown attack software on its defense performance. SYN flood, UDP flood and ICMP flood are used in the experiment.

From Table 1, we can see that the IPS system has an obvious defense effect against the IP Spoof DDoS attack launched by TFN2K. After the IPS system is started, the remote customer’s access delay to Victim is not obvious.

Because the IPS system design and implementation in this paper uses the defense technology based on behavior mode, and does not target specific attack software. From the experimental data in the table above, we can find that IPS is still effective against unknown attacks.

In this experiment, TFN2K modified vl.1. is used to detect the impact of the distribution characteristics of attacking hosts on the defense performance of IPS system, and the experimental results are analyzed. The purpose of the experiment is to simulate the defense ability of IPS system when a large number of real network hosts attack on Victim, and observe the impact of the increase of the number of attacking hosts on the defense ability of IPS system.

In this part, six control experiments were conducted. Each experiment uses different data to fill the TTL field of attack packets, so that the TTL value of packets received by IPS system appears randomly with basically the same probability in the following set:

The experimental results are shown in Table 2. Through the analysis of experimental data, IPS system has completed the filtering of attack traffic well in six experiments. However, with the increase of the distribution of attack sources, more and more legitimate users’ network access will be affected. In the last round of experiments, ICMP packets used to detect response time were also filtered out by IPS system.

In the control experiment, the virtual attack network covered 80 of the possible 100 values of TTL under the current network condition. According to the paper rough estimate, an attacker must control at least 500 attack hosts before launching such an attack.