인터넷 AS 레벨 토폴로지에서 분산서비스거부 공격 징후 탐지 = Detection of the Portent of Distributed DoS Attacks on the Internet AS-level Topology

국문 초록 (Abstract)

각각의 AS 레벨에서 정확한 연결구조를 얻기 위해 들이는 노력에도 불구하고 이들 AS 레벨 인터넷 토폴로지를 이용한 응용 연구들이 매우 드물다. 본 논문에서는 UCLA IRL 연구실이 제공하는 데이터를 이용해 AS 노드의 하위 스트림 AS 분포의 power-laws 특징과 인터넷 라우팅 패스 구조에 가장 중요한 역할을 하는 AS 링크 분포를 살펴 보았다. 또한, 한국과 미국 사이트를 중심으로 (발신지-목적지) 라우팅 홉 수 분포를 조사하고 이들 분포와 BGP 밸리-프리 라우팅 정책 특징을 이용하여 분산서비스거부(DDoS) 공격 시 예상되는 인터넷 트래픽 임의성(randomness)을 근거로 DDoS 공격 징후를 인터넷 AS 레벨에서 발견하는 방법을 제시하였다.

다국어 초록 (Multilingual Abstract)

Despite lots of efforts to obtain an accurate picture of structure at the level of individual ASes, there is a few application works using the AS-level Internet topology. In this paper, we show that the power-law fits the number of down-stream customer ASes very well and also present the distributions of AS links with the “public view” from UCLA IRL laboratory. Moreover, we obtain the distributions of source-destination pairs of routing hops for two sites in Korea and the United States, and then we propose a new method to decide the randomness of Internet traffic using the obtained distributions and the BGP valley-free routing policy. The randomness of traffic must be a portent of outbreak of the distributed denial-of-service attacks.

목차 (Table of Contents)

• 요약
• Abstract
• 1. 서론
• 2. 인터넷 AS 레벨 토폴로지
• 3. AS 레벨 토폴로지에서 트래픽 임의성 검출
• 4. 결론
• 참고문헌

참고문헌 (Reference)

1 "UCLA IRL Internet Topology Collection"

2 Q. Chen, "The origin power laws in Internet topologies revisited" 2002

3 L. Feinstein, "Statistical Approaches to DDoS Attack Detection and Response" 2003

4 M.Roesch, "Snort Lightweight Intrusion Detection for Networks" 101-109, 1999

5 "Route Views routing table archive"

6 "RIPE routing information service project"

7 R. Oliveira, "Quantifying the Completeness of the Observed Internet AS-level Structure" Computer Science Department UCLA 2008

8 K. Park, "On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law Internets" 15-26, 2001

9 M. Faloutsos, "On Power-Law Relationships of the Internet Topology" 251-262, 1999

10 L.Gao, "On Inferring Autonomous System Relationships in the Internet" 9 (9): 733-745, 2001

11 M.V.Mahoney, "Network Traffic Anomaly Detection Based on Packet Byte" 346-350, 2003

12 C.D. Murta, "NIT: The New Internet Topology Generator" Department of Informatics, University Federal of Parana 2008

13 J. Winick, "Inet-3.0: Internet Topology Generator" Department of EECS, University of Michigan 2002

14 R. Oliveira, "In Search of the Elusive Ground Truth: The Internet’s AS-level Connectivity Structure" 2008

15 B. Zhang, "Collecting the internet AS-level topology" 35 (35): 53-61, 2005

16 C. Zou, "Code Red Worm Propagation Modeling and Analysis" 2002

17 I.V. Beijnum, "Building Reliable Networks with the Border Gateway Protocol"

18 W. Lu, "Automatic Discovery of Botnet Communities on Large- Scale Communications Networks" 2009

19 J. Mirkovic, "A taxonomy of DDoS attack and DDoS defense mechanisms" 34 (34): 39-53, 2004