基於軟體定義網絡之Crossfire攻擊預防方法

A Crossfire Attack Prevention Approach for Software Defined Networks

沈泓宇(Hung-Yu Shen)

指導教授 ： 逄愛君

國立臺灣大學/電機資訊學院/資訊工程學研究所/碩士(2019年)

https://doi.org/10.6342/NTU201903641

摘要

鏈路洪泛攻擊是一種新型態的阻斷服務攻擊，其著重於阻斷網絡中的重要線路。Crossfire 為一種鏈路洪泛攻擊的形式，它藉由將封包送至鄰近目標區域的誘餌服務端，可以達到封鎖整個目標區域的效果。我們的做法目標在於讓攻擊者無法蒐集正確情報以阻止其發動攻擊。在軟體定義網絡的環境中，我們可以任意決定ICMP 超時訊息的來源位址。我們藉由不斷改變超時訊息的來源位址，使攻擊者將相同的路由器錯認成不同的。攻擊者便會建出幾乎找不到攻擊流經過的鏈路圖，使他難以發動攻擊。攻擊者便只好放棄發動Crossfire 攻擊。我們在mininet 環境中以ryu作為控制器進行實驗，驗證攻擊流數量的降低程度。

關鍵字

軟體定義網絡 ； 移動目標防禦 ； Crossfire 攻擊 ； 路由位址變動

並列摘要

Link-Flooding Attack(LFA) is a new type of Distributed Denial-of-Service(DDoS) which focuses on important links in the network. Crossfire is one of LFA that blocks the whole area from networks by sending packets to decoy servers near to the target area. We present Router Mutation that stops attackers by forcing them to get wrong network information. In the Software-Defined Networks(SDN) environment, We can send ICMP time exceeded message with any source IP address we want. We send a message with a virtual IP address that keeps changing. The adversary may consider the same router as a different one, so he will build a link-map with few attack flow going through it. It is hard for him to launch an attack based on this information, so the adversary would give up the Crossfire. We verify our approach on Mininet with Ryu controller.

並列關鍵字

Software Defined Networking ； Moving Target Defense ； Crossfire Attack ； Router IP Mutation

參考文獻

[1] Min Suk Kang, Soo Bum Lee, and Virgil D Gligor. The crossfire attack. In 2013 IEEE Symposium on Security and Privacy, pages 127–141. IEEE, 2013.

[2] Ahren Studer and Adrian Perrig. The coremelt attack. In European Symposium on Research in Computer Security, pages 37–52. Springer, 2009.

[3] Christos Liaskos, Vasileios Kotronis, and Xenofontas Dimitropoulos. A novel framework for modeling and mitigating distributed link flooding attacks. In IEEE INFOCOM 2016-The 35th Annual IEEE International Conference on Computer Communications, pages 1–9. IEEE, 2016.

[4] Dimitrios Gkounis, Vasileios Kotronis, Christos Liaskos, and Xenofontas Dimitropoulos. On the interplay of link-flooding attacks and traffic engineering. ACM SIGCOMM Computer Communication Review, 46(2):5–11, 2016.

[5] Abdullah Aydeger, Nico Saputro, Kemal Akkaya, and Mohammed Rahman. Mitigating crossfire attacks using sdn-based moving target defense. In 2016 IEEE 41st Conference on Local Computer Networks (LCN), pages 627–630. IEEE, 2016.