Re: [Dots] Target-Attack-type expansion: more discussion
"MeiLing Chen" <chenmeiling@chinamobile.com> Mon, 06 May 2019 10:10 UTC
Return-Path: <chenmeiling@chinamobile.com>
X-Original-To: dots@ietfa.amsl.com
Delivered-To: dots@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2170812012D for <dots@ietfa.amsl.com>; Mon, 6 May 2019 03:10:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.589
X-Spam-Level:
X-Spam-Status: No, score=-2.589 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gW7ZxIT461bI for <dots@ietfa.amsl.com>; Mon, 6 May 2019 03:10:42 -0700 (PDT)
Received: from cmccmta2.chinamobile.com (cmccmta2.chinamobile.com [221.176.66.80]) by ietfa.amsl.com (Postfix) with ESMTP id E6F7C12012A for <dots@ietf.org>; Mon, 6 May 2019 03:10:41 -0700 (PDT)
Received: from spf.mail.chinamobile.com (unknown[172.16.121.5]) by rmmx-syy-dmz-app05-12005 (RichMail) with SMTP id 2ee55cd00820498-f018f; Mon, 06 May 2019 18:10:40 +0800 (CST)
X-RM-TRANSID: 2ee55cd00820498-f018f
X-RM-TagInfo: emlType=0
X-RM-SPAM-FLAG: 00000000
Received: from cmcc-PC (unknown[10.2.51.72]) by rmsmtp-syy-appsvr03-12003 (RichMail) with SMTP id 2ee35cd0081f9ea-51dd0; Mon, 06 May 2019 18:10:40 +0800 (CST)
X-RM-TRANSID: 2ee35cd0081f9ea-51dd0
Date: Mon, 06 May 2019 18:10:40 +0800
From: MeiLing Chen <chenmeiling@chinamobile.com>
To: Töma Gavrichenkov <ximaera@gmail.com>
Cc: dots <dots@ietf.org>
References: <2afa5c9df0626fd-00007.Richmail.00004070460264152429@chinamobile.com>, <CALZ3u+YTx2b=QMTM_UzgX254cgcgAWYxnwA=-VwHhD03ygragw@mail.gmail.com>, <2019050616564984104217@chinamobile.com>, <CALZ3u+Y43hR-CkyD6sjziiJEi3TVHJ7mNEgmUS-GpLGow8jxew@mail.gmail.com>
X-Priority: 3
X-Has-Attach: no
X-Mailer: Foxmail 7.2.9.115[cn]
Mime-Version: 1.0
Message-ID: <2019050618104036747536@chinamobile.com>
Content-Type: multipart/alternative; boundary="----=_001_NextPart276387245315_=----"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dots/2M3Rra2Q_WnYwtsxdsDYfw5FTwM>
Subject: Re: [Dots] Target-Attack-type expansion: more discussion
X-BeenThere: dots@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." <dots.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dots>, <mailto:dots-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dots/>
List-Post: <mailto:dots@ietf.org>
List-Help: <mailto:dots-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dots>, <mailto:dots-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 06 May 2019 10:10:45 -0000
>On Mon, May 6, 2019, 11:57 AM MeiLing Chen <chenmeiling@chinamobile.com> wrote: Not mean the affected layer, but at the exploited protocol layer. >a) Then the Memcached reflection would be layer 7, as the Memcached ASCII protocol belongs to the application layer; >b) Honestly, I don't see how the "exploited protocol layer" could be of *any* use for mitigation. [MeiLing]Actually, It is more inclined to use TCP/IP four-layer protocol. use "exploited protocol layer" for attack type classification and unified naming, then use the parameter of attack type for faster mitigation response, that's mean if Reporting sources are credible for attack type, the mitigator can use directly to dispatch the clean devices. it is still necessary to unify the types of classified attacks. >Not only it is operationally close to impossible in the foreseeable future, it it is also really of questionable use. You would still need a device on your network which would be >responsible for handling "the rest" of DDoS attacks: not falling under any known type, 0-day, etc. [MeiLing]The attack type here refers to DDoS attacks, Indeed, as you said, we did consider scalability to deal with possible types of attacks in the future. >IMO the best you could *possibly* achieve is the classification similar to what anti-virus vendors provide ("Win32/Conficker.A"-style, you know), but even then no one tries to >handle different malware with multiple anti-virus installations on the same machine. This architecture wouldn't really fly. -- Töma
- [Dots] Target-Attack-type expansion: more discuss… 陈美玲
- Re: [Dots] Target-Attack-type expansion: more dis… Konda, Tirumaleswar Reddy
- Re: [Dots] Target-Attack-type expansion: more dis… Töma Gavrichenkov
- Re: [Dots] Target-Attack-type expansion: more dis… Konda, Tirumaleswar Reddy
- Re: [Dots] Target-Attack-type expansion: more dis… MeiLing Chen
- Re: [Dots] Target-Attack-type expansion: more dis… Töma Gavrichenkov
- Re: [Dots] Target-Attack-type expansion: more dis… MeiLing Chen
- Re: [Dots] Target-Attack-type expansion: more dis… Töma Gavrichenkov
- Re: [Dots] Target-Attack-type expansion: more dis… Nik Teague
- Re: [Dots] Target-Attack-type expansion: more dis… Töma Gavrichenkov
- Re: [Dots] Target-Attack-type expansion: more dis… MeiLing Chen
- Re: [Dots] Target-Attack-type expansion: more dis… MeiLing Chen
- Re: [Dots] Target-Attack-type expansion: more dis… Nik Teague