Re: [savnet] draft-cui-savnet-anti-ddos-00

[Joel Halpern <[e-mail]>]

Rather than debating SADA with you, and noting that I have not yet 
discussed and confirmed this with my co-chair, I will say that the kind 
of monitoring you describe, collecting information about non-spoofed 
traffic, is out of charter for the savnet working group.  While I 
understand that it is related to the spoofing problem, it is a distinct 
problems.  And IETF working groups need to stay within their charter.

Yours,

Joel

On 9/29/2022 10:42 PM, 惠林博 wrote:
> Hi Joel,
>
> I would like to add some explanation for clarification. After a little 
> more thought, we consider that the traceback mechanisms can be 
> classified into two categories. One is from the network layer to 
> identify the controller/attacker from general communication 
> statistics. The other is to monitor the suspicious software’s 
> behaviors inside the bots to traceback.
>
> The SADA’s high-level traceback goal is to identify the 
> controller/attacker. The bot and the controller/attacker may 
> communicate with real addresses during an attack, and a bot is 
> possibly used for multiple attacks in the future. We consider logging 
> the communication activities of the hosts that have ever spoofed 
> addresses and hope toidentify the controller/attacker by analyzing 
> these logs. The logs from multiple bots will be aggregated to find the 
> addresses they have communicated with in common. After filtering out 
> the addresses of public servers, the remaining addresses may belong to 
> the controller/attacker.
>
> The proposed SADA scheme belongs to the first category. Noticing the 
> word “invasive” for logging, I understand you may refer to the second 
> category. “invasive” implies logging on OS-level information such as 
> instructions, which may involve monitoring suspicious software inside 
> a honeypot or sandbox. I don’t know whether my understanding is 
> correct. I would be very grateful if you could provide the related 
> progress upon traceback and give further suggestions.
>
>
> Best,
>
> Linbo
>
> ---- Replied Message ----
> From 	惠林博<[e-mail]> <mailto:[e-mail]>
> Date 	9/26/2022 11:51
> To 	Joel Halpern<[e-mail]> <mailto:[e-mail]>
> Cc 	[e-mail]<[e-mail]> <mailto:[e-mail]>
> Subject 	Re: Re: [savnet] draft-cui-savnet-anti-ddos-00
>
> Hi Joel,
>
>
> Thanks for your question.
>
>
> We consider there are two levels for traceback. The primary goal is to 
> locate the bots, which SAV routers in the access network can easily 
> accomplish.
>
>
> The high-level goal is to traceback the controller/attacker. We are 
> currently considering logging the communication activities of a host 
> when it is regarded as a suspect. The logging data includes authentic 
> src/dst IP, src/dst Port, protocol, and so on. We hope to identify the 
> controller/attacker by analyzing these logs from widespread SAV 
> routers. This mechanism may introduce more pervasive and invasive 
> logging on suspicious hosts, and it may not always be practical. We 
> will conduct more research on it.
>
>
>
> Best,
>
> Linbo
>
>
>     -----原始邮件-----
>     *发件人:*"Joel Halpern" <[e-mail]>
>     *发送时间:*2022-09-25 01:21:06 (星期日)
>     *收件人:* "惠林博" <[e-mail]>
>     *抄送:* "[e-mail]" <[e-mail]>
>     *主题:* Re: [savnet] draft-cui-savnet-anti-ddos-00
>
>     I am slightly confused by the explanation below. Which at least
>     suggests that clarification of the text would be helpful.
>
>     Some explained to me off list that the purpose of the recording /
>     logging was to determine where the actual bot control could be
>     found.  But recording / logging the spoofed packets will not do
>     that.  The controller needs to communicate with the real address. 
>     Which would seem to imply a much more pervasive and invasive
>     logging of the activity??
>
>     Yours,
>
>     Joel
>
>     On 9/24/2022 6:03 AM, 惠林博 wrote:
>>
>>
>>     Hi Barry,
>>
>>
>>     Thanks for your suggestion.
>>
>>
>>     In SADA, the SAV routers are designed not to simply discard the
>>     spoofed packets but to record the spoofing statistics and
>>     behaviors, which we regard as a honeynet. Compared with existing
>>     honeynets, the SAV routers lack some lure and sacrifice
>>     mechanisms. If the terminology "honeynet" in SADA is considered
>>     unsuitable, we will remove it in the revised draft.
>>
>>
>>     Netflow/IPFIX is a network traffic measurement technology that
>>     uses packet sampling to generate flow-level statistics that can
>>     be used to detect attacks. In addition, the DOTS
>>     WG(https://datatracker.ietf.org/wg/dots/about/) has proposed a
>>     signaling architecture to detect, classify, traceback, and
>>     mitigate DDoS attacks. DOTS focuses on DDoS threat signals
>>     transmission under attack traffic congestion conditions. In
>>     comparison, the SADA collects statistics on every spoofed packet
>>     and is targeted for DDoS detection. Netflow/IPFIX and DOTS are
>>     both potential data collection methods for SADA.
>>
>>
>>
>>     Best,
>>
>>     Linbo Hui
>>
>>
>>
>>
>>         -----原始邮件-----
>>         *发件人:*"Barry Greene" <[e-mail]>
>>         *发送时间:*2022-09-20 09:45:58 (星期二)
>>         *收件人:* "惠林博" <[e-mail]>
>>         *抄送:* "[e-mail]" <[e-mail]>
>>         *主题:* Re: [savnet] draft-cui-savnet-anti-ddos-00
>>
>>
>>         Read through twice. I would suggestion more research into
>>         today’s operational realities. For example:
>>
>>         "A distributed DDoS detection mechanism based on honeynets.
>>          The SADA introduces a SAV controller for gathering spoofing
>>         statistics from SAV routers that act as honeynets.”
>>
>>         This is active today through multiple HoneyNet projects. For
>>         context on today’s operational deployments, talk wot Q360 for
>>         a in China example.
>>
>>         “The SADA can detect DDoS attacks with a comprehensive
>>         analysis using aggregated information from distributed SAV
>>         routers.”
>>
>>         Isn’t that Netflow/IPFIX with open source and commercial
>>         telemetry systems?
>>
>>         What is improving on what we have deployed today?
>>
>>
>>
>>>         On Sep 20, 2022, at 8:36 AM, 惠林博
>>>         <huilb=[e-mail]> wrote:
>>>
>>>         Hi SAVNET Experts,
>>>
>>>         We have submitted a new draft:
>>>         draft-cui-savnet-anti-ddos-00. The link is
>>>         https://datatracker.ietf.org/doc/draft-cui-savnet-anti-ddos/
>>>
>>>         The draft proposes the SAVA-based Anti-DDoS Architecture
>>>         (SADA), which can efficiently detect, mitigate, and
>>>         traceback Denial-of-Service (DDoS) attacks that spoof source
>>>         addresses. The SADA consists of a distributed DDoS detection
>>>         mechanism based on honeynets, a multi-stage DDoS mitigation
>>>         mechanism, and a suspect-based DDoS traceback mechanism. By
>>>         adopting the Source Address Validation Architecture (SAVA)
>>>         of SAVNET and introducing the data plane and the control
>>>         plane, the SADA makes minor changes to the SAVA while
>>>         providing major benefits.
>>>
>>>         We'd be grateful if you could provide some feedback. Please
>>>         let us know if you have any questions or comments about the
>>>         draft.
>>>
>>>
>>>         Best regards
>>>
>>>         Linbo Hui
>>>         --
>>>         savnet mailing list
>>>         [e-mail]
>>>         https://www.ietf.org/mailman/listinfo/savnet
>>
>>