Distributed denial-of-service attack detection based on shared network flow information

A system and computer program product for detecting distributed denial-of-service (DDoS) attacks is provided. Current aggregated flow information for a defined period of time is analyzed. It is determined whether network flow increased above a defined flow threshold value to a second data processing system connected to a network within the defined period of time based on analyzing the current aggregated flow information. In response to determining that the network flow has increased above the defined flow threshold value to the second data processing system connected to the network within the defined period of time, it is determined that the second data processing system is under a DDoS attack.

BACKGROUND

The disclosure relates generally to network security and more specifically to detecting distributed denial of service attacks within a network based on data processing systems connected to the network sharing network flow information with other randomly selected data processing systems.

2. Description of the Related Art

A denial-of-service attack is an attempt to make a machine or network resource unavailable or available with a very low level of service, such as an unacceptable amount of response time, by consuming its resources so that it can no longer provide its intended service. A denial-of-service attack that is sent by multiple devices is referred to as a distributed denial-of-service attack (DDoS). Typically, DDoS attacks are highly distributed and well-coordinated offensive assaults on services, host machines, and network infrastructure and may have disastrous effects, which may include financial losses and disruption of essential services. With the rapid growth of the number of Internet of Things (IOT) devices, problems associated with DDoS attacks may become more and more severe.

A DDoS attack delivers a large number of service requests within a short period of time. This large number of service requests overwhelm the service capacity of the provider. In addition, because a DDoS attack is typically highly distributed, the DDoS attack may originate from anywhere within the network. As a result, obtaining a complete real-time picture of network data flows corresponding to a DDoS attack on an ongoing basis may be difficult.

SUMMARY

According to one illustrative embodiment, a computer-implemented method for detecting distributed denial-of-service (DDoS) attacks is provided. A first data processing system analyzes current aggregated flow information for a defined period of time. The first data processing system determines whether network flow increased above a defined flow threshold value to a second data processing system connected to a network within the defined period of time based on the analyzing of the current aggregated flow information. In response to the first data processing system determining that the network flow has increased above the defined flow threshold value to the second data processing system connected to the network within the defined period of time, the first data processing system determines that the second data processing system is under a DDoS attack. According to other illustrative embodiments, a data processing system and computer program product for detecting DDoS attacks are provided.

DETAILED DESCRIPTION

FIG. 1depicts a pictorial representation of a network of data processing systems in which illustrative embodiments may be implemented. Network data processing system100is a network of computers, data processing systems, and other devices in which the illustrative embodiments may be implemented. Network data processing system100contains network102, which is the medium used to provide communications links between the computers, data processing systems, and other devices connected together within network data processing system100. Network102may include connections, such as, for example, wire communication links, wireless communication links, and fiber optic cables.

In the depicted example, server104and server106connect to network102, along with storage108. Server104and server106may be, for example, server computers with high-speed connections to network102. In addition, server104and server106may provide network services to client devices. The network services may be, for example, financial services, banking services, educational services, governmental services, utility services, security services, information search services, social media services, messaging services, and the like. Also, it should be noted that server104and server106may each represent a plurality of different servers providing a plurality of different network services.

In this example, clients110,112, and114are illustrated as desktop or personal computers with wire communication links to network102. However, it should be noted that clients110,112, and114are meant as examples only. In other words, clients110,112, and114may include other types of data processing systems, such as, for example, network computers, laptop computers, handheld computers, smart phones, smart watches, smart televisions, smart appliances, smart thermostats, personal digital assistants, gaming devices, kiosks, and the like, with wire or wireless communication links to network102.

Storage108is a network storage device capable of storing any type of data in a structured format or an unstructured format. In addition, storage108may represent a set of one or more network storage devices. Storage108may store, for example, identifiers for a plurality of different client devices; network flow information corresponding to each of the plurality of different client devices; aggregated network flow information corresponding to the plurality of client devices; defined network flow threshold values; network flow monitors, and the like. Further, storage108may store other data, such as authentication or credential data that may include user names, passwords, and biometric data associated with users and system administrators, for example.

In addition, it should be noted that network data processing system100may include any number of additional server devices, client devices, and other devices not shown. Program code located in network data processing system100may be stored on a computer readable storage medium and downloaded to a computer or data processing system for use. For example, program code may be stored on a computer readable storage medium on server104and downloaded to client110over network102for use on client110.

In the depicted example, network data processing system100may be implemented as a number of different types of communication networks, such as, for example, an internet, an intranet, a local area network (LAN), a wide area network (WAN), a peer-to-peer network, an ad-hoc peer-to-peer network, or any combination thereof.FIG. 1is intended as an example, and not as an architectural limitation for the different illustrative embodiments.

With reference now toFIG. 2, a diagram of a data processing system is depicted in accordance with an illustrative embodiment. Data processing system200is an example of a data processing device, such as server104or client110inFIG. 1, in which computer readable program code or program instructions implementing processes of illustrative embodiments may be located. In this illustrative example, data processing system200includes communications fabric202, which provides communications between processor unit204, memory206, persistent storage208, communications unit210, input/output (I/O) unit212, and display214.

Processor unit204serves to execute instructions for software applications and programs that may be loaded into memory206. Processor unit204may be a set of one or more hardware processor devices or may be a multi-processor core, depending on the particular implementation. Further, processor unit204may be implemented using one or more heterogeneous processor systems, in which a main processor is present with secondary processors on a single chip. As another illustrative example, processor unit204may be a symmetric multi-processor system containing multiple processors of the same type.

In this example, persistent storage208stores distributed denial-of-service (DDoS) attack detector218. DDoS attack detector218detects DDoS attacks within a network, such as network102inFIG. 1, using shared network flow information received from a plurality of other data processing systems connected to the network. It should be noted that even though DDoS attack detector218is illustrated as residing in persistent storage208, in an alternative illustrative embodiment DDoS attack detector218may be a separate component of data processing system200. For example, DDoS attack detector218may be a hardware component coupled to communication fabric202or a combination of hardware and software components.

In this example, DDoS attack detector218includes network flow information monitor220and hash function222. However, it should be noted that DDoS attack detector218may include more or fewer components than illustrated. DDoS attack detector218utilizes network flow information monitor220to monitor and record local network flow information corresponding to data processing system200. DDoS attack detector218utilizes hash function222to generate a hash value for outgoing and incoming network flow information messages. Hash function222may be, for example, Message Digest 5 (MD5) hashing algorithm, Secure Hash Algorithm 3 (SHA-3), or the like.

In this example, persistent storage208also stores list of data processing systems connected to network224, defined time period226, local flow information table228, current local flow information message230, hash value232, randomly selected target destination internet protocol (IP) addresses234based on hash value232, global flow information table236, hash values238, aggregated flow information240, defined flow threshold value242, and mitigation steps244. List of data processing systems connected to network224represents a listing of each data processing system connected to the network, along with corresponding identifiers and IP addresses. Defined time period226represents a predetermined time interval threshold for when DDoS attack detector218is to transmit current local flow information corresponding to data processing system200to randomly selected other data processing systems connected to the network and when DDoS attack detector218is to aggregate current local flow information received from other data processing systems connected to the network.

Network flow information monitor220of DDoS attack detector218analyzes incoming data packets and records current local flow information246corresponding to data processing system200in local flow information table228. Current local flow information246represents data corresponding to the current real-time network flow of data packets to data processing system200within defined time period226. In this example, current local flow information246includes target destination IP address248, data size250, and timestamp252. Target destination IP address248represents the final destination of each data packet, which may be data processing system200, itself, or another data processing system connected to the network. Data size250represents an amount of data contained within each data packet. Timestamp252represents a time when data processing system200received each data packet via the network. Participating data processing systems utilize the timestamp information to determine the amount of data packets flowing to a particular data processing system within the defined period of time.

At the end of each defined time period226, DDoS attack detector218generates a current local flow information message, such as current local flow information message230. Current local flow information message230contains the information within local flow information table228for a respective defined time period226. In addition, DDoS attack detector218utilizes hash function222to generate a hash value, such as hash value232, for current local flow information message230. DDoS attack detector218utilizes hash function222to randomly select a plurality of target destination IP addresses based on hash value232, such as randomly selected target destination IP addresses234, corresponding to a plurality of other data processing systems connected to the network to receive current local flow information message230. DDoS attack detector218sends hash value232with current local flow information message230for validating current local flow information message230at the target destinations.

DDoS attack detector218utilizes global flow information table236to store current local flow information messages254. Current local flow information messages254represent a plurality of different messages containing current flow information corresponding to a plurality of different data processing systems connected to the network for defined time period226. Further, upon receiving current local flow information messages254from the plurality of different data processing systems, DDoS attack detector218generates a hash value for each of the plurality of received network flow messages, such as hash values238, to validate each of the received messages. If DDoS attack detector218is not able to validate a received network flow information message, then DDoS attack detector218discards that particular network flow information message. DDoS attack detector218may validate incoming network flow information messages by, for example, comparing generated hash values238with originally generated hash values sent with the network flow messages from the other data processing systems.

Moreover, DDoS attack detector218aggregates data in current local flow information246with data in valid current local flow information messages254for each defined time period226to form aggregated flow information240. Aggregated flow information240provides a real-time current snapshot of the amount of network data packets flowing to different data processing systems via the network for defined time period226. DDoS attack detector218analyzes aggregated flow information240to detect whether data processing system200, itself, and/or another data processing system connected to the network is under a DDoS attack. For example, based on the analysis of aggregated flow information240, if DDoS attack detector218determines that the amount of network data packet flow to data processing system200or another data processing system from a plurality of different data processing systems exceeds defined flow threshold value242for defined time period226, then DDoS attack detector218detects that that particular data processing system is under a DDoS attack.

If DDoS attack detector218detects a DDoS attack, then DDoS attack detector218performs mitigation steps244. Mitigation steps244represent a set of affirmative action steps that DDoS attack detector218takes to halt the DDoS attack. For example, if DDoS attack detector218detects that data processing system200, itself, is under a DDoS attack, then DDoS attack detector218may, for example, identify the source of the attack and drop packets coming from that source or may generate a firewall preventing packets from that source from getting to data processing system200. DDoS attack detector218also may display a warning popup indicating that a DDoS attack is in progress in display214of data processing system200to inform a user of the attack. If DDoS attack detector218detects that another data processing system connected to the network is under a DDoS attack, then DDoS attack detector218may, for example, send a notification to that particular data processing system prompting that particular data processing system to take appropriate mitigation steps and informing its user of the DDoS attack.

Program code256is located in a functional form on computer readable media258that is selectively removable and may be loaded onto or transferred to data processing system200for running by processor unit204. Program code256and computer readable media258form computer program product260. In one example, computer readable media258may be computer readable storage media262or computer readable signal media264. Computer readable storage media262may include, for example, an optical or magnetic disc that is inserted or placed into a drive or other device that is part of persistent storage208for transfer onto a storage device, such as a hard drive, that is part of persistent storage208. Computer readable storage media262also may take the form of a persistent storage, such as a hard drive, a thumb drive, or a flash memory that is connected to data processing system200. In some instances, computer readable storage media262may not be removable from data processing system200.

Alternatively, program code256may be transferred to data processing system200using computer readable signal media264. Computer readable signal media264may be, for example, a propagated data signal containing program code256. For example, computer readable signal media264may be an electro-magnetic signal, an optical signal, and/or any other suitable type of signal. These signals may be transmitted over communication links, such as wireless communication links, an optical fiber cable, a coaxial cable, a wire, and/or any other suitable type of communications link. In other words, the communications link and/or the connection may be physical or wireless in the illustrative examples. The computer readable media also may take the form of non-tangible media, such as communication links or wireless transmissions containing the program code.

In some illustrative embodiments, program code256may be downloaded over a network to persistent storage208from another device or data processing system through computer readable signal media264for use within data processing system200. For instance, program code stored in a computer readable storage media in a data processing system may be downloaded over a network from the data processing system to data processing system200. The data processing system providing program code256may be a server computer, a client computer, or some other device capable of storing and transmitting program code256.

As another example, a computer readable storage device in data processing system200is any hardware apparatus that may store data. Memory206, persistent storage208, and computer readable storage media262are examples of physical storage devices in a tangible form.

The first step in decreasing or eliminating the effects of a DDoS attack is to detect the DDoS attack as quickly as possible. Illustrative embodiments detect DDoS attacks by analyzing shared network flow information between data processing systems (e.g. how many bytes are sent to a target data processing system within a predefined period of time). Illustrative embodiments can be applied to all data processing nodes connected to a network. In other words, all network data processing nodes can participate in the network flow information sharing process of illustrative embodiments to detect DDoS attacks. Thus, illustrative embodiments provide all participating data processing nodes in the network with a sampled picture of the amount of network data packet flow. It should be noted that participating data processing nodes share their respective local flow information with other participating data processing nodes randomly. Also, it should be noted that participating data processing nodes may communicate with each other using a customized Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) socket. When the number of participating data processing nodes within a network is above a threshold number of participating nodes, then the sampled network flow information provides a reliable reflection of network flow.

Illustrative embodiments utilize a hashing function that receives network flow information as input and outputs random target destination IP addresses corresponding to participating data processing nodes to share the network flow information with. This deterministic random approach prevents malicious participants within the network from providing false network flow information to undermine the DDoS detection process of illustrative embodiments. Each data processing node joining the network may learn the current network flow status from shared network flow information provided by other participating data processing nodes and take the appropriate mitigation steps once a data processing node becomes aware that abnormal data packet traffic exists (i.e., DDoS attack) within the network.

A participating data processing node may be, for example, a personal computer, a mobile phone, or any other computing device that can connect to the network, such as the Internet. A participating data processing node may act as a sending data processing node, which records and shares its local network flow information with other data processing nodes. In addition, a participating data processing node also may act as a receiving data processing node, which receives and aggregates network flow information received from other data processing nodes connected to the network.

The sending data processing node generates and sends a local network flow information message (e.g., data packet) containing the current real-time flow information corresponding to that sending data processing node for a specified interval of time. For each specified interval of time (i.e., current network flow information period), the sending data processing node generates a new local network flow information message and distributes that message to a random set of target data processing nodes. The sending data processing node generates each new message based on local network flow information corresponding to that sending data processing node and other network flow information messages received from other data processing nodes connected to the network.

The sending data processing node randomly selects the set of target data processing nodes based on a hash value of each new local network flow information message. When a receiving data processing node receives an incoming network flow information message, the receiving data processing node calculates a hash value of the message and the set of target destinations based on the hash value to determine whether the message is valid.

During an initialization phase, each data processing node generates a local network flow information table and a global network flow information table. The data processing nodes utilize the tables to store the network flow information, such as, for example, target destination IP address, data size, timestamp, and the like, which the data processing nodes utilize to detect DDoS attacks within the network.

During each defined time period, a data processing node records its local network flow information in the local network flow information table. In addition, the data processing node receives one or more network flow information messages from other data processing nodes connected to the network and records the flow information contained in the received network flow information messages in the global network flow information table. Because table space is limited, the data processing system aggregates the received flow information and only maintains a top number of entries of flow information by data size, occurrences, or the like.

At the end of each defined time period, the data processing node generates a message consisting of aggregated local network flow information corresponding to the data processing node. In addition, the data processing node generates a list of random target destination data processing nodes to receive the message using a hash function and then sends the message to the target nodes. In parallel, the data processing node analyzes the global network flow information to determine whether there are network flow surges to one or more other data processing nodes connected to the network in a short period of time. The data processing node may further analyze a network flow history corresponding to the one or more other data processing nodes to determine whether the network flow surges are normal or not. If not, then the data processing node may determine that a DDoS attack is occurring.

With reference now toFIG. 3, a flowchart illustrating a process for broadcasting current local network flow information to a plurality of randomly selected data processing systems connected to a network is shown in accordance with an illustrative embodiment. The process shown inFIG. 3may be implemented in a data processing system, such as, for example, server104or client110inFIG. 1or data processing system200inFIG. 2.

The process begins when the data processing system monitors current local network flow information corresponding to data packets received by the data processing system via a network (step302). The current local network flow information may be, for example, current local network flow information246inFIG. 2. The data processing system may utilize a network flow information monitor, such as network flow information monitor220inFIG. 2, to monitor and analyze the current local network flow information. The network may be, for example, network102inFIG. 1. The data processing system also records the current local network flow information in a local flow information table, such as local flow information table228inFIG. 2(step304).

Subsequently, the data processing system makes a determination as to whether a defined period of time has elapsed (step306). The defined period of time may be, for example, defined time period226inFIG. 2. If the data processing system determines that the defined period of time has not elapsed, no output of step306, then the process returns to step302where the data processing system continues to monitor and record the current local network flow information. If the data processing system determines that the defined period of time has elapsed, no output of step306, then the data processing system generates a current local network flow information message based on the current local network flow information recorded in the local flow information table for the defined period of time (step308). The current local network flow information message may be, for example, current local flow information message230inFIG. 2.

In addition, the data processing system computes a hash value of the current local network flow information message using a hash function, such as hash function222inFIG. 2(step310). The hash value of the current local network flow information message may be, for example, hash value232inFIG. 2. Further, the data processing system broadcasts the current local network flow information message to a plurality of randomly selected data processing systems connected to the network based on the hash value of the current local network flow information message (step312). The data processing system also may, for example, send the computed hash value with the current local network flow information message in order for the plurality of randomly selected data processing systems to validate the incoming message. Thereafter, the process returns to step302where the computer monitors current local network flow information for the next defined time period.

With reference now toFIG. 4, a flowchart illustrating a process for determining whether received network flow information is valid is shown in accordance with an illustrative embodiment. The process shown inFIG. 4may be implemented in a data processing system, such as, for example, server104or client110inFIG. 1or data processing system200inFIG. 2.

The process begins when the data processing system receives a current local network flow information message from another data processing system via a network (step402). The current local network flow information message received from the other data processing system may be, for example, a message in current local network flow information messages254inFIG. 2. The other data processing system may be, for example, client112and the network may be, for example, network102inFIG. 1.

Afterward, the data processing system computes a hash value of the received current local network flow information message using a hash function, such as hash function222inFIG. 2(step404). The hash value of the received current local network flow information message may be, for example, a hash value in hash values238inFIG. 2. In addition, the data processing system computes a set of target destination IP addresses based on the hash value, such as hash value232inFIG. 2, of the received current local network flow information message (step406). It should be noted that illustrative embodiments utilize step406to detect and prevent a data poisoning attack from a malicious network node, which is trying to compromise the detection process on attacked network nodes by providing false network flow information to the attacked network nodes.

Subsequently, the data processing system makes a determination as to whether the received current local network flow information message is valid based on the data processing system finding its IP address in the set of target destination IP addresses (step408). If the data processing system determines that the received current local network flow information message is valid based on the data processing system finding its IP address in the set of target destination IP addresses, yes output of step408, then the data processing system stores the current local network flow information message received from the other data processing system in a global flow information table, such as global flow information table236inFIG. 2(step410). If the data processing system determines that the received current local network flow information message is invalid based on the data processing system not finding its IP address in the set of target destination IP addresses, no output of step408, then the data processing system discards the received current local network flow information message determined to be invalid (step412). Thereafter, the process returns to step402where the computer continues to receive current local network flow information messages from one or more other data processing systems connected to the network.

With reference now toFIG. 5, a flowchart illustrating a process for detecting that a data processing system is under a DDoS attack is shown in accordance with an illustrative embodiment. The process shown inFIG. 5may be implemented in a data processing system, such as, for example, server104or client110inFIG. 1or data processing system200inFIG. 2.

The process begins when the data processing system makes a determination as to whether a defined period of time has elapsed (step502). The defined period of time may be, for example, defined time period226inFIG. 2. If the data processing system determines that the defined period of time has not elapsed, no output of step502, then the process returns to step502where the data processing system continues to wait for the defined period of time to elapse. If the data processing system determines that the defined period of time has elapsed, yes output of step502, then the data processing system aggregates flow information contained in current local network flow information messages received from other data processing systems connected to a network stored in a global flow information table (step504). The current local network flow information messages stored in the global flow information table may be, for example, current local network flow information messages254stored in the global flow information table236inFIG. 2. The other data processing systems connected to the network may be, for example, client112and client114connected to network102inFIG. 1.

Afterward, the data processing system analyzes the aggregated flow information, such as aggregated flow information240inFIG. 2, for the defined period of time (step506). Subsequent to analyzing the aggregated flow information for the defined period of time in step506, the data processing system makes a determination as to whether network flow increased above a defined flow threshold value to a particular data processing system connected to the network within the defined period of time (step508). The defined flow threshold value may be, for example, defined flow threshold value242inFIG. 2.

If the data processing system determines that the network flow has not increased above the defined flow threshold value to a particular data processing system connected to the network within the defined period of time, no output of step508, then the process returns to step502where the data processing system waits for the next defined period of time to elapse. If the data processing system determines that the network flow has increased above the defined flow threshold value to a particular data processing system connected to the network within the defined period of time, yes output of step508, then the data processing system determines that the particular data processing system is under a DDoS attack (step510). Further, the data processing system makes a determination as to whether that particular data processing system is a target destination for the data processing system based on current flow information recorded in a local flow information table (step512). The current flow information recorded in the local flow information table may be, for example, current local flow information246recorded in local flow information table228inFIG. 2.

If the data processing system determines that the particular data processing system is not a target destination for the data processing system based on the current flow information recorded in the local flow information table, no output of step512, then the process returns to step502where the data processing system waits for the next defined period of time to elapse. If the data processing system determines that that particular data processing system is a target destination for the data processing system based on the current flow information recorded in the local flow information table, yes output of step512, then the data processing system transmits a notification to that particular data processing system indicating that that particular data processing system is under a DDoS attack (step514). Thereafter, the process returns to step502where the data processing system waits for the next defined period of time to elapse.

Thus, illustrative embodiments of the present invention provide a computer-implemented method, data processing system, and computer program product for detecting DDoS attacks within a network based on data processing systems connected to the network sharing network flow information with other randomly selected data processing systems. The descriptions of the various embodiments of the present invention have been presented for purposes of illustration, but are not intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein was chosen to best explain the principles of the embodiments, the practical application or technical improvement over technologies found in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.