论文标题
IXMON：在Internet交换点检测和分析DRDOS攻击
IXmon: Detecting and Analyzing DRDoS Attacks at Internet Exchange Points
论文作者
论文摘要
分布式反思性拒绝服务（DRDOS）攻击是对手之间的流行选择。实际上，有史以来最大的DDOS攻击之一是对Github的1.3Tbps的峰值，是基于MEMCACH的DRDOS攻击。最近，对亚马逊AWS的2.3tbps攻击是由于基于CLDAP的DRDOS攻击所致。尽管多年来已经知道了反思性攻击，但不幸的是，DRDOS攻击仍然受欢迎，并且在很大程度上没有受到保护。在本文中，我们研究了从大型互联网交换点（IXP）观察到的野外DRDOS攻击，并提供了许多相关的与安全相关的测量和见解。 为了启用这项研究，我们首先开发了IXMON，这是一种开源DRDOS检测系统，专门为大型IXP网络连接提供商和对焦中心设计而设计。我们在Southern Crossroads（Sox）（SOX）部署了IXMON，这是一个类似IXP的枢纽，可为美国东南部的20多个研究和教育（R＆E）网络提供对等互联网连接服务。在大约21个月的时间里，ixmon发现了900多次DRDOS攻击31个不同的受害者Ases。对我们系统检测到的现实世界中DRDOS攻击的分析表明，大多数DRDOS攻击都短暂持续，仅持续几分钟，但是对R＆E网络的大量，持久和高度分布的攻击并不罕见。然后，我们使用分析结果来讨论可能在IXP级别部署的攻击缓解方法，在攻击流量压倒受害者网络带宽之前。
Distributed reflective denial of service (DRDoS) attacks are a popular choice among adversaries. In fact, one of the largest DDoS attacks ever recorded, reaching a peak of 1.3Tbps against GitHub, was a memcached-based DRDoS attack. More recently, a record-breaking 2.3Tbps attack against Amazon AWS was due to a CLDAP-based DRDoS attack. Although reflective attacks have been known for years, DRDoS attacks are unfortunately still popular and largely unmitigated. In this paper, we study in-the-wild DRDoS attacks observed from a large Internet exchange point (IXP) and provide a number of security-relevant measurements and insights. To enable this study, we first developed IXmon, an open-source DRDoS detection system specifically designed for deployment at large IXP-like network connectivity providers and peering hubs. We deployed IXmon at Southern Crossroads (SoX), an IXP-like hub that provides both peering and upstream Internet connectivity services to more than 20 research and education (R&E) networks in the South-East United States. In a period of about 21 months, IXmon detected more than 900 DRDoS attacks towards 31 different victim ASes. An analysis of the real-world DRDoS attacks detected by our system shows that most DRDoS attacks are short lived, lasting only a few minutes, but that large-volume, long-lasting, and highly-distributed attacks against R&E networks are not uncommon. We then use the results of our analysis to discuss possible attack mitigation approaches that can be deployed at the IXP level, before the attack traffic overwhelms the victim's network bandwidth.
