 ICACT20220359 Slide.01
[Big Slide]
[YouTube] |
Chrome  Click!! |
 |
Hello, I'm Seong-Ho Yoon, participating in ICACT 2022. Today's presentation is about detecting DDoS attacks in the cloud. |
| ICACT20220359 Slide.02
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
I'll start explaining the introduction |
| ICACT20220359 Slide.03
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Attempts to attack DDoS are steadily increasing. Statistics show that more than 20% of companies around the world have been attacked by DDoS at least once, which is a common attack.The recent major DDoS attacks include Google, GitHub, and Amazon, and GitHub temporarily suffered server paralysis. These three representative examples show that the scale of DDoS attacks is growing day by day. |
| ICACT20220359 Slide.04
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
As the cloud market develops gradually, attacks on cloud servers are also steadily increasing. DDoS attacks are also used to prevent the use of services through simple resource depletion, but are also used to cause financial damage. So, failure to prevent the attack can cause enormous damage to the victim. Currently, security equipment is detecting and blocking the attack, but security equipment is located outside the cloud, so it cannot detect attacks inside the cloud. Therefore, we suggest mounting a detector that detects DDoS using K-medoids algorithms on hypervisors inside the cloud.
|
| ICACT20220359 Slide.05
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
explain the background knowledge |
| ICACT20220359 Slide.06
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Cloud is a service that does not directly manage users but provides resources as quickly as necessary, and users rent resources from cloud providers. Cloud service models are largely divided into three categories: IaaS, which rents virtualized hardware resources, PaaS, which rents application execution and development environments, and SaaS, which subscribes to and uses SW provided by the cloud through the web.
|
| ICACT20220359 Slide.07
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
The core technology of the cloud is virtualization. Cloud cannot be operated without virtualization. The cloud running on the basis of virtualization works on a hypervisor basis, and the hypervisor is software that enables multiple virtual machines to share resources, as shown in the figure.
|
| ICACT20220359 Slide.08
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
The K-medoids algorithm is a type of clustering algorithm that emerged to solve the noise and outliers of the K-means algorithm. The K-medoids algorithm is more efficient in the time to select heads than the K-means algorithm, in the spatial complexity of cluster superposition, and The center value of the coordinates is calculated like K-means, but unlike K-means, which is calculated as the center of all coordinates, the actual coordinates most similar to the center value of the coordinates are used as the center.
|
| ICACT20220359 Slide.09
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
The K-medoids algorithm classifies objects into groups using data similarity based on distance values. It should be noted that the clustering result varies depending on the K value, and the K value should be determined in advance.
|
| ICACT20220359 Slide.10
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
The K-medoids algorithm must specify k representative objects among the total objects. In this case, the value of n should be greater than the value of k. After that, after designating k objects, the object having the highest similarity becomes the center point. After that, after checking all objects other than those selected as center points, the cost between the existing center point object and all objects is calculated, and if the calculation result is negative, the center point is replaced. Repeat this process until there is no change.
|
| ICACT20220359 Slide.11
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
I will explain PROPOSE DDoS DETECTION TECHNIQUES IN THE CLOUD |
| ICACT20220359 Slide.12
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
When detecting DDoS attacks, detection is usually performed based on six categories: Average of Packets per flow, Average of bytes per flow, Average of duration per flow, Percentage of pair flow, Growth of single flow, Growth of different ports.
|
| ICACT20220359 Slide.13
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
When trying to determine a DDoS attack as a K-medoids algorithm, setting the axis is important because the results vary depending on what you set the axis to. Based on the six classifications on the previous slide, four classifications that can be set as axes when using K-medoids were derived. The four categories can be classified into Different Source IP and Same Destination Ip Pair Number, Different Source Port and Same Destination Port Pair Number, Total Data Size, and Total Packet Number.
|
| ICACT20220359 Slide.14
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Three of the four classifications of the previous slide will be extracted to detect DDoS attacks. Due to the nature of the DDoS attack, multiple zombie PCs constantly change their origin IP addresses, resulting in different source IP and Same Destination IP Pairnumber classification and large amounts of traffic during attacks, so we will use the number of packets and the size of data sent.
|
| ICACT20220359 Slide.15
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Test result The X-axis is the parameter number of bytes transmitted per second, The Y-axis is the number of packets transmitted per second as a parameter, The Z-axis is the number of Different origin, same destination, IP pair transmitted per When second as parameters were applied, abnormal traffic and normal traffic could be easily distinguished as shown in the figure.
|
| ICACT20220359 Slide.16
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
As a result of measuring the performance of the algorithm, a high detection rate was derived. To measure performance, True Positive Rate and False Positive Rate were calculated based on True Positive, True Negative, False Positive, and False Negative. As a result of the calculation, a point nine five nine was derived for the True Positive Rate, and a point zero three five was derived for the False Positive Rate.
|
| ICACT20220359 Slide.17
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
A detector that monitors packets is placed inside the hypervisor to collect data from IP headers, TCP, and UDP packets per second, total data size, total packet number, different origin, same destination, and IP pair, and to detect DDoS attacks in the cloud using K-medoids algorithms.
|
| ICACT20220359 Slide.18
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
I will explain conclusion |
| ICACT20220359 Slide.19
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
In this paper, propose a DDoS attack detection model inside the cloud because IDS/IPS outside the cloud does not recognize the inside of the cloud. As a detection technique, a technology that detects abnormal traffic by clustering network traffic using the K-medoids algorithm. Divide traffic into three categories: the X-axis, the Y-axis, and the Z-axis. The X-axis is the number of bytes of parameters transmitted per second. The Y-axis is the number of packets transmitted per second as a parameter. The Z-axis is the number of Different origin, same destination, IP pair transmitted per second as parameters. DDoS attacks can be detected when divided by the classification method, and DDoS attacks occurring in the cloud can be detected by mounting them on the cloud's hypervisor. |
| ICACT20220359 Slide.20
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
This is references |
| ICACT20220359 Slide.21
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Thank you if you any question, please ask me, you can send that email |
