DoS 공격의 유형 분석 및 탐지 방법 ... - knom.or.kr

1 DoS (Monitoring and Investigation of DoS Attack) *, **, ** * , ** DoS . DoS , DoS . DoS LAN DoS , TCP DoS . DoS . DoS . 1 .. , . (Denial of Service).

2 DoS Agent Agent (Distributed DoS) [9]. (Nachi, Welchia) DoS DoS [15]. DoS T C P, U D P, I C M P , [1]. DoS DoS , DoS , , , .. 2 DoS . 3 DoS . 4 DoS . 5.

3 2 . DoS DoS , , , (victim) (CPU, Memory ) , victim Application [1]. CPU, , , .. DoS [2] [12]. SYN Flooding SYN Flooding , . TCP (Connection-oriented) . , SYN Flooding TCP Three-way handshaking (Attacker) (Victim) source IP address spoofing SYN (Backlog Queue) [3].

4 Source IP , Unreachable . ping . port scan . unreachable IP spoofing (SYN/ACK) victim unreachable ACK . overflow , . < 1> SYN Flooding . 1. SYN Flooding DOS UDP Flooding UDP(User Datagram Protocol) (connectionless) . TFTP, SNMP, . UDP Flooding UDP . UDP source address source port spoofing . victim spoof victim.

5 < 2> victim A source IP address victim B IP address spoofing UDP victim A victim B . echo chargen . 2. UDP Flooding DOS ICMP Flooding ICMP(Internet Control Message Protocol) IETF RFC 792 .. ICMP ICMP Flooding ICMP victim Smurf, Welchia worm . Smurf source IP address victim IP address , broadcast address ICMP echo request ICMP echo reply victim . < 3> Smurf.

6 3. Smurf DOS Welch ia w orm IP address B C ICMP [4]. 3 . DoS DoS (normal state) . parameter , parameter . parameter CPU Load , ( header ), , spoofing , . parameter . , DoS LAN DoS DoS.

7 DoS Source IP . IP Spoofing . Source IP . Web HTTP TCP . Web Source IP . Source IP . Web Source IP DoS Source IP uniform . DoS source IP . Source IP LRU(Least Recently used) , , [14]. LAN LAN 2002 7 4 9 13 MRTG In-Out busy hour [5].

8 LAN , < 4> 64byte broadcasting, multicasting, configuration, control , 128~255byte web . 4. < 5> IP 94:6, 93:7 TCP UDP . ICMP [5]. 5. Protocol TCP ACK 100% TCP [6]. DoS DoS , . average value parameter . victim victim.

9 UDP Flooding UDP , ICMP Flooding ICMP . SYN Flooding TCP , . TCP TCP SYN Flooding . SYN Flooding ACK SYN . DoS DoS 3 . i. ii. iii. TCP 6. DoS Attack flow chart , DoS 1 . UDP Flooding ICMP Flooding TCP TCP SYN Flooding . DoS LAN.

10 MRTG, Sniffer .. 2003 9 15 10 17 busy hour data . 1. T_mes T_t DoS . < 1> . TTktT +=_ , ( =4,3,2,1k) (1) , k 3 . , T . newoldT + =)1( (2) , . (T_mes > T_t) 2 . UDP UDP_t . UUktUDP +=_, ( =4,3,2,1k) (3) k 3 . UDP UDP_mes (UDP_mes > UDP_t) UDP Flooding . ICMP LAN ICMP 10% ICMP Flooding.