Day 41: Detection of DoS attacks on Load Balancer using HAProxy

In the previous post, we have built the basic network. Let's remember the problem statement we are working on: Securing the SDN distributed controller architecture against DoS attacks specifically - Syn-Flood and Smurf attacks.

Now, we have the basic SDN conroller architecture ready. We need to now concentrate on securing this network. Have a look at the architecture we have built so far(an implementation oriented diagram):

Let's start with detecting Syn-Flood attacks on the load balancer. Why the load balancer? The reason is that all packets have to go through it and if any controller is under a DoS attack, we can come to know about the same from observing packets that the load balancer has to forward to the controller pool. I have already implemented Syn-Flood attacks on the controllers and stored the tcpdump data in 2 of my files. ping.txt consists of packets generated in a normal scenario when the switch has not installed any flow tables and contacts the controller for the first few times. attack.txt consists of all the packets observed when one of the hosts is attacking another host through a syn-flood attack. During this scenario, the malicious host tries to ping the victim posing as differnet IP addresses. Thus the switch keeps on contacting the controller whenever it encounters a new IP address. Thus the switch too is potentially attacking the controller unknowingly.

After observing the tcpdump files of both scenarios, there are few very clear distinctions between a normal ping phase and a DoS attack phase:

1. Packet rate: Packet rate when calculated for a normal ping scenario, came to 4.583 packets per second. For an attack scenario, it came upto 1943.716 packets per second. This is a huge difference and can be accounted as a paramter in detecting Syn-flood attacks in our SDN network.
2. Packet length: In scenario 1, we can observe that the packet length is almost always 8. In scenario 2, we can observe that the packets length is between 100-300. This can also be used as another factor in identifying a DoS attack.

Since the detection algorithm that I shall be using is not ML based, I would only be considering these few factors to drop few of the packets that might potentially cause a DoS attack on the controllers. Using ML techniques will further enhance the accuracy and avoid false positives.

How to tackle malicious packets?

My approach right now, is to detect DoS attcak in my load balancer and drop few packets that satisfy few conditions for malicious packets. Since I am already using HAProxy as my load balancer, I shall be looking into what features it offers with respect to dealing with DoS attacks.

This article gives a detailed explanation of how we can define threshold packet rates, threshold packet length which would be forwarded by the load balancer. Once this threshold is crossed, the packets would be dropped. I shall implement the same in the next article and also upload a video showing it's working. Till then, you can go through the link and familiarize yourslef with the various approaches we could take.

While researching on the same, I also found out that most load balancer tools provide various features to detect and prevent DoS attacks. The below table is a summary of the same. If you are looking at various tools to decide on which could be the best, this table might help you with the same.

Refer to previous and next posts here.

Author: Shravanya

Co-Author: Swati