attack type unification
draft-chen-dots-attack-type-unification-00

Document Type Active Internet-Draft (individual)
Last updated 2019-10-17
Stream (None)
Intended RFC status (None)
Formats plain text xml pdf htmlized bibtex
Stream Stream state (No stream defined)
Consensus Boilerplate Unknown
RFC Editor Note (None)
IESG IESG state I-D Exists
Telechat date
Responsible AD (None)
Send notices to (None)
DOTS                                                             M. Chen
Internet-Draft                                                    Li. Su
Intended status: Informational                                      CMCC
Expires: April 19, 2020                                 October 17, 2019

                        attack type unification
               draft-chen-dots-attack-type-unification-00

Abstract

   This document put forward a method to unify DDoS attack type
   classification and attack definition description, this will help
   different mitigators to mitigate DDoS attacks together.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on April 19, 2020.

Copyright Notice

   Copyright (c) 2019 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Chen & Su                Expires April 19, 2020                 [Page 1]
Internet-Draft              dots-attack-type                October 2019

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . .   3
   3.  DDoS Attack Type Classification Framework . . . . . . . . . .   3
   4.  DDoS Attack Definition Description  . . . . . . . . . . . . .   4
   5.  Security Considerations . . . . . . . . . . . . . . . . . . .   6
   6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   6
   7.  Acknowledgement . . . . . . . . . . . . . . . . . . . . . . .   6
   8.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   6
     8.1.  Normative References  . . . . . . . . . . . . . . . . . .   6
     8.2.  Informative References  . . . . . . . . . . . . . . . . .   6
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .   7

1.  Introduction

   Distributed Denial of Service (DDoS) is a type of resource-consuming
   attack, which exploits a large number of attack resources and uses
   standard protocols to attack target objects.  With the cost of DDoS
   attack become more cheaper, DDoS attack become more and more
   frequently, a single mitigator unable to cope with all the DDoS
   attack, so DOTS come up to solve the problem.

   From the charter of DOTS working group, it writes that elements may
   be deployed as part of a wider strategy incorporating multiple points
   of DDoS detection, classification, traceback and mitigation, both on
   premise or service provider based.  As so far, DDoS classification
   have not written to DOTS.  This draft will from the perspective of
   the type of DDoS attack to do DDoS classification.

   Different understanding of DDoS attacks will result in different
   classification and that's why do we need uniform attack types.  At
   present, telecom operators, cloud service providers and third-party
   manufacturers have their own anti-ddos solutions.The construction of
   DDoS attack mitigation and disposal system involves two devices,
   namely detection equipment and cleaning equipment.  In the actual
   network deployment, the core nodes of the network will deploy
   detection equipment and cleaning equipment at the same time to detect
   and dispose attacks.  After an alarm is given, the cleaning equipment
   will be triggered to carry out traffic drainage and cleaning
   operations.  At present, the detection equipment adopts the coarse-
   grained attack type determination method, which greatly reduces the
   false alarm rate of attack.Different disposal of cleaning equipment
   is different for different attack types.  For example, TCP attack
   types can be discarded directly after matching, but HTTP CC Flood can
   be further determined only after interactive operation is required at
   the disposal.  Interactive operation may be redirection or
Show full document text