1、 International Telecommunication Union ITU-T Series XTELECOMMUNICATION STANDARDIZATION SECTOR OF ITU Supplement 18(04/2013) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY ITU-T X.1205 Supplement on guidelines for abnormal traffic detection and control on IP-based telecommunication
2、networks ITU-T X-series Recommendations Supplement 18 ITU-T X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NETWORKS X.300X.399 MESSAGE HANDLING SYSTEMS X.400X.499 DIRECTORY X.5
3、00X.599 OSI NETWORKING AND SYSTEM ASPECTS X.600X.699 OSI MANAGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.1029 Network security X.1030X.1049 Security management X.1050X.1069
4、Telebiometrics X.1080X.1099 SECURE APPLICATIONS AND SERVICES Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols X.1150X.1159 Peer-to-peer security X.1160X.1169 Networked ID security X.1170X.1179 IPTV security X
5、.1180X.1199 CYBERSPACE SECURITY Cybersecurity X.1200X.1229 Countering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X.1339 CYBERSECURITY INFORMATION EXCHANGE Overview of cybersecurity
6、 X.1500X.1519 Vulnerability/state exchange X.1520X.1539 Event/incident/heuristics exchange X.1540X.1549 Exchange of policies X.1550X.1559 Heuristics and information request X.1560X.1569 Identification and discovery X.1570X.1579 Assured exchange X.1580X.1589 For further details, please refer to the l
7、ist of ITU-T Recommendations. X series Supplement 18 (04/2013) i Supplement 18 to ITU-T X-series Recommendations ITU-T X.1205 Supplement on guidelines for abnormal traffic detection and control on IP-based telecommunication networks Summary Telecommunication networks based on the IP protocol face ma
8、ny security threats. One of the most important threats is abnormal traffic, which can cause serious impact on the secure and steady operation of telecommunication networks. Abnormal traffic attacks consume large quantities of network resources and easily lead to network unsteadiness and link blockag
9、e. Moreover, abnormal traffic attacks have increasingly been aimed at achieving certain business objectives, and are a great challenge to telecommunication operators. Therefore, detecting and controlling abnormal traffic effectively has become an urgent task for telecommunication operators. Suppleme
10、nt 18 to ITU-T X.1205 series of Recommendations identifies abnormal traffic detection technologies and control measures for IP-based telecommunication networks. The aim of this Supplement is to provide telecommunication operators with a comprehensive guideline for monitoring, detecting and controlli
11、ng abnormal IP traffic. History Edition Recommendation Approval Study Group 1.0 ITU-T X Suppl. 18 2013-04-26 17 ii X series Supplement 18 (04/2013) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information and co
12、mmunication technologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis.
13、 The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resoluti
14、on 1. In some areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this publication, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and a
15、recognized operating agency. Compliance with this publication is voluntary. However, the publication may contain certain mandatory provisions (to ensure, e.g., interoperability or applicability) and compliance with the publication is achieved when all of these mandatory provisions are met. The words
16、 “shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the publication is required of any party. INTELLECTUAL PROPERTY RIGHTS ITU draws attention to the possibility that the
17、practice or implementation of this publication may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the publication developm
18、ent process. As of the date of approval of this publication, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this publication. However, implementers are cautioned that this may not represent the latest information and are therefore stron
19、gly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2013 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. X series Supplement 18 (04/2013) iii Table of Contents Page 1 Scope 1 2 Ref
20、erences. 1 3 Definitions 1 4 Abbreviations and acronyms 1 5 Conventions 2 6 Impacts of abnormal traffic on telecommunication networks 2 6.1 Impacts on network availability . 2 6.2 Impacts on network quality of service 2 6.3 Impacts on service income . 2 6.4 Impacts on customers quality of experience
21、 2 7 Abnormal traffic detection technology . 2 7.1 Anomaly detection 2 7.2 Misuse detection . 3 7.3 Synthetic analysis . 3 8 Abnormal traffic control measures . 3 8.1 Control mode 3 8.2 Control granularity . 4 Appendix I Overview of anomaly detection algorithms, systems and practices 6 I.1 Introduct
22、ion 6 I.2 Algorithm overview 6 I.3 Work in network operator groups . 7 Bibliography. 8 X series Supplement 18 (04/2013) 1 Supplement 18 to ITU-T X-series Recommendations ITU-T X.1205 Supplement on guidelines for abnormal traffic detection and control on IP-based telecommunication networks 1 Scope Th
23、is Supplement provides guidelines to telecommunication operators on how to utilize abnormal traffic detection and control technologies to protect their IP-based networks. This Supplement also describes the impacts of abnormal traffic and provides an overview of abnormal traffic detection technologie
24、s and control measures. 2 References None. 3 Definitions 3.1 Terms defined elsewhere None. 3.2 Terms defined in this Supplement This Supplement defines the following terms: 3.2.1 abnormal traffic: Traffic other than the normal service and signalling traffic that is allowed by the network operator. A
25、bnormal traffic is caused by distributed denial of service (DDoS), worm attacks, spam, etc. 3.2.2 abnormal traffic control system: Software systems or hardware products that control abnormal traffic based on information produced by the abnormal traffic detection system. 3.2.3 abnormal traffic detect
26、ion system: Software systems or hardware products that detect abnormal traffic. 4 Abbreviations and acronyms This Supplement uses the following abbreviations and acronyms: ACL Access Control List BRAS Broadband Remote Access Server CPU Central Processing Unit DDoS Distributed Denial of Service DoS D
27、enial of Service FIN Final (one of the control bits in the TCP protocol header) FTP File Transfer Protocol IP Internet Protocol IXP Internet eXchange Point MPLS Multiprotocol Label Switching OD Origin Destination PCA Principal Component Analysis 2 X series Supplement 18 (04/2013) QoE Quality of Expe
28、rience QoS Quality of Service RIPE Rseaux IP Europens RST Reset (one of the control bits in the TCP protocol header) TCP Transmission Control Protocol UDP User Datagram Protocol 5 Conventions None. 6 Impacts of abnormal traffic on telecommunication networks 6.1 Impacts on network availability Certai
29、n types of abnormal traffic can impede or prevent the ability of networks to provide services as a result of congestion or service failure of the network equipment and links. A distributed denial of service (DDoS) attack is a good example of one type of abnormal traffic that can affect network avail
30、ability. A DDoS attack is derived from the traditional denial of service (DoS) attack. A traditional DoS attack commonly adopts the one-to-one attack mode. A DoS attack will have a negative impact on a target that has limited resources such as, processing ability, memory or bandwidth. However, with
31、the rapid increase of computer ability, memory capacity, and network bandwidth, DoS attacks initiated by a single host have become ineffective. A DDoS attack makes use of a large number of zombie computers, each performing small-scale attacks, but coordinated in their efforts in performing large sca
32、le distributed DoS attacks, thus resulting in a higher bandwidth, focused attack. 6.2 Impacts on network quality of service Some abnormal traffic can affect the networks quality of service (QoS), by influencing the available bandwidth, packet latency and jitter. 6.3 Impacts on service income Some ab
33、normal traffic originates from service applications that are not consistent with the interests of network operators. These unexpected services may reduce the income of the operators, who consider them as a type of abnormal traffic and thus may put them under control. 6.4 Impacts on customers quality
34、 of experience From a customers point of view, a decrease in network availability and QoS usually leads to a degraded quality of experience (QoE). In addition, some abnormal traffic, such as spam, is not only annoying, but also occupies a large portion of a networks bandwidth. Spam also causes netwo
35、rk equipment to work in a heavy load state for long periods of time, and blocks a customers normal services such as Internet access, e-mail and video-on-demand. This also has a negative impact on the customers QoE. 7 Abnormal traffic detection technology 7.1 Anomaly detection Anomaly detection metho
36、ds model the normal state of a network. If current network traffic is different from the normal modelled (i.e., baseline) traffic, it is considered abnormal. X series Supplement 18 (04/2013) 3 This method is usually based on a statistical analysis mechanism. The detection accuracy of this method is
37、closely related to the establishment algorithm of the normal traffic model. The parameters of the algorithm must be chosen carefully and intelligent self-learning capabilities are usually needed. Because this method does not depend on a database of known attacks (i.e., signatures), it can detect unk
38、nown attacks, resulting in a lower false negative rate. This is an advantage over the misuse detection method described below. However, the false positive rate of the anomaly detection method can be higher than that produced using the misuse detection method. 7.2 Misuse detection In misuse detection
39、 methods, network traffic data is compared against large databases of documented attack signatures. If they match, then the network traffic is considered abnormal. An attack knowledge database is one that stores the attack features extracted from known attack data. The attack knowledge database is t
40、he key factor that influences the detection accuracy of a misuse detection method. Using a proper matching algorithm, misuse detection can reduce the false positive rate significantly. However, the false negative rate is difficult to reduce because this method cannot detect unknown new attacks. In a
41、ddition, small changes of attack features may also result in false negatives. 7.3 Synthetic analysis The main advantage of misuse detection is that the detection accuracy of known attacks can be very high. However, its main disadvantage is that it can only detect known attacks. Any new, unknown atta
42、cks will cause false negatives. Anomaly detection methods can detect known or unknown attacks, so the false negative rate can be significantly lowered as compared with misuse detection methods. Nevertheless, the main weakness of anomaly detection is that its detection accuracy is not very high and t
43、here may be many false positives. Based on the above analysis, these two methods can be combined to achieve higher efficiency and detection of abnormal traffic. The corresponding deployment mode is described below: 1) Anomaly detection is used first, to provide primary filtering for high bandwidth t
44、raffic. Then normal traffic can be differentiated and does not need to be inspected further. Only the traffic that is different from the normal model needs to be further inspected using the misuse detection method, greatly reducing its work load. This deployment mode demonstrates its merits in high
45、efficiency and low false negative rates. 2) Misuse detection is used to perform accurate feature matching only against the traffic identified by anomaly detection, thus taking advantage of its merits in low false positive rates. NOTE Some attacks cannot be addressed by either detection mode. 8 Abnor
46、mal traffic control measures 8.1 Control mode There are three ways to control abnormal network traffic: in-path (in-line), out-of-path (bypass), and a combination of both (i.e., in-path, out-of-path cooperation). All three are different in several aspects, including: deployment, effect, performance,
47、 influence on network, etc. 8.1.1 In-path control For the in-path control mode, the detection and control equipment resides directly in the network link. This provides an advantage in that the equipment can control or filter the abnormal traffic directly as it is detected. However, there are four di
48、sadvantages to this control mode: 4 X series Supplement 18 (04/2013) The first is the single-point failure. Because the equipment is a necessary element of the network link, if the equipment is damaged and no longer works, the network link will be broken. A solution to this problem is to add additio
49、nal equipment as a backup, or implement a bypass switch policy. The second problem is the forwarding performance and the ability for detection database updating. When traffic load is high and exceeds the process capability of the in-path control equipment, the network QoS will be impacted. Moreover, the detection database of the equipment needs to be periodically updated. In in-path control mode, the online update of the database is more difficult than the offline update. The third problem is that routing po
