网络拒绝服务

攻击者可能执行网络拒绝服务（DoS）攻击，以降低或阻止目标资源对用户的可用性。网络DoS可以通过耗尽服务所依赖的网络带宽来执行。示例资源包括特定的网站，电子邮件服务，DNS和基于Web的应用程序。观察到对手出于政治目的[1]并支持其他恶意活动，包括分散注意力[2]，黑客行为和勒索，而进行网络DoS攻击。[3]

当针对该资源或该资源所依赖的网络连接和网络设备的恶意流量很大时，当与系统的网络连接的带宽容量耗尽时，将发生网络DoS。例如，一个对手可能会向服务器托管的服务器发送10Gbps的流量，该服务器由与互联网建立1Gbps连接的网络托管。此流量可以由遍布Internet的单个系统或多个系统生成，通常称为分布式DoS（DDoS）。已经观察到实现这种网络饱和的许多不同方法，但是大多数方法可分为两大类：直接网络泛洪和反射放大。

要执行网络DoS攻击，有几个方面适用于多种方法，包括IP地址欺骗和僵尸网络。

攻击者可能会使用攻击系统的原始IP地址，也可能会欺骗源IP地址，从而使攻击流量更难追溯到攻击系统或进行反射。通过减少或消除通过网络防御设备上的源地址进行过滤的有效性，这可能会增加防御者防御攻击的难度。

僵尸网络通常用于对网络和服务进行DDoS攻击。大型僵尸网络可以从遍布全球互联网的系统中产生大量流量。攻击者可能有足够的资源来构建和控制自己的僵尸网络基础结构，也可以租用现有僵尸网络上的时间进行攻击。在DDoS的一些最坏情况下，使用了太多的系统来生成洪灾，每个系统仅需要发出少量流量即可产生足够的流量来使目标网络饱和。在这种情况下，将DDoS流量与合法客户端区分开变得非常困难。僵尸网络已用于一些最引人注目的DDoS攻击，例如2012年针对美国主要银行的一系列事件。[4]

对于直接针对托管系统的DoS攻击。

Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth services rely on. Example resources include specific websites, email services, DNS, and web-based applications. Adversaries have been observed conducting network DoS attacks for political purposes[1] and to support other malicious activities, including distraction[2], hacktivism, and extortion.

A Network DoS will occur when the bandwidth capacity of the network connection to a system is exhausted due to the volume of malicious traffic directed at the resource or the network connections and network devices the resource relies on. For example, an adversary may send 10Gbps of traffic to a server that is hosted by a network with a 1Gbps connection to the internet. This traffic can be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS). Many different methods to accomplish such network saturation have been observed, but most fall into two main categories: Direct Network Floods and Reflection Amplification.

To perform Network DoS attacks several aspects apply to multiple methods, including IP address spoofing, and botnets.

Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.

Botnets are commonly used to conduct DDoS attacks against networks and services. Large botnets can generate a significant amount of traffic from systems spread across the global internet. Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. In some of the worst cases for DDoS, so many systems are used to generate the flood that each one only needs to send out a small amount of traffic to produce enough volume to saturate the target network. In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. Botnets have been used in some of the most high-profile DDoS attacks, such as the 2012 series of incidents that targeted major US banks. For DoS attacks targeting the hosting system directly, see Endpoint Denial of Service.

Direct Network Flood 泛洪

直接网络泛洪是指使用一个或多个系统向目标服务的网络发送大量网络数据包时。几乎任何网络协议都可以用于直接网络泛洪。通常使用无状态协议（例如UDP或ICMP），但也可以使用有状态协议（例如TCP）。

Direct Network Floods are when one or more systems are used to send a high-volume of network packets towards the targeted service's network. Almost any network protocol may be used for Direct Network Floods. Stateless protocols such as UDP or ICMP are commonly used but stateful protocols such as TCP can be used as well.

Reflection Amplification 反射

攻击者可以使用Reflection来扩大攻击流量。这种类型的网络DoS利用托管并会响应给定欺骗源IP地址的第三方服务器中介的优势。该第三方服务器通常称为反射器。攻击者通过将具有受害者地址欺骗的数据包发送到反射器来完成反射攻击。与直接网络洪水类似，可以使用多个系统来进行攻击，也可以使用僵尸网络。同样地，可以使用一个或多个反射器将交通聚焦在目标上。[5]

反射攻击通常利用具有比请求更大响应的协议的优势来放大其流量，通常称为反射放大攻击。攻击者可能能够使攻击流量的增加量大于发送给放大器的请求的数量级。这种增加的程度将取决于许多变量，例如所讨论的协议，所使用的技术以及实际上在攻击量方面产生放大作用的放大服务器。DNS [6]和NTP [7]是启用反射放大泛洪的两个主要协议，尽管已记录了在野外使用其他几个协议的情况。[8] 尤其是，memcache协议显示自己是一个强大的协议，其放大大小高达请求数据包的51,200倍。[9]

Adversaries may amplify the volume of their attack traffic by using Reflection. This type of Network DoS takes advantage of a third-party server intermediary that hosts and will respond to a given spoofed source IP address. This third-party server is commonly termed a reflector. An adversary accomplishes a reflection attack by sending packets to reflectors with the spoofed address of the victim. Similar to Direct Network Floods, more than one system may be used to conduct the attack, or a botnet may be used. Likewise, one or more reflector may be used to focus traffic on the target.

Reflection attacks often take advantage of protocols with larger responses than requests in order to amplify their traffic, commonly known as a Reflection Amplification attack. Adversaries may be able to generate an increase in volume of attack traffic that is several orders of magnitude greater than the requests sent to the amplifiers. The extent of this increase will depending upon many variables, such as the protocol in question, the technique used, and the amplifying servers that actually produce the amplification in attack volume. Two prominent protocols that have enabled Reflection Amplification Floods are DNS and NTP， though the use of several others in the wild have been documented.[8] In particular, the memcache protocol showed itself to be a powerful protocol, with amplification sizes up to 51,200 times the requesting packet.

标签

ID编号： T1498

策略： 影响

平台： Linux，macOS，Windows

数据源： Sensor health and status ，网络协议分析，Netflow/Enclave netflow，网络入侵检测系统，网络设备日志

影响类型： 可用性

缓解措施

缓解	描述
过滤网络流量	当洪水量超过目标网络连接的容量时，通常有必要拦截上游的传入流量，以从合法流量中过滤出攻击流量。此类防御措施可以由托管Internet服务提供商（ISP）或第三方（例如内容分发网络（CDN））或专门从事DoS缓解措施的提供商提供。根据洪水量，可以通过阻止源地址发起攻击，阻止目标端口或阻止用于传输的协议来进行本地过滤。由于立即响应可能需要第三方迅速参与，因此分析与受到网络DoS攻击影响的关键资源相关的风险，并创建灾难恢复计划/业务连续性计划以响应事件。

Mitigation

Description

Filter Network Traffic

When flood volumes exceed the capacity of the network connection being targeted, it is typically necessary to intercept the incoming traffic upstream to filter out the attack traffic from the legitimate traffic. Such defenses can be provided by the hosting Internet Service Provider (ISP) or by a 3rd party such as a Content Delivery Network (CDN) or providers specializing in DoS mitigations.Depending on flood volume, on-premises filtering may be possible by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport.As immediate response may require rapid engagement of 3rd parties, analyze the risk associated to critical resources being affected by Network DoS attacks and create a disaster recovery plan/business continuity plan to respond to incidents. [10] [10] [10]

检测

有时可以在流量足以影响服务可用性之前实现网络DoS的检测，但是这种响应时间通常需要非常积极的监视和响应，或者上游网络服务提供商所提供的服务。典型的网络吞吐量监视工具，例如netflow ，SNMP和自定义脚本可用于检测网络或服务利用率的突然增加。对网络流量的实时，自动和定性研究可以确定一种协议中的突然激增，该协议可以用来检测网络DoS事件开始时的状态。通常，前置时间可能会很小，并且网络或服务的事件可用性指标会下降。然后，可以使用上述分析工具来确定导致中断的DoS类型，并帮助进行补救 。

Detection of Network DoS can sometimes be achieved before the traffic volume is sufficient to cause impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness or services provided by an upstream network service provider. Typical network throughput monitoring tools such as netflow, SNMP, and custom scripts can be used to detect sudden increases in network or service utilization. Real-time, automated, and qualitative study of the network traffic can identify a sudden surge in one type of protocol can be used to detect an Network DoS event as it starts. Often, the lead time may be small and the indicator of an event availability of the network or service drops. The analysis tools mentioned can then be used to determine the type of DoS causing the outage and help with remediation.

- 译者: 林妙倩、戴亦仑 . source:cve.scap.org.cn