NTP Reflection DDoS Mitigation via Tracking Table Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems find it difficult to differentiate between legitimate and attack packets in Network Time Protocol (NTP) reflection attacks, making it challenging to mitigate Distributed Denial of Service (DDoS) attacks effectively, as the packets may appear legitimate according to protocol standards.
Innovation Solution
A network security device maintains a tracking table for NTP requests and responses, intercepting and dropping NTP requests from clients if a prior request has not received a response within a predetermined time period, thereby distinguishing between legitimate and attack packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional firewall or IPS appliances are used to filter packets, then basic protocol compliance can be enforced, but they cannot differentiate between legitimate and attack packets in NTP reflection attacks
Solution Approach 1:
The system performs preliminary actions by maintaining a tracking table that records expected NTP request-response pairs before the attack traffic arrives. This allows the firewall to proactively identify and block spoofed packets that don't match pre-recorded legitimate transactions, resolving the contradiction by enabling accurate differentiation without requiring complex real-time analysis
2Productivity
If all NTP packets are allowed to pass through to maintain protocol compliance, then legitimate traffic is not blocked, but attack traffic overwhelms the server
Solution Approach 1:
The system uses feedback by continuously monitoring NTP traffic patterns and maintaining a dynamic tracking table of expected requests and responses. This feedback mechanism allows the firewall to distinguish legitimate traffic (which matches tracked patterns) from attack traffic (which doesn't), enabling selective blocking that protects servers while maintaining productivity for legitimate users
3Object-affected harmful factors
If the firewall blocks all unsolicited NTP packets, then attack traffic is reduced, but legitimate responses may be incorrectly blocked
Solution Approach 1:
The system records legitimate NTP request-response pairs in advance in a tracking table before blocking decisions are made. This preliminary action creates a whitelist of expected traffic patterns, allowing the firewall to reliably distinguish legitimate responses from attack traffic and prevent false positives, resolving the contradiction between blocking attacks and delivering legitimate packets
Data Source
AI summary
Systems and methods for mitigating DDoS attacks utilizing NTP are provided. According to one embodiment, a tracking table is maintained by a network security device protecting a private network. The tracking table contains information regarding NTP requests originated by clients of the private network and observed by the network security device. An NTP request sent from a client to an NTP server external to the private network is intercepted by the network security device. An NTP request flooding attack on the NTP server by the first client is mitigated by the network security device by: (i) determining based on the tracking table whether a prior NTP request directed to the NTP server and for which an NTP response has yet to be received was sent by the client within a predetermined or configurable time period of the NTP request; and (ii) when said determining is affirmative, dropping the NTP request.