Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Metricon5 powell - ddos analytics

598 views

Published on

ddos analytics

Published in: Technology
  • Login to see the comments

  • Be the first to like this

Metricon5 powell - ddos analytics

  1. 1. Headlines You May Have Seen © 2010 Akamai
  2. 2. Headlines You DID NOT See Independence Day Attacks Paralyze the U.S. Government and Financial Websites Attacked and Taken Down: Stocks Show Concerns President Delays Trip Due to Cyber Attacks POWERING A BETTER INTERNET © 2010 Akamai
  3. 3. IT Risk In a Complex World © 2010 Akamai
  4. 4. What’s At Risk? Reputation & Brand Dollars & Revenue Mission & TrustNSAs Guide: Defense in Depth - A practical strategy for achieving Information Assurance in today’s highly networked environments © 2010 Akamai
  5. 5. Weathering Storms in the Cloud: AnalyzingMassive DDoS Attacks to Prepare for the Future R. H. Powell IV Senior Service Line Manager August 10, 2010
  6. 6. AgendaWeathering Storms in the Cloud• Is the Threat Worth Considering?• Data Collection & Considerations• Observations from the Wild • July 4th DDoS Case Study• How Do you Analyze This• Future Expectations & Innovation © 2010 Akamai
  7. 7. State of Internet Security Today• 95% of corporate Web applications have severe vulnerabilities.1• 34 million computers in the U.S. alone may now be part of a botnet.2• Cybercrime costs businesses $1 trillion a year.3• In 2008, a Web page was infected every 4.5 seconds.4• Attack traffic observed from 198 countries in Q1 ‘10, up 291% from 68 countries in Q1 ‘09.5 1 WASC 2 Georgia Tech Information Security 3 McAfee 4 Sophos 5 Akamai © 2010 Akamai
  8. 8. Targets of Opportunity 4000 3,462Volume of Vulnerabilities 2,750 3000 2,029 1,875 2000 1000 0 2007 2008 2007 2008 (Non-Web Application (Web Application Vulnerabilities) Vulnerabilities) Source: Symantec Internet Security Threat Report, April 2009 © 2010 Akamai
  9. 9. Peak Attack Traffic per year 49 250 50 225 45 40 >200 200 40 175 35Attack Size - Gbps 150 30 125 25 24 100 20 17 15 75 10 50 10 25 5 2.5 0 1.2 2002 2003 2004 2005 2006 2007 2008 2009 (Arbor Networks) (Akamai Technologies) © 2010 Akamai
  10. 10. Where Does the Data Come From? Primary Auxiliary Data Data Sources Source Akamai Distributed Agents Publicly Available Reports Akamai Customer Production Traffic Logs © 2010 Akamai
  11. 11. Top Attack Countries (Akamai Agents) © 2010 Akamai
  12. 12. Top Attack Regions (Akamai Agents)Europe 44% Overall Europe 50% of Mobile © 2010 Akamai
  13. 13. A Note On Mobile Connectivity Global %>1 %>2 %>5 %> Mobile Mbps Mbps Mbps 10 Mbps ProvidersAverage Connection Speed 32%1 13%1 -- --Maximum Connection Speed -- 76%1 30%1 6%1 The GSM Association reports that global Mobile Broadband connections roughly doubled during 2009 to 200 million. By the end of 2010, they estimate this will reach 342 million global connections, with 120 million in Europe, 116 million in the Asia Pacific region, and 58 million in North America. 2 1 Akamai 2 GSM Association © 2010 Akamai
  14. 14. July 4 2009 DDoS Attack Observed Attack Profile Type of Attack – Brute Force DDoS • The largest coordinated DDoS cyber attack against US Government Websites • HTTP Resource Drain attack • Sourced primarily from compromised Korean computers Intensity of Attack • 1,000,000+ hits per second and ~200 Gbps aggregate attack traffic (US Gov Only) • One website received 8 years of traffic in a day All Traffic Logged for Akamai Customers • 64 Billion Log Lines • 13 TB of uncompressed log data (400+ Gigs of Compressed logs)“Between the volume of the requests and their frustrating nature, a Web site with few servers or limitedbandwidth can quickly be taken down. Others with greater physical and financial resources can take thepunishment. That may explain why high-volume Web sites such as those belonging to the WhiteHouse, the Pentagon and the New York Stock Exchange were able to withstand such attacks with barely ahiccup, while the Federal Trade Commissions and the Transportation Departments were knockedoffline." - Paul Wagenseil, Fox News © 2010 Akamai
  15. 15. July 4, 2009 DDoS Attack Times Above Customer – PROTECTED Peak Traffic Previous Peak Traffic U.S. Government Customer 1 124 Gbps 598x U.S. Government Customer 2 32 Gbps 369x U.S. Government Customer 3 9 Gbps 39x U.S. Government Customer 4 9 Gbps 19x U.S. Government Customer 5 2 Gbps 9x U.S. Government Customer 6 1.9 Gbps 6x New U.S. Government Customer 0.7 Gbps SITE DOWN before Akamai“Between the volume of the requests and their frustrating nature, a Web site with few servers or limitedbandwidth can quickly be taken down. Others with greater physical and financial resources can take thepunishment. That may explain why high-volume Web sites such as those belonging to the WhiteHouse, the Pentagon and the New York Stock Exchange were able to withstand such attacks with barely ahiccup, while the Federal Trade Commissions and the Transportation Departments were knockedoffline." - Paul Wagenseil, Fox News © 2010 Akamai
  16. 16. Akamai Analysis of Log DataTop Attacking IP Address Over Time • July 4th – Attacks focused on two sites • July 5th – Attacks spread to include 5 other sites. Even traffic spread. • July 5th (late) – Attack shifts bulk of attack to 2 new sites • July 7th (late) – Attack EndsAll Targeted US Government Websites (not using Akamai) Went Down! © 2010 Akamai
  17. 17. Unique Hostile IPs Over Time # Unique Hostile IPs Per 30 Minute Block120000 97,882 Unique IP’s in 30 mins100000 Spike 1 80000 60000 Spike 3 Spike 2 40000 # IPs 20000 Few common attackers between spikes: (Only 4,284 IP’s Shared Across all Spikes) 0 5.1.0 7.8.0 8.6.0 9.4.0 10.13.0 11.11.0 11.22.0 12.20.0 2.23.5 3.10.5 4.13.0 5.12.0 5.23.0 6.10.0 6.21.0 7.19.0 8.17.0 9.15.0 10.2.0 11.0.0 12.9.0 13.7.0 Much Larger Then Any Public Estimates © 2010 Akamai
  18. 18. Crunching The Data © 2010 Akamai
  19. 19. Future Outlook and Innovation © 2010 Akamai
  20. 20. Thank you
  21. 21. Akamai Architecture Operational View – OV-1 Akamai Network Data Center 65,000+ Servers 1500+ Locations Web 950+ Networks Servers 70+ Countries Fire Edge ServersDatabase Wall Compression Network Storage Load Balancer Transaction WAF Server EDNS Internet Directory/ Akamai Policy Server Site Shield Edge Servers Network Legacy App DNS StorageSystems Servers Server End Users Back-Up Site or Load Balanced Multi-Data CenterSecurity Availability Scalability Visibility Resource Savings Performance © 2010 Akamai
  22. 22. Broad adoption across verticalsIf you’re on-line you’re using AkamaiRetail & Travel• Over 400 Global Retailers• 50 of the top 50 U.S. Retailers• Over 125 Global Online Travel SitesMedia & Entertainment• 30 of the top 30 M&E companiesFinance• 9 of top 15 Global BanksTechnology•The top five anti-virus companies © 2010 Akamai
  23. 23. US Government Customers12 of 15 Cabinet Agencies © 2010 Akamai

×