A Novel Model for Distributed Denial of Service Attack Analysis and Interactivity

Ashraf Ahmad,Yousef Abuhour,Firas Alghanim

doi:10.3390/sym13122443

Ashraf Ahmad, Yousef Abuhour + Show 1 more

Open Access

https://doi.org/10.3390/sym13122443

Copy DOI

Journal: Symmetry	Publication Date: Dec 17, 2021
Citations: 2	License type: CC BY 4.0

Affiliation: Princess Sumaya University for Technology

Abstract

A Distributed Denial of Service (DDoS) attack is a type of cybercrime that renders a target service unavailable by overwhelming it with traffic from several sources (attack nodes). In this paper, we focus on DDoS attacks on a computer network by spreading bots throughout the network. A mathematical differential equation model is proposed to represent the dynamism of nodes at different compartments of the model. The model considers two levels of security, with the assumption that the recovered nodes do not return to the same security level. In previous models, the recovered nodes are returned to be suspect on the same security level, which is an unrealistic assumption. Moreover, it is assumed that the attacker can use the infected target nodes to attack again. With such epidemic-like assumptions of infection, different cases are presented and discussed, and the stability of the model is analyzed as well; reversing the symmetry transformation of attacking nodes population is also proven. The proposed model has many parameters in order to precisely describe the infection movement and propagation. Numerical simulation methods are used to solve the developed system of equations using MATLAB, with the intention of finding the best counteraction to control DDoS spread throughout a network.

Highlights

A Denial of Service attack (DoS attack) is a cyberattack in which the attacker attempts to reduce the access or completely shut down the resources of either a machine or a network and make them unavailable to their legitimate users [1]
A Distributed Denial of Service (DDoS) attack is a large-scale DoS attack in which the attacking system consists of a large number of compromised computers that are targeting the victim’s system
A DDoS attack consists of two stages; in the first stage, the attacking system compromises a large number of vulnerable computers in order to use them as a part of the attacking attempt during the second stage, wherein the victim’s system is attacked

Summary

Introduction

A Denial of Service attack (DoS attack) is a cyberattack in which the attacker attempts to reduce the access or completely shut down the resources of either a machine or a network and make them unavailable to their legitimate users [1]. In the first quarter of 2018, 57.3% of DDoS attacks were SYN flood attacks [4] Another protocol that can be misused to attack the victim’s system is the Internet. The estimated damages of the attack were $1.7 billion [8] Another example is Dyn, an Internet performance management and web application security company that was compromised in October 2016. It is significant to mention that our model is more realistic than others because the recovered nodes will have high-level security after the attack, which is an assumption that has usually been omitted in previous models This dynamical system of equation is generally much faster than botnet simulation, the simulation is more accurate.

Background

Model Formulation and Basic Properties

Local Stability of Infection-Free Equilibrium

No High-Security Level

Perfect High-Security Level

Numerical Analysis and Discussion

Conclusions