Distributed Denial Of Service Attack Defense Research Articles

Research on Multi-Layer Defense against DDoS Attacks in Intelligent Distribution Networks

With the continuous development of new power systems, the intelligence of distribution networks has been increasingly enhanced. However, network security issues, especially distributed denial-of-service (DDoS) attacks, pose a significant threat to the safe operation of distribution networks. This paper proposes a novel DDoS attack defense mechanism based on software-defined network (SDN) architecture, combining Rényi entropy and multi-level convolutional neural networks, and performs fine-grained analysis and screening of traffic data according to the amount of calculation to improve the accuracy of attack detection and response speed. Experimental verification shows that the proposed method excels in various metrics such as accuracy, precision, recall, and F1-score. It demonstrates significant advantages in dealing with different intensities of DDoS attacks, effectively enhancing the network security of user-side devices in power distribution networks.

A Method of DDoS Attack Detection and Mitigation for the Comprehensive Coordinated Protection of SDN Controllers.

Software defined networking (SDN) improves the flexibility and programmability of the network by separating the control plane and the data plane and effectively realizes the global control of the network infrastructure. However, the centralized structure design of SDN exposes the controller to potential threats. Attackers have used the active flow table delivery mode to launch distributed denial of service (DDoS) attacks on the SDN controller, resulting in the controller failure and seriously affecting the network performance. To overcome this problem, this paper proposes a defense framework called CC-Guard. The framework consists of four modules: attack detection triggering, switch migration, anomaly detection, and mitigation. Among them, the attack detection trigger module improves the system's timely response to DDoS attacks. The switch migration module effectively unclogs the controller congestion problem and provides convenience for network flow transmission. The anomaly detection module uses a coarse-grained method for two-stage detection, which improves the detection accuracy. The mitigation module uses the idea of cross-domain cooperation of the controller to clear the abnormal flow in the blacklist. Experimental results show that our proposed CC-Guard has real-time DDoS attack defense capability and high detection accuracy, as well as efficient network resource utilization.

Distributed Denial of Service Attacks on Cloud Computing Environment‎

This paper aimed to identify the various kinds of distributed denial of service attacks (DDoS) attacks, their destructive capabilities, and most of all, how best these issues could be counter attacked and resolved for the benefit of all stakeholders along the cloud continuum, preferably as permanent solutions. A compilation of the various types of DDoS is done, their strike capabilities and most of all, how best cloud computing environment issues could be addressed and resolved for the benefit of all stakeholders along the cloud continuum. The key challenges against effective DDoS defense mechanism are also explored.

Mathematical Approach as Qualitative Metrics of Distributed Denial of Service Attack Detection Mechanisms

The distributed denial of service (DDoS) attack is one of the most destructive organized cyber-attacks against online services or computers on the network. Despite the existence of many mechanisms to detect DDoS attacks, the problem is still prevalent. This research dissected and analyzed twenty-two existing DDoS attack detection mechanisms, representing all types of DDoS attack defense approaches, to determine the reason for the persistent successful DDoS attacks. This research posits two hypotheses concerning this gap: First, a lack of mathematical function usage by the existing detection mechanisms. The few functions used are limited to logical, statistical, or probability functions, resulting in reduced detection effectiveness. Second, researchers unintentionally or inadvertently miscalculate the mechanisms’ detection accuracy rate by partially using quantitative metrics. This research has three objectives; to propose a set of qualitative metrics based on mathematical functions, to measure the relationship between the quantitative and qualitative metrics in the DDoS attack detection mechanisms, and to prove the relationship between the genuineness of the existing mechanisms’ detection accuracy, and full consideration of quantitative metrics and diversity of qualitative and metrics. The result revealed a correlation rate of 84.22 %, which reflects the correctness of the detection accuracy. Third, identifying the manipulation percentage of reported detection accuracy by employing the correlation rate complement. The result indicated that 15.78 % of the reviewed mechanisms had manipulated or inadvertently miscalculated the accuracy.

A survey and meta‐analysis of application‐layer distributed denial‐of‐service attack

SummaryBackgroundOne of the significant attacks targeting the application layer is the distributed denial‐of‐service (DDoS) attack. It degrades the performance of the server by usurping its resources completely, thereby denying access to legitimate users and causing losses to businesses and organizations.AimThis study aims to investigate existing methodologies for application‐layer DDoS (APDDoS) attack defense by using specific measures: detection methods/techniques, attack strategy, and feature exploration of existing APDDoS mechanisms.MethodologyThe review is carried out on a database search of relevant literature in IEEE Xplore, ACM, Science Direct, Springer, Wiley, and Google Search. The search dates to capture journals and conferences are from 2000 to 2019. Review papers that are not in English and not addressing the APDDoS attack are excluded. Three thousand seven hundred eighty‐nine studies are identified and streamlined to a total of 75 studies. A quantifiable assessment is performed on the selected articles using six search procedures, namely: source, methods/technique, attack strategy, datasets/corpus, status, detection metric, and feature exploration.ResultsBased on existing methods/techniques for detection, the results show that machine learning gave the highest proportion with 36%. However, assessment based on attack strategy shows that several studies do not consider an attack form for deploying their solution. Result based on existing features for the APDDoS detection technique shows request stream during a user session and packet pattern gave the highest result with 47%. Unlike packet header information with 33%, request stream during absolute time interval with 12% and web user features 8%.ConclusionResearch findings show that a large proportion of the solutions for APDDoS attack detection utilized features based on request stream during user session and packet pattern. The optimization of features will improve detection accuracy. Our study concludes that researchers need to exploit all attack strategies using deep learning algorithms, thus enhancing effective detection of APDDoS attack launch from different botnets.

Cloud based DDoS attack detection and defense system using statistical approach

In the recent era, business and IT domain rely on the cloud as it has evolved as the potential service model and lots of people jumped on the bandwagon to seek profit out of the cloud computing environment. The cloud is highly vulnerable and its risk associated with unpatched machines is exposed to distributed denial of service (DDoS) attacks. According to cloud security alliance group DDoS is the major security attack in the cloud and the impact and effects on virtual machines is much unexplored. Despite numerous DDoS solutions, there is a need for 'a dish fit for gods' in cloud. Hence, the proposed system defends the DDoS attacks in cloud by monitoring the performance distortion, detecting multilayer attacks using statistical method. Based on the attack variances with normal using chi-square statistics, DDoS attack sources are enlisted and communicated to the defence system to filter attack traffic and protect the cloud.

An SDNFV-Based DDoS Defense Technology for Smart Cities

A software defined networking (SDN)-enabled smart city is a new paradigm that can effectively improve the cost efficiency and flexibility of data management through data-control separation. However, it faces significant security threats such as distributed denial of service (DDoS) attacks which jeopardize the security and availability of data and services by overloading the system with excessive traffic from distributed sources. To improve the DDoS defense capability and enhance the security of data management in SDN-enabled smart cities, this paper proposes a DDoS attack Defense strategy based on Traffic Classification (DDTC). We use software defined network function virtualization (SDNFV) architecture and traffic classification strategy, to improve the flexibility and reduce the load of SDN against DDoS attacks. Experimental results show that the proposed DDTC can not only launch DDoS attacks detection quickly, but also accurately track the sources of DDoS attacks. More importantly, it can reduce the risk of attack on the controller of SDN and improve the effectiveness of the system.

SGS: Safe-Guard Scheme for Protecting Control Plane Against DDoS Attacks in Software-Defined Networking

Software-defined networking (SDN) achieves flexible and efficient network management by decoupling control plane from the data plane, where the controller with a global network view is responsible for planning routing for packets. However, the centralized design makes the controller become a potential bottleneck, and adversaries can exploit this vulnerability to launch distributed denial-of-service (DDoS) attacks to the controller. Existing solutions are fundamentally based forged traffic analysis, increasing computational cost and being prone to produce false positives. This paper proposes a safe-guard scheme (SGS) for protecting control plane against DDoS attacks, and the main characteristic of SGS is deploying multi-controller in control plane through the controller’s clustering. SGS procedures are organized in two modules: anomaly traffic detection and controller dynamic defense. Anomaly traffic detection focuses on switches in data plane to distinguish forged flows from legitimate ones by innovatively adopting four-tuple feature vector. Controller dynamic defense mitigates DDoS attacks’ effects on control plane by remapping controller and sending the access control message to switches. The simulation results demonstrate the efficiency of our proposed SGS with real-time DDoS attack defense and high detection accuracy, as well as high-efficiency network resource utilization.

Application Layer Distributed Denial of Service Attacks Defense Techniques : A review

Currently distributed denial of service (DDoS) is the most sever attack that effect on the internet convenience. The main goal of these attacks is to prevent normal users from accessing the internet services such as web servers. However the more challenge and difficult types to detect is application layer DDoS attacks because of using legitimate client to create connection with victims. In this paper we give a review on application layer DDoS attacks defense or detection mechanisms. Furthermore, we summarize several experimental approaches on detection techniques of application layer DDoS attacks. The main goal of this paper is to get a clear view and detailed summary of the recent algorithms, methods and techniques presented to tackle these serious types of attacks.

Securing the cloud-assisted smart grid

Rapid elasticity, ubiquitous network access, and highly-reliable services are some of the desirable features of cloud computing that are attractive for building cloud-assisted data-intensive Smart Grid (SG) applications. However, the Distributed Denial-of-Service (DDoS) attacks represent a serious threat to the cloud-assisted SG applications. To mitigate the risk related to the DDoS threat, we propose an SG-relevant Hierarchical Hybrid Cloud-Extension Concept (HHCEC) along with a DDoS attack defense mechanism, termed as Port Hopping Spread Spectrum (PHSS). HHCEC is a cloud-assisted architecture designed to meet scalability and security requirements of the SG applications in the cloud. To prevent transport or application-layer DDoS attacks on HHCEC, PHSS switches the open port of server as a function of time and a secret shared between authorized clients and server, and thus efficiently dropping packets with closed port number. In addition, PHSS spreads the data packets over all the servers versus a single server to provide a robust protection against volume-based DDoS attacks that would affect some of the servers. This packet spreading approach enables PHSS to instantiate replica servers to take over the attacked servers without blocking the whole traffic by utilizing the rapid-elasticity characteristic of the cloud. Moreover, PHSS leverages a shuffling-based containment mechanism in order to quarantine malicious clients in a notably short time. Accordingly, the effect of a DDoS attack based on the compromised secret of the malicious clients is minimized. We evaluate our approach by building a proof-of-concept prototype using Amazon’s EC2 and the PlanetLab test-bed. In a DDoS attack scenario, the proposed approach obtains a significant availability enhancement of > 38% that highlight its efficiency in comparison to existing approaches. The results also indicate negligible overhead for the proposed approach compared to the plain system i.e., no additional latency and less than 0.01% throughput degradation.

Low rate cloud DDoS attack defense method based on power spectral density analysis

The major threat to the availability of cloud computing resources and services is Distributed Denial-of-Service (DDoS) attack. DDoS is a multifaceted attack, and the detection of Low-rate DDoS (LDDoS) attack is a challenging task due to its stealthy and low-rate attack traffic behavior. The objective of the letter is to propose an approach which detects and mitigates the LDDoS attack in the frequency-domain. A power spectral density (PSD) based approach is proposed which monitors and analyzes real-time aggregate traffic for the attack detection. It mainly consists of five phases; the first four phases are in the time-domain while the last phase is in the frequency-domain. The approach is implemented on the OpenStack-based closed setup of a real cloud environment. The experimental results show that the approach is adaptive, and provides 3.7% false positive rate (FPR) and 4.9% false negative rate (FNR) which are comparable.

SDN-Assisted Slow HTTP DDoS Attack Defense Method

A Slow HTTP distributed denial of service (DDoS) attack causes a Web server to be unavailable, but it is difficult to detect in a network, because its traffic patterns are similar to those of legitimate clients. In this letter, we propose a network-based Slow HTTP DDoS attack defense method, which is assisted by a software-defined network that can detect and mitigate Slow HTTP DDoS attacks in the network. Simulation results show that the proposed Slow HTTP DDoS attack defense method successfully protects Web servers against Slow HTTP DDoS attacks.

OverWatch: A Cross-Plane DDoS Attack Defense Framework with Collaborative Intelligence in SDN

Distributed Denial of Service (DDoS) attacks are one of the biggest concerns for security professionals. Traditional middle-box based DDoS attack defense is lack of network-wide monitoring flexibility. With the development of software-defined networking (SDN), it becomes prevalent to exploit centralized controllers to defend against DDoS attacks. However, current solutions suffer with serious southbound communication overhead and detection delay. In this paper, we propose a cross-plane DDoS attack defense framework in SDN, called OverWatch, which exploits collaborative intelligence between data plane and control plane with high defense efficiency. Attack detection and reaction are two key procedures of the proposed framework. We develop a collaborative DDoS attack detection mechanism, which consists of a coarse-grained flow monitoring algorithm on the data plane and a fine-grained machine learning based attack classification algorithm on the control plane. We propose a novel defense strategy offloading mechanism to dynamically deploy defense applications across the controller and switches, by which rapid attack reaction and accurate botnet location can be achieved. We conduct extensive experiments on a real-world SDN network. Experimental results validate the efficiency of our proposed OverWatch framework with high detection accuracy and real-time DDoS attack reaction, as well as reduced communication overhead on SDN southbound interface.

Scalable DDoS Mitigation System for Data Centers

Distributed Denial of Service attacks (DDoS) have been used by attackers for over two decades because of their effectiveness. This type of the cyber-attack is one of the most destructive attacks in the Internet. In recent years, the intensity of DDoS attacks has been rapidly increasing and the attackers combine more often different techniques of DDoS to bypass the protection. Therefore, the main goal of our research is to propose a DDoS solution that allows to increase the filtering capacity linearly and allows to protect against the combination of attacks. The main idea is to develop the DDoS defense system in the form of a portable software image that can be installed on the reserve hardware capacities. During a DDoS attack, these servers will be used as filters of this DDoS attack. Our solution is suitable for data centers and eliminates some lacks of commercial solutions. The system employs modular DDoS filters in the form of special grids containing specific protocol parameters and conditions.

Controlling IP Falsifying Using Realistic Simulation

The study of Internet-scale events such as worm proliferation, distributed denial-of-service attacks (DDoS), flash crowds, routing volatilities, and DNS attacks depend on the formation of all the networks that generate or forward valid and malevolent traffic,The Distributed Denial of Services (DDoS) attack is a serious threat to the valid use of the Internet. Forestalling mechanisms are disappointed by the ability of attackers to steal, or spoof, the source addresses in IP packets. IP falsifying is still widespread in network scanning and investigates, as well as denial of service floods.IDPFs can limit the falsifying capability of attackers. Moreover, it works on a small number of candidate networks easily traceable, thus simplifying the reactive IP trace back process. However, this technique does not allow large number of networks, which is a common misapprehension for those unfamiliar with the practice. Current network simulators cannot be used to study Internet-scale events. They are general-purpose, packet-level simulators that reproduce too many details of network communication, which limits scalability. We propose to develop a distributed Internet simulator, with the following novel features. It will provide a built-in Internet model, including the topology, routing, link bandwidths and delays, Instead of being a general-purpose simulator, it will provide a common simulation core for traffic generation and message passing, on top of which we will build separate modules that customize messages and level of simulation details for the event of interest. Customization modules will ensure that all and only the relevant details of the event of interest are simulated, cutting down the simulation time. We will also provide an interface for new module specification, and for existing module modification, this will bring the Internet event simulation at the fingertips of all interested researchers. The simulator will promote research in worm detection and defense, IP falsifying prevention and DDoS defense.

Resistance against Distributed Denial of Service Attacks (DDoS) Using Bandwidth Based Admission Control

Internet hosts are threatened by large-scale Distributed Denial of- Service (DDoS) attacks. The Path Identification DDoS defense scheme has recently been proposed as a deterministic packet marking scheme that allows a DDoS victim to filter out attack packets on a per packet basis with high accuracy after only a few attack packets are received. The previous work suggested depicts the Stack Path identification marking, a packet marking scheme based on path identification, and filtering mechanisms. To circumvent detection, attackers are increasingly moving from floods to attacks that mimic the behavior of a large number of clients, and target expensive higher-layer resources such as CPU, database and disk bandwidth. The resulting attacks are hard to defend against using standard techniques, as the malicious requests differ from the legitimate ones in intent but not in content. The proposal in this work improves our previous path identification scheme to protect network servers against DDoS attacks that masquerade the crowds. It provides rate filter authentication using verifiers different from other systems by using an intermediate stage to identify the IP addresses that ignore the verifier, and persistently bombard the server with requests despite repeated failures. Once these machines are identified, it blocks their requests, and allows access to legitimate users. It protects the authentication mechanism from being DDoS attacks and integrates filter authentication with bandwidth admission control. Rate limitation implies that a peer must reject or even drop some incoming requests. The proposed bandwidth admission control strategy discriminates against the attrition adversary by selectively dropping the requests for attacker legitimacy. Admission control strategies have been used even in circumstances that includes session-based classification (e.g., in web services, preferentially drop requests signifying a new service session, instead of requests that continue longer running sessions with greater potential for a purchase), and reputation-based classification (prefer requesters with a good subjective or global history). Knowing that the admission level is a relative measurement, the component of the control scheme is made adaptive according to the rate limit filter and parameter such as session time, bandwidth level, load demand etc., When the admission level of the bandwidth is used as a DDoS detection indicator for sources, and also achieve similar performance with some expected slight degradation in stability. It is well known that delay is a major concern for any feedback control systems and tested the effect of delays as well. It was found that the control performance remains highly stable when the delay is as high as one second or more.