Distributed Denial Of Service Flooding Attacks Research Articles

IQR-based approach for DDoS detection and mitigation in SDN

Software-defined networking (SDN) is a trending networking paradigm that focuses on decoupling of the control logic from the data plane. This decoupling brings programmability and flexibility for the network management by introducing centralized infrastructure. The complete control logic resides in the controller, and thus it becomes the intellectual and most important entity of the SDN infrastructure. With these advantages, SDN faces several security issues in various SDN layers that may prevent the growth and global adoption of this groundbreaking technology. Control plane exhaustion and switch buffer overflow are examples of such security issues. Distributed denial-of-service (DDoS) attacks are one of the most severe attacks that aim to exhaust the controller's CPU to discontinue the whole functioning of the SDN network. Hence, it is necessary to design a quick as well as accurate detection scheme to detect the attack traffic at an early stage. In this paper, we present a defense solution to detect and mitigate spoofed flooding DDoS attacks. The proposed defense solution is implemented in the SDN controller. The detection method is based on the idea of an statistical measure — Interquartile Range (IQR). For the mitigation purpose, the existing SDN-in-built capabilities are utilized. In this work, the experiments are performed considering the spoofed SYN flooding attack. The proposed solution is evaluated using different performance parameters, i.e., detection time, detection accuracy, packet_in messages, and CPU utilization. The experimental results reveal that the proposed defense solution detects and mitigates the attack effectively in different attack scenarios.

Deep-Learning-Based Approach to Detect ICMPv6 Flooding DDoS Attacks on IPv6 Networks

Internet Protocol version six (IPv6) is more secure than its forerunner, Internet Protocol version four (IPv4). IPv6 introduces several new protocols, such as the Internet Control Message Protocol version six (ICMPv6), an essential protocol to the IPv6 networks. However, it exposes IPv6 networks to some security threats since ICMPv6 messages are not verified or authenticated, and they are mandatory messages that cannot be blocked or disabled. One of the threats currently facing IPv6 networks is the exploitation of ICMPv6 messages by malicious actors to execute distributed denial of service (DDoS) attacks. Therefore, this paper proposes a deep-learning-based approach to detect ICMPv6 flooding DDoS attacks on IPv6 networks by introducing an ensemble feature selection technique that utilizes chi-square and information gain ratio methods to select significant features for attack detection with high accuracy. In addition, a long short-term memory (LSTM) is employed to train the detection model on the selected features. The proposed approach was evaluated using a synthetic dataset for false-positive rate (FPR), detection accuracy, F-measure, recall, and precision, achieving 0.55%, 98.41%, 98.39%, 97.3%, and 99.4%, respectively. Additionally, the results reveal that the proposed approach outperforms the existing approaches.

Detecting flooding DDoS attacks in software defined networks using supervised learning techniques

For the easy and flexible management of large scale networks, Software-Defined Networking (SDN) is a strong candidate technology that offers centralisation and programmable interfaces for making complex decisions in a dynamic and seamless manner. On the one hand, there are opportunities for individuals and businesses to build and improve services and applications based on their requirements in the SDN. On the other hand, SDN poses a new array of privacy and security threats, such as Distributed Denial of Service (DDoS) attacks. For detecting and mitigating potential threats, Machine Learning (ML) is an effective approach that has a quick response to anomalies. In this article, we analyse and compare the performance, using different ML techniques, to detect DDoS attacks in SDN, where both experimental datasets and self-generated traffic data are evaluated. Moreover, we propose a simple supervised learning (SL) model to detect flooding DDoS attacks against the SDN controller via the fluctuation of flows. By dividing a test round into multiple pieces, the statistics within each time slot reflects the variation of network behaviours. And this ”trend” can be recruited as samples to train a predictor to understand the network status, as well as to detect DDoS attacks. We verify the outcome through simulations and measurements over a real testbed. Our main goal is to find a lightweight SL model to detect DDoS attacks with data and features that can be easily obtained. Our results show that SL is able to detect DDoS attacks with a single feature. The performance of the analysed SL algorithms is influenced by the size of training set and parameters used. The accuracy of prediction using the same SL model could be entirely different depending on the training set.

Detection of DDoS attack in cloud computing and its prevention: a systematic review

Cloud computing is one of the latest and greatest environments for delivering Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS) in digital communications infrastructure. Cloud computing helps the user remotely access the required service as needed through the Internet. But this technological advancement, due to its remote availability in the cloud, leads to new attacks. One of the biggest threats to cloud infrastructure is Distributed Denial of Service (DDoS) flooding attacks. DDoS flooding attacks are clearly trying to exploit the availability of services for a legitimate user. An attacker gains access to a large number of computers (i.e., botnets) by exploiting the vulnerabilities, and then uses the botnets to initiate an organized attack with a large number of targets. This paper analyses the latest methods for detecting and preventing Distributed Denial of Service (DDoS) attacks. It also provided methods and technologies for preventing, detecting, and responding to DDoS flood attacks.

DDOS ATTACK DETECTION AND MITIGATION AT SDN ENVIROMENT

Abstract- Software-Defined Networking (SDN) is a promising sample that allows the programming behind the network’s operation with some abstraction level from the underlying networking devices .the insistence to detect and mitigate Distributed Denial of Service (DDoS) which introduced by network devices tries to discover network security weaknesses and the negative effects of some types of Distributed Denial of Service (DDoS) attacks. An SDN-based generic solution to mitigate DDoS attacks when and where they originate. Briefly, it compares at runtime the expected trend of normal traffic against the trend of abnormal traffic; if big deviation on the traffic trend is detected, then an event is created; as an event associated to a DDoS attack is produced, an SDN (OpenDayLight) controller creates flow rules for blocking the malign traffic, By designing and implementing an application that reactively impairs the attacks at its origin, ensuring the “normal operation” of the network infrastructure. The evaluation results suggest that the proposal timely detect the characteristics of a flooding DDoS attacks, and mitigates their negative impacts on the network performance, and ensures the correct data delivery of normal traffic. The work sheds light on the programming relevance over an abstracted view of the network infrastructure.

Detection and Classification of DDoS Flooding Attacks on Software-Defined Networks: A Case Study for the Application of Machine Learning

Software-defined networks (SDNs) offer robust network architectures for current and future Internet of Things (IoT) applications. At the same time, SDNs constitute an attractive target for cyber attackers due to their global network view and programmability. One of the major vulnerabilities of typical SDN architectures is their susceptibility to Distributed Denial of Service (DDoS) flooding attacks. DDoS flooding attacks can render SDN controllers unavailable to their underlying infrastructure, causing service disruption or a complete outage in many cases. In this paper, machine learning-based detection and classification of DDoS flooding attacks on SDNs is investigated using popular machine learning (ML) algorithms. The ML algorithms, classifiers and methods investigated are quadratic discriminant analysis (QDA), Gaussian Naïve Bayes (GNB), k-nearest neighbor (k-NN), and classification and regression tree (CART). The general principle is illustrated through a case study, in which, experimental data (i.e. jitter, throughput, and response time metrics) from a representative SDN architecture suitable for typical mid-sized enterprise-wide networks is used to build classification models that accurately identify and classify DDoS flooding attacks. The SDN model used was emulated in Mininet and the DDoS flooding attacks (i.e. hypertext transfer protocol (HTTP), transmission control protocol (TCP), and user datagram protocol (UDP) attacks) have been launched on the SDN model using low orbit ion cannon (LOIC). Although all the ML methods investigated show very good efficacy in detecting and classifying DDoS flooding attacks, CART demonstrated the best performance on average in terms of prediction accuracy (98%), prediction speed (5.3 ×105 observations per second), training time (12.4 ms), and robustness.

A Forensics Analysis of ICMP Flooded DDoS Attack using WireShark

The usage of Denial of Service (DoS) and Distributed Denial of Service (DDoS) packets by the assailant may change and dependent on various sorts of administrations and protocols. A flooding DDoS attack depends on an immense volume of assault traffic which is named as a Flooding based DDoS packet. Flooding-based DDoS packet endeavors to block the injured individual's system transfer speed with genuine-looking however undesirable IP information. Because of which Legitimate IP packets can’t arrive at the unfortunate casualty in view of the absence of data transfer capacity asset. Internet Control Message Protocol (ICMP) Flood started by sending countless ICMP packets to a remote host. Thus, the deceived framework's assets will be devoured by taking care of the assaulting packets, which in the long run makes the framework be inaccessible by different customers. In this paper, we distinguish of ICMP Flood DDoS packet by utilizing WireShark.

DDoS Flooding Attack Mitigation in Software Defined Networks

Distributed denial of service (DDoS) attacks which have been completely covered by the security community, today pose a potential new menace in the software defined networks (SDN) architecture. For example, the disruption of the SDN controller could interrupt data communication in the whole SDN network. DDoS attacks can produce a great number of new and short traffic flows (e.g., a series of TCP SYN requests), which may launch spiteful flooding requests to overcharge the controller and cause flow-table overloading attacks at SDN switches. In this research work, we propose a lightweight and practical mitigation mechanism to protect SDN architecture against DDoS flooding threats and ensure a secure and efficient SDN-based networking environment. Our proposal extends the Data Plane (DP) with a classification and mitigation module to analyze the new incoming packets, classify the benign requests from the SYN flood attacks, and perform the adaptive countermeasures. The simulation results indicate that the proposed defending mechanism may efficiently tackle the DDoS flood attacks in the SDN architecture and also in the downstream servers.

Autonomic protection of multi-tenant 5G mobile networks against UDP flooding DDoS attacks

There is a lack of effective security solutions that autonomously, without any human intervention, detect and mitigate DDoS cyber-attacks. The lack is exacerbated when the network to be protected is a 5G mobile network. 5G networks push multi-tenancy to the edge of the network. Both the 5G user mobility and multi-tenancy are challenges to be addressed by current security solutions. These challenges lead to an insufficient protection of 5G users, tenants and infrastructures. This research proposes a novel autonomic security system, including the design, implementation and empirical validation to demonstrate the efficient protection of the network against Distributed Denial of Service (DDoS) attacks by applying countermeasures decided on and taken by an autonomic system, instead of a human. The self-management architecture provides support for all the different phases involved in a DDoS attack, from the detection of an attack to its final mitigation, through making the appropriate autonomous decisions and enforcing actions. Empirical experiments have been performed to protect a 5G multi-tenant infrastructure against a User Datagram Protocol (UDP) flooding attack, as an example of an attack to validate the design and prototype of the proposed architecture. Scalability results show self-protection against DDoS attacks, without human intervention, in around one second for an attack of 256 simultaneous attackers with 100 Mbps bandwidth per attacker. Furthermore, results demonstrate the proposed approach is flow-, user- and tenant-aware, which allows applying different protection strategies within the infrastructure.

An OpenStack based cloud testbed framework for evaluating HTTP flooding attacks

The cloud computing has inherent challenges to detect the Hyper Text Transfer Protocol (HTTP) flooding Distributed Denial of Service (DDoS) attack due to its natural characteristics like virtualization, elasticity and multi-tenancy. The usage of cloud computing is user-friendly, but the implementation of the cloud infrastructure such as compute node, networking, cloud storage is very complex in order to achieve its various characteristics. Similarly, detecting the HTTP flooding attack in the cloud is also very complex as it requires an understanding of various potential attack paths in such a complex environment. So, designing the cloud testbed framework to detect the HTTP flooding attacks is a challenging problem to be solved. The cloud testbed framework has to consider several aspects of attack scenarios while accounting the cloud characteristics. This paper reviews the existing DDoS attack detection framework and their gaps and proposes a cloud testbed framework for evaluating the HTTP flooding DDoS attack solution. The proposed framework is implemented using the OpenStack cloud environment. The Federation Internationale de Football Association (FIFA) World Cup 1998 real-time dataset is used to generate the HTTP flooding attack to the OpenStack cloud testbed framework for the experimentation.

Design and Development of Collaborative Detection and Taxonomy of DDoS Attacks Using ESVM

Distributed Denial of Service (DDoS) assault is a ceaseless basic risk to the web. Application layer DDoS Attack is gotten from the lower layers. Application layer based DDoS assaults utilize honest to goodness HTTP asks for after foundation of TCP three-way handshaking and overpowers the casualty assets, for example, attachments, CPU, memory, circle, database transfer speed. Arrange layer based DDoS assaults sends the SYN, UDP and ICMP solicitations to the server and debilitates the transfer speed. An oddity discovery system is proposed in this paper to identify DDoS assaults utilizing Enhanced Support Vector Machine (ESVM). The Application layer DDoS Attack, for example, HTTP Flooding, DNS Spoofing and Network layer DDoS Attack, for example, Port Scanning, TCP Flooding, UDP Flooding, ICMP Flooding, Land Flooding. Session Flooding is taken as test tests for ESVM. The Normal client gets to conduct characteristics is taken as preparing tests for ESVM. The movement from the testing tests and preparing tests are Cross Validated and the better arrangement exactness is acquired. Application and Network layer DDoS assaults are arranged with order exactness of 99 % with ESVM.

Distributed Denial of Service Attacks – TCP Syn Flooding Attack Mitigation

In this new era of digital science, networks and their capacities are significantly growing and increasing their market values. Attackers are gradually improving their skill sets by developing powerful tools to stay ahead in the world of black hat. Distributed Denial of Service Attacks (DDoS) are most dangerous attacks with the internet services and networks which is carried out in various forms such as server crashing, router crashing, slow performance of the CPU etc. Attackers implement various techniques to launch DDoS attacks on target computers or networks. In this paper, we discussed TCP syn flooding DDoS attack and its mitigation techniques to reduce attacks effect. We present a mitigation method of the TCP syn flood DDoS attacks on the Apache server by capturing attackers IP addresses and set the TCP – RST over the continues flow of SYN+ACK. It will reduce the effect of syn flooding with customised time duration. Through this method legitimate users can maintain their connection accessibility.

DDoS attacks on data plane of software‐defined network: are they possible?

AbstractWith software‐defined networking (SDN) becoming the leading technology for large‐scale networks, it is definitely expected that SDN will suffer various types of distributed denial‐of‐service (DDoS) attacks because of its centralized control logic. However, almost all of existing works concentrate on the controller overloading DDoS attacks, while vulnerabilities exposed by data plane of SDN for DDoS attacks are largely ignored. In this paper, we firstly investigate a flow rule flooding DDoS attack. By thoroughly analyzing the flow table size and miss rate, we find that attackers are able to inflict significant performance degradation over the system with limited volume of attack resource. We then prove that it is possible for attackers to maximize the performance degradation and minimize the attack rate at the same time. Besides the flooding DDoS attack, we also study a novel DDoS attack targeting data plane of SDN. By utilizing the entry lifetime management mechanism of flow tables, this attack almost never exhibits an intensive controller access behavior. It flies under the radar by inflicting non‐notable performance impact on the system, while it creates heavy long‐term financial burden on the target application. Finally, we present a potential countermeasure for this stealthy DDoS attack. Through extensive experiments, we conclude that DDoS attacks targeting data plane are possible. Copyright © 2016 John Wiley & Sons, Ltd.

A Novel Intrusion Detection System Based on Trust Evaluation to Defend Against DDoS Attack in MANET

With the increasing demand of data communication in Internet and electronic commerce environments, security of the data is the prime concern. Large-scale collaborative wireless mobile ad hoc networks may face attacks and damages due to harsh behavior of the malicious nodes. To protect the systems from the intrusion of the attackers, security of the system has to be improvised. In researches involving the designing of the intrusion detection system (IDS), performance efficiency of the system is bound to be compromised. For an effective data communication process in the secured system, there is a need for better IDS without reducing the performance metrics. Intrusion detection is the progression of monitoring node movements and data transmission events that occur in a system for possible intrusions. Distributed denial of service (DDOS) attacks are the primary threat for security in the collaborative wireless Mobile Ad hoc networks. The attacks due to DDOS are much severe when compared to the non DDOS attacks. So proper preventive measures are necessary to detect and revoke such attacks. Our proposed approach involves trust-based evaluation wherein the intrusion detection is done using secured trust evaluation policies. In this paper, a novel IDS is designed using the trust evaluation metrics. This is used for the detection of the flooding DDOS attacks in the networked architecture. The proposed system combines the existing Firecol-based security procedures with Dynamic Growing Self-Organizing Tree Algorithm in the trust evaluation-based environment. Simulation results show that the Trust-based IDS is found to be better in terms of Security metrics viz. Detection probability and Performance metrics viz. Packet Data Ratio, Average Delay, Throughput and Energy Consumption.

Identifying and Blocking High and Low Rate DDOS ICMP Flooding

The technique to prevent and block Distributed Denial of Service (DDoS)1 attacks has become the most difficult task, because as the attackers have lot of new trend hardware and software devices and techniques to disturb the network resources. DDoS attacks is the most vulnerable threat for all internet users and identifying these kinds of attacks as soon as it initiated from the attackers and successfully preventing it not to cause damage to network. The effective method to protect ICMP flooding DDoS attack is most required technique for these modern network security systems. The high rate of ICMP DDoS attack focuses on denying a ICMP services or its related equipments to its intended users. The high rate of attack is typically detected and blocked by the ISPs (Internet Service Providers)2 level, by forming protecting virtual rings around the preventing hosts which will defend against the high level of attacks by exchanging selected traffic details with multiple Intrusion Detection System and Intrusion Prevention System3 using a technique called FireCol4. The another most vulnerable attack called low-rate ICMP DDoS flooding5 has the ability to gradually obscure its traffic as it is much a like to ordinary traffic. The potential technique to stop this form of attack by means of HAWK (Halting Anomaly with Weighted Choking)6 system, this is based on threshold level of the packet flow is being implemented. By combining both these techniques, the increasing security threats of low and high level of ICMP flooding DDoS attacks may be identified and block to the greatest level and it can also promise that a service will never be denied to its anticipated user.

A Firegroup Mechanism to Provide Intrusion Detection and Prevention System Against DDos Attack in Collaborative Clustered Networks

Distributed Denial of Service (DDOS) attacks are the major concern for security in the collaborative networks. Although non DDOS attacks are also make the network performances poor, the effect of DDOS attacks is severe. In DDOS attacks, flooding of the particular node as victim and jam it with massive traffic happens and the complete network performance is affected. In this paper, a novel Intrusion Detection and Prevention System is designed which detects the flooding DDOS attacks based on Firecol and prevents the attacks based on Dynamic Growing Self Organizing Tree (DGSOT) for collaborative networks. Simulation results in NS2 shows that DGSOT with Firecol (Firegroup) produces better intrusion detection and prevention system. Performance metrics based on the parameters delay, throughput, average path length, packet data ratio and energy conservation are better in Firegroup than the traditional Firecol system.

Interactive Detection and Classification of DDoS Attacks Using ESVM

Distributed Denial of Service (DDoS) attack is a continuous critical threat to the internet. Application layer DDoS Attack is derived from the lower layers. Application layer based DDoS attacks use legitimate HTTP requests after establishment of TCP three way hand shaking and overwhelms the victim resources, such as sockets, CPU, memory, disk, database bandwidth. Network layer based DDoS attacks sends the SYN, UDP and ICMP requests to the server and exhausts the bandwidth. An anomaly detection mechanism is proposed in this paper to detect DDoS attacks using Enhanced Support Vector Machine (ESVM). The Application layer DDoS Attack such as HTTP Flooding, DNS Spoofing and Network layer DDoS Attack such as Port Scanning, TCP Flooding, UDP Flooding, ICMP Flooding, Land Flooding. Session Flooding are taken as test samples for ESVM. The Normal user access behavior attributes is taken as training samples for ESVM. The traffic from the testing samples and training samples are Cross Validated and the better classification accuracy is obtained. Application and Network layer DDoS attacks are classified with classification accuracy of 99 % with ESVM. Keywords— Anomaly detection, DDoS, Enhanced Support VectorMachine (ESVM), Intrusion detection, String kernels.

FireCol: A Collaborative Protection Network for the Detection of Flooding DDoS Attacks

Distributed denial-of-service (DDoS) attacks remain a major security problem, the mitigation of which is very hard especially when it comes to highly distributed botnet-based attacks. The early discovery of these attacks, although challenging, is necessary to protect end-users as well as the expensive network infrastructure resources. In this paper, we address the problem of DDoS attacks and present the theoretical foundation, architecture, and algorithms of FireCol. The core of FireCol is composed of intrusion prevention systems (IPSs) located at the Internet service providers (ISPs) level. The IPSs form virtual protection rings around the hosts to defend and collaborate by exchanging selected traffic information. The evaluation of FireCol using extensive simulations and a real dataset is presented, showing FireCol effectiveness and low overhead, as well as its support for incremental deployment in real networks.

Defending against Distributed Denial of Service Attacks: Issues and Challenges

ABSTRACT Distributed Denial of Service (DDoS) attacks on user machines, organizations, and infrastructures of the Internet have become highly publicized incidents and call for immediate solution. It is a complex and difficult problem characterized by an explicit attempt of the attackers to prevent access to resources by legitimate users for which they have authorization. Several schemes have been proposed on how to defend against these attacks, yet the problem still lacks a complete solution. The main purpose of this paper is therefore twofold. First is to present a comprehensive study of a wide range of DDoS attacks and defense methods proposed to combat them. This provides better understanding of the problem, current solution space, and future research scope to defend against DDoS attacks. Second is to propose an integrated solution for completely defending against flooding DDoS attacks at the Internet Service Provider (ISP) level.

Detection of Variations of Local Irregularity of Traffic under DDOS Flood Attack

The aim of distributed denial‐of‐service (DDOS) flood attacks is to overwhelm the attacked site or to make its service performance deterioration considerably by sending flood packets to the target from the machines distributed all over the world. This is a kind of local behavior of traffic at the protected site because the attacked site can be recovered to its normal service state sooner or later even though it is in reality overwhelmed during attack. From a view of mathematics, it can be taken as a kind of short‐range phenomenon in computer networks. In this paper, we use the Hurst parameter (H) to measure the local irregularity or self‐similarity of traffic under DDOS flood attack provided that fractional Gaussian noise (fGn) is used as the traffic model. As flood attack packets of DDOS make the H value of arrival traffic vary significantly away from that of traffic normally arriving at the protected site, we discuss a method to statistically detect signs of DDOS flood attacks with predetermined detection probability and false alarm probability.