Flooding Attacks Research Articles

The impact of DoS (Denial of Service) cyberattacks on a Local Area Network (LAN)

In this paper I will highlight a modus operandi of hackers launching Denial of Service (DoS) cyberattacks. I will theoretically show how CAM Overflow and TCP SYN Flood attacks can be performed, using Kali Linux, a Linux distribution used by cyber criminals to launch MitM (Man-in-the-Middle) attacks, DoS attacks, observing traffic in a computer network, etc. Hackers can affect the functioning of devices on an organization’s local network (server, router, switch, etc.) by sending thousands of packets per second to the target device. CAM Overflow is an attack where a hacker aims to overcrowd the CAM table of a switch with MAC addresses, and TCP SYN Flood is an attack that can be launched against a server in the computer network.

Proficient and Safe Token with Secret and Public Keys Sharing Algorithm for Preventing Cryptographic Key Leakage in Wireless Sensor Network

Sensor devices in the Wireless Sensor Network (WSN) are commonly subjected to various forms of attacks, such as flood attacks, eavesdropping attacks, etc. When an attacker compromises a sensor device, the sensor device's data contents become non-confidential and are grabbed by the attacker, putting the entire network at risk. As a result, to prevent key leaks in WSN networks, this paper proposes a Token with Secret and Public Keys Sharing (TSP-KS) algorithm. In the existence of attackers, cryptography is used to provide secure communication. A traditional public-key cryptosystem is appropriate in cryptography since it does not need the sender and receiver to supply the same secret to communicate without risk. However, they frequently rely on complex mathematical calculations, making them far less capable than equivalent symmetric-key cryptosystems. The high cost of encrypting long messages with public-key cryptography could be problematic in a wide range of applications. A hybrid system deals with it using a combination of the two. In WSN, Admin creates a token, a secret key, a public key, and a private key. Here, the token is used for access control in sensor devices and the administrator, the secret and public keys are utilized for packet encryption in sensor devices and the base station, and the private key is utilized for decryption in the administrator. Admin shares token with secret and public key for sensor devices and base station for encryption purposes. As a result, the TSP-KS algorithm was utilized to securely share these token with secret and public keys for sensor devices and base station over a distributed way. Experimental results demonstrate that the TSP-KS algorithm securely shares a token with a secret and public key.

As 5G Mobile Private Security Analysis Based on Cloud Computing

As time passes by, the increasing demands from 4G technology services to 5G technology are getting bigger. In line with the development of 5G, there are several open sources such as Free5gc, Open5gs which already provide core 5G network services so that they can help create and simulate private 5G networks. By using free5gc open source, it still needs more attention from the security side, especially from common attacks such as DDoS. Then the attack scenario is carried out from the inner network side, namely from the UE with the TCP SYN Flood and Ping of Death attack methods. The results of the attack contained comparisons for CPU and memory usage parameters. Then the TCP SYN Flood attack had an impact on the core network function components, namely Access and Mobility Management (AMF), which in 5G services experienced errors or crashes after receiving large packets. Thus, users cannot use the service because if an error occurs in the core network function (AMF), then the connection to gNB and the UE will also be lost

A mechanism to detecting flooding attacks in quantum enabled cloud-based lowpower and lossy networks

RPL (Routing Protocol) is the Quantum enabled Cloud-based Low-Power Wireless Personal Area Networks (6LoWPAN) routing protocol. Destination Oriented Directed Acyclic Graph (DODAG) information Solicitation (DIS) messages are received by a node in the RPL protocol to access the network. This function may be abused by a malicious node to transmit illegitimate DIS messages to neighbouring nodes to launch a DIS flooding attack. It is found that the DIS flooding attack raises the overhead of the network control packet, which greatly degrades the efficiency of the network. This further raises the network resource demand of the nodes. A defence scheme called DIS-mitigation in RPL is proposed to resolve this problem. The proposed system greatly mitigates the impact of the DIS flooding attack on the output of the network and also finds the nodes that produce the DIS flood attack effectively. The efficacy of the suggested scheme is related to the traditional RPL protocol and the current stable RPL mechanism. In both static and dynamic network conditions, the experimental findings demonstrate that the proposed model identifies and mitigates DIS flooding attacks rapidly and effectively, without introducing any major overhead to the nodes.

DI-ADS: A Deep Intelligent Distributed Denial of Service Attack Detection Scheme for Fog-Based IoT Applications

Nowadays, fog computing plays a very vital role in providing many services to end-based IoT (Internet of Things) systems. The end IoT devices communicate with the middle layer fog nodes and to the above cloud layer to process the user tasks. However, this large data communication experiences many security challenges as IoT devices are being compromised and thus the fog nodes at the fog layer are more prone to a very critical attack known as Distributed Denial of Service (DDoS) attack. The attackers or the compromised IoT devices need to be detected well in the network. Deep Learning (DL) plays a prominent role in predicting the end-user behavior by extracting features and classifying the adversary in the network. But, due to IoT device’s constrained nature in computation and storage facilities, DL cannot be administered on those. In this paper, a deep intelligent DDoS attack detection scheme (DI-ADS) is proposed for fog-based IoT applications. The framework mainly uses a deep learning model (DLM) to detect DDoS attacks in the network. The DLM is installed on the computation module of the fog node that predicts the end IoT device behavior. For the selection of the best DLM model at the fog layer, the performance comparison is made on Deep Neural Multilayer Perceptron (DNMLP) and Long Short-Term Memory (LSTM) models along with the conventional machine learning (ML) models such as Support Vector Machine (SVM), K-Nearest Neighbours (KNN), Logistic Regression (LR), and Random Forest (RF). The simulation is performed using the Python Anaconda platform by considering a new DDoS-SDN (Mendeley Dataset) dataset that consists of three DDoS attacks such as TCP Syn, UDP Flood, and ICMP attacks. From the results, DNMLP showed the best accuracy of 99.44% as compared to other DL and ML models. By outperforming nature in the detection of DDoS attacks, DNMLP is considered in the proposed framework for being implemented at the fog layer.

TFAD: TCP flooding attack detection in software-defined networking using proxy-based and machine learning-based mechanisms

TFAD: TCP flooding attack detection in software-defined networking using proxy-based and machine learning-based mechanisms

C-FPA: A Cloud-Based FPA Novel Approach to Defend Hotspot Issues and Attacks in WSN

Wireless Sensor Network (WSN) is a distributed network formed by sensor nodes that perform a specific sensing task like temperature, humidity, fire attacks, and so on. Used in all sorts of application like military, medical, industrial, scientific, and so on, WSN’s are well known for high performance operations. Till date, power conservation and sensor node lifetime remained as the major drawback in such networks where the development of optimization techniques and routing protocols were proposed to overcome them. Also, attacks like DoS (Denial Of Service), Sybil attack, wormhole attack, HELLO flood attack, and identity replication attack are mostly common in a WSN. At present, Hotspot-based issues and attacks is found as one of the major and performance-degrading factor in wireless sensor network. In this paper, we propose a novel cloud-based FPA scheme or approach to defend and withstand such hotspot-related issues and attacks in WSN. Developed with the principle of Cloud, the simulation results prove that the proposed scheme offer high privacy, and routing stability.

A DDoS attack detection and countermeasure scheme based on DWT and auto-encoder neural network for SDN

Software Defined Networking provides new functionalities to easily manage, configure, and optimize network resources by introducing a clear separation between the control entity and the forwarding devices. Such functionalities also help network operators detect and mitigate the security attacks to the network and provide better security level when compared to the traditional networks. However, some security threats, particularly distributed denial of service (DDoS) attacks, keep their effectiveness in degrading the availability of the networks even if the networking paradigm have changed. Existing DDoS attack detection approaches for SDN are mainly based on statistical (threshold-based) and Machine Learning-based (ML) approaches. Considering the dynamic characteristics of the network traffic, finding a dynamic threshold is somehow problematic. On the other hand, finding an appropriate feature that can discriminate DDoS attack from normal traffic is challenging for ML-based approaches. Therefore, to address the aforementioned issues, in this work, we propose a DDoS attack detection and countermeasure scheme based on discrete wavelet transform (DWT) and auto-encoder neural network for SDN. The proposed scheme extracts statistical features from the wavelet transform to be processed by an auto-encoder neural network to detect samples of DDoS attack traffic. Later, to reduce the computational burden imposed by the neural network model, the average hit rate in the flow table of the switches is used to activate the DDoS detection of the scheme. We also provide a detailed performance analysis by considering the computational cost complexity of the algorithms proposed in scheme and the evaluation of the successful detection rate with simulations. Our experimental results show that the proposed scheme achieves high detection rate against DNS amplification, Network Time Protocol and TCP SYN flood attacks with a remarkably low false alarm rate.

ReLFA: Resist link flooding attacks via renyi entropy and deep reinforcement learning in SDN-IoT

Link flooding attack (LFA) is a fresh distributed denial of service attack (DDoS). Attackers can cut off the critical links, making the services in the target area unavailable. LFA manipulates legal low-speed flow to flood critical links, so traditional technologies are difficult to resist such attack. Meanwhile, LFA is also one of the most important threats to Internet of things (IoT) devices. The introduction of software defined network (SDN) effectively solves the security problem of the IoT. Aiming at the LFA in the software defined Internet of things (SDN-IoT), this paper proposes a new LFA mitigation scheme ReLFA. Renyi entropy is to locate the congested link in the data plane in our scheme, and determines the target links according to the alarm threshold. When LFA is detected on the target links, the control plane uses the method based on deep reinforcement learning (DRL) to carry out traffic engineering. Simulation results show that ReLFA can effectively alleviate the impact of LFA in SDN IoT. In addition, the rerouting time of ReLFA is superior to other latest schemes.

Moby: A Blackout-Resistant Anonymity Network for Mobile Devices

Internet blackouts are challenging environments for anonymity and censorship resistance. Existing popular anonymity networks (e.g., Freenet, I2P, Tor) rely on Internet connectivity to function, making them impracticable during such blackouts. In such a setting, mobile ad-hoc networks can provide connectivity, but prior communication protocols for ad-hoc networks are not designed for anonymity and attack resilience. We address this need by designing, implementing, and evaluating Moby, a blackout-resistant anonymity network for mobile devices. Moby provides end-to-end encryption, forward secrecy and sender-receiver anonymity. It features a bi-modal design of operation, using Internet connectivity when available and ad-hoc networks during blackouts. During periods of Internet connectivity, Moby functions as a regular messaging application and bootstraps information that is later used in the absence of Internet connectivity to achieve secure anonymous communications. Moby incorporates a model of trust based on users’ contact lists, and a trust establishment protocol that mitigates flooding attacks. We perform an empirically informed simulation-based study based on cellphone traces of 268,596 users over the span of a week for a large cellular provider to determine Moby’s feasibility and present our findings. Last, we implement and evaluate the Moby client as an Android app.

Comparative Analysis of Several Anomaly Detection Algorithm with its Impact Towards the Security and its Performance

Anomaly detection in network traffic is a promising and effective technique to enhance network security. In addition to traditional statistical analysis and rule-based detection techniques, machine learning models are introduced for intelligent detection of abnormal traffic data. A Denial of Service (DoS) attack is a malicious effort to keep endorsed users of a website or web service from accessing it, or limiting their ability to do so. A Distributed Denial of Service (DDoS) attack is a type of DoS attack in which many computers are used to cripple a web page, website or web based service. Fault either in users’ implementation of a network or in the standard specification of protocols has resulted in gaps that allow various kinds of network attack to be launched of the type of network attacks, denial-of-service flood attacks have reason the most severe impact. This analysis study on flood attacks and Flash Crowd their improvement, classifying such attacks as either high-rate flood or low-rate flood. Finally, the attacks are appraised against principle related to their characteristics, technique and collision. This paper discusses a statistical approach to analysis the distribution of network traffic to recognize the normal network traffic behavior. This paper also discusses a various method to recognize anomalies in network traffic.

Secured Mailing System for Eliminating Spam and Flood Attacks

Abstract: Threatening to spam considers cement strategiesfor seeing unrequested email from the email content and frameworks for utilizing carrier data. In the event that it will overall be troublesome from the source's IP address of carrier information and the carrier's area name whether theemail ought to be gotten, it is feasible to diminish the treatment of the spam channel by the email content that hasa high separating load for the goal. This study utilizes source confirmation improvement to perceive the carrier of sent email. We consider that the wellspring of this sent email is the embraced email carrier to get, and thinking to utilize these as a permit list. In this paper, we set forth a strategy to furthermore refresh the system we set forth and reduction mix-up of the permit list. We showed that this newmethodology solid by utilizing the log information of the messages really got

Secured Clustered Internet of Things Wireless Sensor Network

The Internet of Things (IoT) is a swiftly evolving technology that will have a significant impact in the future. The Internet of Things (IoT) is a huge collection of interconnected networks, such as the Wireless Sensor Network (WSN), that make use of fast evolving devices and technologies. The risk of confidentiality of information and protection has increased as a result of the indefinite interconnection of a variety of applied sciences in IoT. WSN employs Low Energy Adaptive Clustering Hierarchy (LEACH) to create an energy-efficacious network that is vulnerable to a wide range of assaults, including the HELLO flood. This work employs AS-LEACH (Abundant Secure LEACH) as an extension to the LEACH protocol to protect cluster heads from Hello flood attacks. For the purpose of validating a sensor node as CH, AS-LEACH employs RBG color cube numbers, a distinct Abundant number, and each sensor node has its own unique ID. The NS2 network simulator is utilized to implement AS-LEACH and verify its efficiency in this proposed work.

Real-time DDoS flood attack monitoring and detection (RT-AMD) model for cloud computing.

In recent years, the advent of cloud computing has transformed the field of computing and information technology. It has been enabling customers to rent virtual resources and take advantage of various on-demand services with the lowest costs. Despite the advantages of cloud computing, it faces several threats; an example is a distributed denial of service (DDoS) attack, which is considered among the most serious. This article presents real-time monitoring and detection of DDoS attacks on the cloud using a machine learning approach. Naïve Bayes, K-nearest neighbor, decision tree, and random forest machine learning classifiers have been selected to build a predictive model named “Real-Time DDoS flood Attack Monitoring and Detection RT-AMD.” The DDoS-2020 dataset was constructed with 70,020 records to evaluate RT-AMD’s accuracy. The DDoS-2020 contains three protocols for network/transport-level, which are TCP, DNS, and ICMP. This article evaluates the proposed model by comparing its accuracy with related works. Our model has shown improvement in the results and reached real-time attack detection using incremental learning. The model achieved 99.38% accuracy for the random forest in real-time on the cloud environment and 99.39% on local testing. The RT-AMD was evaluated on the NSL-KDD dataset as well, in which it achieved 99.30% accuracy in real-time in a cloud environment.

Analysis of the vulnerability estimation and neighbor value prediction in autonomous systems.

The security within autonomous systems (AS)s is one of the important measures to keep network users safe and stable from the various type of Distributed Denial of Service (DDoS) attacks. Similar to the other existing attack types Internet control message protocol (ICMP) based attacks are remained open challenge on the Internet environment. In this study, we have proposed a method to estimate the vulnerability of 600 AS provider edge (PE) routers by sending ICMP packets and predicted AS neighbor values using least square regression (LSR) approach. The results of our study show that 265 AS PE routers are vulnerable due to ICMP flood attack from the 600 ASs which were analyzed. Additionally, we have predicted that about 60% of total AS neighbors will be reduced in the next 3 years. Our results indicate that some ASs still did not deploy the firewall system in the boundary of their networks. Similarly, we also observed that the majority of ASs which expected to have less neighbor values in the next 3 years is due to change their routing paths to find adjacent paths.

Detecting flooding DDoS attacks in software defined networks using supervised learning techniques

For the easy and flexible management of large scale networks, Software-Defined Networking (SDN) is a strong candidate technology that offers centralisation and programmable interfaces for making complex decisions in a dynamic and seamless manner. On the one hand, there are opportunities for individuals and businesses to build and improve services and applications based on their requirements in the SDN. On the other hand, SDN poses a new array of privacy and security threats, such as Distributed Denial of Service (DDoS) attacks. For detecting and mitigating potential threats, Machine Learning (ML) is an effective approach that has a quick response to anomalies. In this article, we analyse and compare the performance, using different ML techniques, to detect DDoS attacks in SDN, where both experimental datasets and self-generated traffic data are evaluated. Moreover, we propose a simple supervised learning (SL) model to detect flooding DDoS attacks against the SDN controller via the fluctuation of flows. By dividing a test round into multiple pieces, the statistics within each time slot reflects the variation of network behaviours. And this ”trend” can be recruited as samples to train a predictor to understand the network status, as well as to detect DDoS attacks. We verify the outcome through simulations and measurements over a real testbed. Our main goal is to find a lightweight SL model to detect DDoS attacks with data and features that can be easily obtained. Our results show that SL is able to detect DDoS attacks with a single feature. The performance of the analysed SL algorithms is influenced by the size of training set and parameters used. The accuracy of prediction using the same SL model could be entirely different depending on the training set.

The Robustness of Detecting Known and Unknown DDoS Saturation Attacks in SDN via the Integration of Supervised and Semi-Supervised Classifiers

The design of existing machine-learning-based DoS detection systems in software-defined networking (SDN) suffers from two major problems. First, the proper time window for conducting network traffic analysis is unknown and has proven challenging to determine. Second, it is unable to detect unknown types of DoS saturation attacks. An unknown saturation attack is an attack that is not represented in the training data. In this paper, we evaluate three supervised classifiers for detecting a family of DDoS flooding attacks (UDP, TCP-SYN, IP-Spoofing, TCP-SARFU, and ICMP) and their combinations using different time windows. This work represents an extension of the runner-up best-paper award entitled ‘Detecting Saturation Attacks in SDN via Machine Learning’ published in the 2019 4th International Conference on Computing, Communications and Security (ICCCS). The results in this paper show that the trained supervised models fail in detecting unknown saturation attacks, and their overall detection performance decreases when the time window of the network traffic increases. Moreover, we investigate the performance of four semi-supervised classifiers in detecting unknown flooding attacks. The results indicate that semi-supervised classifiers outperform the supervised classifiers in the detection of unknown flooding attacks. Furthermore, to further increase the possibility of detecting the known and unknown flooding attacks, we propose an enhanced hybrid approach that combines two supervised and semi-supervised classifiers. The results demonstrate that the hybrid approach has outperformed individually supervised or semi-supervised classifiers in detecting the known and unknown flooding DoS attacks in SDN.

An Intelligent Model for DDoS Attack Detection and Flash Event Management

Distributed Denial of Service (DDoS) attacks are the foremost security concerns on the Internet. DDoS attacks and a similar occurrence called Flash Event (FE) signify anomalies in the normal network traffic, requiring intelligent interventions. This study presents the design and implementation of an intelligent model for the detection of application-layer DDoS attacks and the prevention of service degradations during FE. A Multi-Layer Perceptron (MLP) classifier was used for detecting DDoS attacks on application servers. The FE management system consists of asynchronous processing of requests on a First-In, First-Out (FIFO) basis. A demo application was set up wherein HTTP flood attack was launched and a Flash Event was simulated. The experimental results clearly show that the MLP classifier in comparison with other machine learning classifiers performs best in terms of speed and accuracy. Also, the evaluation of the FE management system shows a great reduction in service degradation. This reflects that the designed model is capable of averting service unavailability on the web.

Link Security Situation Identification Method Based on the Ad Hoc Network of Medical Units.

In order to strengthen the management and security status monitoring of the internal network of medical units and make up for security vulnerabilities in time, an ad hoc network link security situation identification method is proposed. According to the architecture of the ad hoc network, it is analyzed that it has the advantages of strong persistence and its own protocol. Combined with the data of detection equipment and security log, the hierarchical acquisition model is used to obtain the situation elements such as port scanning attack and flood attack. The transmission rate factor, forwarding rate factor, dispersion factor, and node aggregation factor are regarded as eigenvectors. We determine the relationship between identity, difference, and opposition, identify the security situation through the description of the node state, and conduct quantitative processing to obtain the final identification result. The experimental results show that the weight value of this method is the same as the standard weight, which can identify the security situation level, obtain the specific situation value, and present a more intuitive identification result.

Clustering and Securing IoT Wireless Sensor Network

One of the future rising technologies is Internet of Things (IoT) that will play a significant role in linking the world. IoT is a group of a huge number of interrelated networks including Wireless Sensor Network (WSN). IoT makes use of speedily developing devices and technologies. A large number of unlimited interconnections of numerous technologies in IoT makes privacy and safety of data as a matter of concern. WSN makes use of Low Energy Adaptive Clustering Hierarchy (LEACH) for the purpose of construction of sensor networks that are energy-efficient. These networks are likely to a huge number of attacks including HELLO flood attack. This paper presents a novel protocol named CS-LEACH (Cyclic Secure LEACH) for securing cluster head from Hello flood attack as an extension to LEACH protocol. CS-LEACH makes use a unique Cyclic number, an exclusive ID and RBG color cube numbers for each sensor node so as to authenticate one of the nodes as CH. The CS-LEACH is executed by making use of NS2 simulator for the purpose of proving its efficiency.