Denial Of Service Flooding Attacks Research Articles

An extended evaluation on machine learning techniques for Denial-of-Service detection in Wireless Sensor Networks

Despite the research efforts in the last years, Denial-of-Service (DoS) attacks detection still represent a challenge for the Internet of Things (IoT) scenarios composed of hard-constrained networks, as Wireless Sensor Networks (WSN). Machine Learning (ML) techniques have been presented as a promising alternative for detecting DoS attacks. Therefore, understanding the impact of the different ML techniques in a comprehensive way is quite important. In this work, we present an extended evaluation covering both supervised and unsupervised ML techniques considering three feature selection algorithms. Our experiments are based on Flooding, Grayhole, and Blackhole DoS attacks from a public WSN-based dataset. As an additional contribution, we investigate the adjustable parameter K to maximize the performance of unsupervised techniques. Experimental comparison is guided by the accuracy, recall, precision, F1-Score, and processing time metrics. Results reveal that, among the studied ML algorithms, the supervised techniques present better performance than the unsupervised ones: the highest F1-Score (95.69%) was obtained by the REPTree with the OneR feature selection algorithm for detecting blackhole attacks. In general, supervised techniques are faster than unsupervised. REPTree is the fastest, spending 0.931 μs on average to classify a sample.

No more DoS? An empirical study on defense techniques for web server Denial of Service mitigation

Denial-of-Service (DoS) attacks are becoming increasingly common and undermine the availability of widely used web servers. Even if DoS attacks cannot be rendered completely harmless, ready-to-use defense modules and solutions to mitigate their effect are highly beneficial for site administrators. Unfortunately, there is a lack of measurement studies that explore the pros and cons of common DoS web server defense modules in order to understand their limitations and to drive practitioners’ choices.This paper presents an empirical study of the ubiquitous Apache web server, with an assessment of two well-known pluggable defense modules and an enlargement technique that provides the server with additional resources. Measurements are based on a mixture of flooding and slow DoS attacks. The experimentation shows that, in spite of the large availability of pluggable security modules that can be usefully deployed in practice, there is not a bulletproof defense solution to mitigate the DoS attacks in hand. The findings of our analysis can be useful to support the deployment of proper defense mechanisms, as well as the development of robust and effective solutions for DoS protection.

Detection of Distributed Denial of Service Flooding Attack Using Odds Ratio

Computer networks are vulnerable to many types of attacks while the Distributed Denial of Service attack (DDoS) serves as one of the top concerns for security professionals. The DDoS flooding attack denies the services by consuming the server resources to prevent the legitimate users from using their desired services. The hardness of detecting this attack lies in sending a stream of packets to the server with spoofed IP addresses, so that the internet routing infrastructure cannot distinguish the spoofed packets. Based on the odds ratio (OR) statistical measurement, in this work we propose a new detection method for the DDoS flooding attacks. By exploring the odds ratio to determine the risk factor of any incoming traffic to the server, the legitimate and attack traffic packets can be easily differentiated. Experimental results demonstrate the efficiency of the presented detection method in terms of its detection probability and detection time.

Blocking Distributed Denial of Service Flooding Attacks with Dynamic Path Detectors

Blocking Distributed Denial of Service Flooding Attacks with Dynamic Path Detectors

A Security Scheme to Mitigate Denial of Service Attacks in Delay Tolerant Networks

Denial of Service (DoS) attacks are a major network security threat which affects both wired and wireless networks. The effect of DoS attacks is even more damaging in Delay Tolerant Networks (DTNs) due to their unique features and network characteristics. DTN is vulnerable to resource exhaustion and flooding DoS attacks. Several DoS mitigating schemes for wired and wireless networks have been investigated and most of them have been found to be highly interactive requiring several protocol rounds, resource-consuming, complex, assume persistent connectivity and hence not suitable for DTN. To mitigate the impact of resource exhaustion and flooding attacks in DTN, we propose a security scheme which integrates ingress filtering, rate limiting and light-weight authentication security mechanisms to monitor, detect and filter attack traffic. We propose three variants of light-weight bundle authenticators called DTNCookies. To make the proposed DTNCookies random and hard to forge, we exploit the assumption that DTN nodes are loosely time-synchronized to generate different nonce values in different timeslots for the computation and verification of our proposed DTNCookies. The results demonstrate the efficiency and effectiveness of the proposed scheme to detect and drop attack traffic. The simulation results also show good performance for the proposed scheme in terms of energy and bandwidth efficiency, high delivery ratio and low latency.

Analysis of the Impact of AuthRF and AssRF Attacks on IEEE 802.11e-based Access Point

This paper analyzes several Denial of Service (DoS) attacks at Medium Access Control (MAC) level, with an emphasis on the attacks related to authentication and association mechanisms in WLANs. In particular, a detailed analytical model is presented based on IEEE 802.11e access point (AP) queuing model, which shows the impact of the authentication and association flooding attacks. Using the proposed queuing model, the paper discusses the differences in behavior of APs based on both IEEE 802.11 and IEEE 802.11e standards, under DoS attacks. The analytical model is further extended in order to tackle the 802.11e AP behavior, followed by appropriate quantitative results for different types of Authentication Request Flooding (AuthRF) and Association Request Flooding (AssRF) DoS attacks. More specific, the paper analyzes the AP behavior being under AuthRF DoS attacks with three different levels of attack intensity: Low Level (LL), Medium Level (ML) and High Level (HL), at the same time assuming different traffic priorities. The analysis reveals that during the attack, the implemented algorithm plays a significant role in the overall performance. Namely, if an appropriate model is applied during LL and ML DoS attacks, the high priority traffic will be less affected, providing it with an opportunity to be served with significantly lower losses compared to the low priority traffic. The proposed queuing model and the developed analytical approach can be also used for each protocol layer, especially if the attacks involve flooding with too many requests (ICMP, TCP SYN, UDP etc.). The last part of the paper provides a comprehensive survey of different mechanisms used to mitigate the effects of the DoS attacks on MAC sublayer.

Machine learning approach for detection of flooding DoS attacks in 802.11 networks and attacker localization

IEEE 802.11 Wi-Fi networks are prone to a large number of Denial of Service (DoS) attacks due to vulnerabilities at the media access control (MAC) layer of 802.11 protocol. In this work, we focus on the flooding DoS attacks in Wi-Fi networks. In flooding DoS attacks, a large number of legitimate looking spoofed requests are transmitted to a victim access point (AP). The processing of large number of spoofed frames results in a huge load at the AP, resulting in a flooding DoS attack. Current methods to detect the flooding DoS use encryption, signal characteristics, protocol modification, upgradation to newer standards etc. which are often expensive to operate and maintain. In this paper, we propose a novel Machine Learning (ML) based intrusion detection system along with intrusion prevention system (IPS) that not only detects the flooding DoS attacks in Wi-Fi networks, but also helps the victim station (STA) in recovering swiftly from the attack. To the best of our knowledge, the usage of ML based techniques for detection of flooding DoS attacks in 802.11 networks has largely been unexplored. The ML based IDS detects the flooding DoS attacks with a high accuracy (precision) and detection rate (recall). After the attack is detected, the location of the attacker is ascertained using Angle of Arrival based localization algorithm and traffic coming from the attacker region is blocked which helps in mitigating the effect of flooding DoS attack.

Analysis of Flooding DoS Attacks Utilizing DNS Name Error Queries

The Domain Name System (DNS) is a critical Internet infrastructure that provides name to address mapping services. In the past decade, Denial-of-Service (DoS) attacks have targeted the DNS infrastructure and threaten to disrupt this critical service. While the flooding DoS attacks may be alleviated by the DNS caching mechanism, we show in this paper that flooding DoS attacks utilizing name error queries is capable of bypassing the cache of resolvers and thereby impose overwhelming flooding attacks on the name servers. We analyze the impacts of such DoS attacks on both name servers and resolvers, which are further illustrated by May 19 China’s DNS Collapse. We also propose the detection and defense approaches for protecting DNS servers from such DoS attacks. In the proposal, the victim zones and attacking clients are detected through monitoring the number of corresponding responses maintained in the negative cache. And the attacking queries can be mitigated by the resolvers with a sample proportion adaptive to the percent of queries for the existent domain names. We assess risks of the DoS attacks by experimental results. Measurements on the request rate of DNS name server show that this kind of attacks poses a substantial threat to the current DNS service.

ISPs and Denial of Service Attacks

A denial of service (DOS) attack is any malicious attempt to deprive legitimate customers of their ability to access services, such as a Web server. DOS attacks fall into two broad categories: • Server vulnerability DOS attacks — attacks that exploit known bugs in operating systems and servers. These attacks typically will use the bugs to crash programs that users routinely rely upon, thereby depriving those users of their normal access to the services provided by those programs. Examples of vulnerable systems include all operating systems, such as Windows NT or Linux, and various Internet-based services such as DNS, Microsoft's IIS Servers, Web servers, etc. All of these programs, which have important and useful purposes, also have bugs that hackers exploit to bring them down or hack into them. This kind of DOS attack usually comes from a single location and searches for a known vulnerability in one of the programs it is targeting. Once it finds such a program, the DOS attack will attempt to crash the program to deny service to other users. Such an attack does not require high bandwidth. • Packet flooding DOS attacks — attacks that exploit weaknesses in the Internet infrastructure and its protocols. Floods of seemingly normal packets are used to overwhelm the processing resources of programs, thereby denying users the ability to use those services. Unlike the previous category of DOS attacks, which exploit bugs, flood attacks require high bandwidth in order to succeed. Rather than use the attacker's own infrastructure to mount the attack (which might be easier to detect), the attacker is increasingly likely to carry out attacks through intermediary computers (called zombies) that the attacker has earlier broken into. Zombies are coordinated by the hacker at a later time to launch a distributed DOS (DDOS) attack on a victim. Such attacks are extremely difficult to trace and defend with the present-day Internet. Most zombies come from home computers, universities, and other vulnerable infrastructures. Often, the owners of the computers are not even aware that their machines are being co- opted in such attacks. The hacker community has invented numerous scripts to make it convenient for those interested in mounting such attacks to set up and orchestrate the zombies. Many references are available on this topic.1–4