Legitimate Flows Research Articles

Certrust: An SDN-Based Framework for the Trust of Certificates against Crossfire Attacks in IoT Scenarios

The low-intensity attack flows used by Crossfire attacks are hard to distinguish from legitimate flows. Traditional methods to identify the malicious flows in Crossfire attacks are rerouting, which is based on statistics. In these existing mechanisms, the identification of malicious flows depends on the IP address. However, the IP address is easy to be changed by attacks. Compared with the IP address, the certificate is more challenging to be tampered with or forged. Moreover, the traffic trend in the network is towards encryption. The certificates are popularly utilized by IoT devices for authentication in encryption protocols. DTLShps proposed a new way to verify certificates for resource-constrained IoT devices by using the SDN controller. Based on DTLShps, the SDN controller can collect statistics on certificates. In this paper, we propose Certrust, a framework based on the trust of certificates, to mitigate the Crossfire attack by using SDN for IoT. Our goal is threefold. First, the trust model is built based on the Bayesian trust system with the statistics on the participation of certificates in each Crossfire attack. Moreover, the forgetting curve is utilized instead of the traditional decay method in the Bayesian trust system for achieving a moderate decay rate. Second, for detecting the Crossfire attack accurately, a method based on graph connectivity is proposed. Third, several trust-based routing principles are proposed to mitigate the Crossfire attack. These principles can also encourage users to use certificates in communication. The performance evaluation shows that Certrust is more effective in mitigating the Crossfire attack than the traditional rerouting schemes. Moreover, our trust model has a more appropriate decay rate than the traditional methods.

SDNShield: NFV-Based Defense Framework Against DDoS Attacks on SDN Control Plane

Software-defined networking (SDN) is increasingly popular in today’s information technology industry, but existing SDN control plane is insufficiently scalable to support on-demand, high-frequency flow requests. Weaknesses along SDN control paths can be exploited by malicious third parties to launch distributed denial-of-service (DDoS) attacks against the SDN control plane. Recently proposed solutions only partially solve the problem, by protecting either the SDN network edges or the centralized controller. We propose SDNShield, a solution based on emerging network function virtualization (NFV) technologies, which enforces more comprehensive defense against potential DDoS attacks on SDN control plane. SDNShield incorporates a three-stage overload control scheme. The first stage statistically identifies legitimate flows with low complexity and performance overhead. The second stage further performs in-depth TCP handshake verification to ensure good flows are eventually served. The third stage intellectually salvages the misclassified legitimate flows that are falsely dropped from the first two stages. Prototype tests and real data-driven simulation results show that SDNShield can achieve high resilience against brute-force attacks, and maintain good flow-level service quality at the same time.

Discriminating flash crowds from DDoS attacks using efficient thresholding algorithm

Distributed Denial-of-Service attacks have been a challenge to cyberspace, as the attackers send a large number of attack packets similar to the normal traffic, to throttle legitimate flows. These attacks intentionally disrupt the services offered by the systems resulting in heavy cost. A flash crowd or flash event is an unexpected surge in the number of visitors to a particular website resulting in a sudden increase in server load. Flash crowds, which are legitimate flows, are difficult to be discriminated from Distributed Denial-of-Service attacks that are illicit flows. Effective and accurate detection of Distributed Denial of Service attacks still remains a challenge due to the difficulty in its detection and the false alerts generated in the case of flash crowds. There is a trade off between detection rate and false positive rate. This work deals with an efficient and early detection of distributed denial of service attacks and discriminates flash crowd by considering two network traffic parameters such as packet size and destination IP address. Using these traffic features two attributes are computed and its generalized entropies are calculated. The threshold is computed using the mean value of network attributes to detect the attacks. Threshold updater can automatically adjust the threshold values according to the changes in the channel conditions. The data sets used to evaluate the performance of the proposed approach are the MIT Lincoln Laboratory DARPA data set and a data set generated in a University network. Experimental results show this research approach achieves higher detection rate and lower false positives in a much reduced processing time as compared to the existing methods.

Trends and Challenges in Network Covert Channels Countermeasures

Network covert channels are increasingly used to endow malware with stealthy behaviors, for instance to exfiltrate data or to orchestrate nodes of a botnet in a cloaked manner. Unfortunately, the detection of such attacks is difficult as network covert channels are often characterized by low data rates and defenders do not know in advance where the secret information has been hidden. Moreover, neutralization or mitigation are hard tasks, as they require to not disrupt legitimate flows or degrade the quality perceived by users. As a consequence, countermeasures are tightly coupled to specific channel architectures, leading to poorly generalizable and often scarcely scalable approaches. In this perspective, this paper investigates trends and challenges in the development of countermeasures against the most popular network covert channels. To this aim, we reviewed the relevant literature by considering approaches that can be effectively deployed to detect general injection mechanisms or threats observed in the wild. Emphasis has been put on enlightening trajectories that should be considered when engineering mitigation techniques or planning the research to face the increasing wave of information-hiding-capable malware. Results indicate that many works are extremely specialized and an effective strategy for taming security risks caused by network covert channels may benefit from high-level and general approaches. Moreover, mechanisms to prevent the exploitation of ambiguities should be already considered in early design phases of both protocols and services.

SD-WAN Flood Tracer: Tracking the entry points of DDoS attack flows in WAN

Countering DDoS attacks in the network requires identification of attack flows and their removal, resulting in the removal of legitimate flows as well. Mitigation of attacks near the attacker reduces the chances of affecting legitimate communication as the attack path is curtailed. Hence, an efficient DDoS countermeasure requires an efficient traceback scheme to identify the attack source in order to mitigate the attack at entry point itself. This paper proposes SD-WAN Flood Tracer to facilitate tracing the attack source in software-defined wide area network (SD-WAN). The traceback scheme is divided into two parts; the first part is internal traceback to trace the sources in the vicinity of a single controller. The second part is external traceback to trace the source belonging to another controller’s vicinity. Such a global traceback scheme prevents the impact of DDoS attacks on legitimate traffic. Not just DDoS attack sources, but this scheme may also support tracking other anomaly sources as well. The traceback scheme is lightweight with low overhead on the communication channel and converges the trace quickly. The proposed scheme is capable of efficiently tracing internal anomaly sources, as well as external anomaly sources to the farthest location, preventing damage to legitimate communications in the network.

Using learning time as metrics: an artificial intelligence driven risk assess framework to evaluate DDoS cyber attack

The cloud computing and Internet of Things (IoT) have become two key technologies to meet future business requirements. However, a massive scale of Distributed Denial-of-Service (DDoS) has been widely applied to congest network critical links and to paralyze the cloud and IoT service. This is mainly due to DDoS is easily implemented, obfuscated, and occulted by launching large-scale legitimate low-speed flows and rolling target links to paralyze target network areas. Many metrics and risk access management frameworks to evaluate the impact of DDoS are proposed. However, they all lack time granularity to evaluate the cost of different scales of attacks in IoT or large-scale network structure. This study proposes an AI Driven Evaluation framework, called ADE, that applies Convolution Neural Networks to statistically evaluate the network status through end-to-end functionality (Input: network status; Output: DDoS detected or not) without any manual intervention. ADE provides quantitative security risk analysis by using learning time as the control variable, network structure as the independent variable, and time to identify DDoS as the dependent variable. The learning time to detect DDoS event and recover the system is then applied to evaluate the scale of this DDoS, the reasonability of the regulated RTO, and the vulnerability of the current net-work topology and the improvement due to the new security solution. The experiment results demonstrate the contributions of ADE are (1) providing objective and quantitative analytical security risk assessment indicator, (2) providing an autonomic DDoS defense framework without any manual intervention which allows cloud computing and Internet of Things company focuses on their service and leaves security defending to ADE, and (3) demonstrating the possibility of AI assisted risk assessment which enables security defense solution buyer with less security domain experts to evaluate suitable network defense strategy.

Using game theory to model DoS attack and defence

Denial of service (DoS) or distributed denial of service (DDoS) attacks based on bandwidth depletion remain a persistent network security threat and have always been an important issue for system administrators and researchers. Defence mechanisms proposed so far to defend against such attacks could not address the problem adequately and efficiently due to lack of quantitative approaches in modelling defence strategies against DoS/DDoS attacks. Game theory is a microeconomic and mathematical tool that provides a quantitative framework to model such attacks. A model based on game theory can act as a decision support system to the defender and augments its capabilities to take best decisions for maintaining an optimum level of network security round the clock against such attacks. Inspired by this, different DoS/DDoS scenarios, where game theory has been used to represent the strategic interaction between the attacker and a defender, are investigated. Based on the strategic interactions, a game theoretical defence mechanism is proposed to mitigate DoS/DDoS attacks. The proposed mechanism is based on two-player zero-sum game. It considers DoS/DDoS attack based on bandwidth depletion where an attacker wants to occupy maximum bandwidth of a link having a limited capacity. The attacker does so by flooding the network with unsolicited or malicious flows. The attacker has to decide an effective attack rate per flow. It has to choose an optimal size of botnet also for a cost-effective attack. It does trade-off analysis prior to attack. If its payoff or benefit obtained is less than the attack cost, it chooses to refrain from launching such a costlier DoS/DDoS attack. On the other hand, to set an upper bound on network traffic, the defender needs to set an optimum threshold per flow so that maximum attack flows are either dropped or redirected to a honeypot deployed in the network. Arbitrary setting of a threshold for flow rates can also cause a loss of legitimate flows. The defender chooses the optimum threshold value with precise estimation to minimize loss of legitimate flows. The defender also does trade-off analysis and sets the threshold in a way that can minimize the attacker’s payoff. This optimization problem is presented as a game between the attacker and defender. Action sets and objective functions of both players are defined. The network constrains are modelled and payoffs are calculated. The game converges to Nash equilibrium. The best course of actions is deduced from the Nash strategies. Results obtained by simulation and numerical calculations are in favour of the proposed game theoretical defence mechanism and strongly advocate the worthiness of using game theory to defend against DoS and DDoS attacks to strengthen network security.

Umbrella: Enabling ISPs to Offer Readily Deployable and Privacy-Preserving DDoS Prevention Services

Defending against distributed denial of service (DDoS) attacks on the Internet is a fundamental problem. However, recent industrial interviews with over 100 security experts from more than ten industry segments indicate that DDoS problems have not been fully addressed. The reasons are twofold. On one hand, many academic proposals that are provably secure witness little real-world deployment. On the other hand, the operation model for existing DDoS-prevention service providers (e.g., Cloudflare, Akamai) is privacy invasive for large organizations (e.g., government). In this paper, we present Umbrella, a new DDoS defense mechanism enabling Internet service providers to offer readily deployable and privacy-preserving DDoS prevention services to their customers. At its core, Umbrella develops a multi-layered defense architecture to defend against a wide spectrum of DDoS attacks. In particular, the flood throttling layer stops amplification-based DDoS attacks; the congestion resolving layer, aiming to prevent sophisticated attacks that cannot be easily filtered, enforces congestion accountability to ensure that legitimate flows are guaranteed to receive their fair shares regardless of attackers’ strategies; and finally the user-specific layer allows DDoS victims to enforce self-desired traffic control policies that best satisfy their business requirements. Based on Linux implementation, we demonstrate that Umbrella is capable to deal with large-scale attacks involving millions of attack flows, meanwhile imposing negligible packet processing overhead. Further, our physical test bed experiments and large-scale simulations prove that Umbrella is effective to mitigate various DDoS attacks.

LinkScope: Toward Detecting Target Link Flooding Attacks

A new class of target link flooding attacks (LFAs) can cut off the Internet connections of a target area without being detected, because they employ legitimate flows to congest selected links. Although new mechanisms for defending against LFA have been proposed, the deployment issues limit their usage, since they require either additional modules to enhance routers or using the software-defined network to replace the traditional routers. In this paper, we propose a novel framework that employs both the end-to-end and hop-by-hop network measurement techniques to capture the abnormal path performance degradation for detecting LFA and then locate the target links or areas whenever possible, and develop a prototype of the framework named LinkScope . Although using network measurement to capture network anomaly is not new, we tackle a number of challenging issues, such as conducting large-scale Internet path monitoring via non-cooperative measurement so that users do not need to install LinkScope on every host, profiling the performance of asymmetric Internet paths and detecting LFA. The extensive evaluation in a testbed and the Internet shows that with limited bandwidth and computational overhead, LinkScope can achieve timely detection and diagnosis of LFA with high detection rate and low false positive rate.

Toward Practical Spectrum Permits

As spectrum is being released from legacy technologies, reforms in policies and regulations promise to spur wireless growth by distributing spectrum dynamically across wireless networks matching their traffic demands. However, a major obstacle to its adoption remains. There is no effective solution to protect licensed users from spectrum misuse , where users transmit without properly licensing spectrum, and in doing so, interfere and disrupt legitimate flows to whom the spectrum is assigned (and sold). In this paper, we discuss an initial step toward enforcing dynamic spectrum allocation using the concept of spectrum permit , where authorized spectrum users embed secure spectrum permits into data transmissions, enabling patrolling trusted devices to detect devices transmitting without authorization. We highlight the development of spectrum permits, and describe Gelato , a spectrum misuse detection system that minimizes both hardware costs and performance overhead on legitimate data transmissions. We implement Gelato using USRP2 with laptops and lower cost RTL-SDR devices with smartphones. We show that both implementations are robust against attacks and can reliably detect spectrum permits in real time.

Low-Rate DDoS Attack Detection Using Expectation of Packet Size

Low-rate Distributed Denial-of-Service (low-rate DDoS) attacks are a new challenge to cyberspace, as the attackers send a large amount of attack packets similar to normal traffic, to throttle legitimate flows. In this paper, we propose a measurement—expectation of packet size—that is based on the distribution difference of the packet size to distinguish two typical low-rate DDoS attacks, the constant attack and the pulsing attack, from legitimate traffic. The experimental results, obtained using a series of real datasets with different times and different tolerance factors, are presented to demonstrate the effectiveness of the proposed measurement. In addition, extensive experiments are performed to show that the proposed measurement can detect the low-rate DDoS attacks not only in the short and long terms but also for low packet rates and high packet rates. Furthermore, the false-negative rates and the adjudication distance can be adjusted based on the detection sensitivity requirements.

A SOFTWARE FRAMEWORK FOR CODE SECURITY USING M-COT-METRICS BASED CODE OBFUSCATION TECHNIQUE

Programming security is a paramount concern in IT industry because of its immense monetary misfortunes. Programming is inclined to different security assaults, for example, Software piracy. In this proposal, program security assurance through code Obfuscation, a technique which opposes reverse engineering attacks. In this paper, different sets of criteria are depicted to gauge viability of code obfuscation, for example, intensity: trouble for human to comprehend code, imperviousness to computerized piracy. A large portion of the current obscurity procedures and plans fulfil just a couple of these criteria. In this paper, it shows that the novel code obfuscation plan created for securing exclusive code. A software framework for providing software security using Metric based Code Obfuscation Techniques named as M-COT is designed to propose which will maximize the objectives. The essential thought is to change unique code to obfuscated codes which will concede more state space. This is attained by developing obfuscated non inconsequential code clones for intelligent code parts exhibit in unique code. These code clones that are connected utilizing element predicate variables to present legitimate control flows. The performance of the system is observed by experimentation on a couple of projects (for example, scientific calculator code, searching) to assess our plan. The demonstration made that product unpredictability nature of obfuscated code is higher than that of unique code and comparing to single execution Despite of the fact that the proposal builds the improvement of obfuscated code (because of development of non-inconsequential code clones for legitimate code parts).

A networking solution on uplink channel of co-frequency and co-time system

Recently, Denial-of-Service (DoS) attacks have become the mainstream threat to the Internet service availability. The filter-based packet filtering is a key technology to defend against such attacks. Relying on the filtering location, the proposed schemes can be grouped into Victim-end Filtering and Source-end Filtering. The first scheme uses a single filtering router to block the attack flows near the victim, but does not take the factor that the filters are scarce resource into account, which causes the huge loss of legitimate flows; considering each router could contribute a few filters, the other extreme scheme pushes the filtering location back into each attack source so as to obtain ample filters, but this may incur the severe network transmission delay due to the abused filtering routers. Therefore, in this paper, we propose a scalable filter-based packet filtering scheme to balance the number of filtering routers and the available filters. Through emulating DoS scenarios based on the synthetic and real-world Internet topologies and further implementing the various filter-based packet filtering schemes on them, the results show that our scheme just uses fewer filtering routers to cut off all attack flows while minimizing the loss of legitimate flows.

Real-Time MAC-Layer Selfish Misbehavior Detection and Prevention Technique for Wireless Networks

Background/Objectives: Contention issue in the IEEE 802.11 based wireless network is resolved using CSMA/CA protocol that aims to ensure the Fair Share of the channel to each node in the network. A malicious node can manipulate the backoff parameters and gain large share of network access. Methods/Statistical Analysis: Since back off parameters are programmable field it can change the value any time. So real time detection of malicious behavior is required. For Real Time Detection a Markov chain-based analytical model is being used. Since the Despite of all its advantages there have been no mechanism used to monitor the MAC layer misbehavior of all the nodes in the wireless network. Only tagged nodes are being monitored. Findings: Adding to the challenge of identifying and isolating the malicious node from the network is the non-deterministic nature and distributed functionality of IEEE 802.11 based networks. In order to overcome the problem regarding the defensive mechanism and for better efficiency, this Research work has developed an efficient technique called Markov-RED-FT. By using this model all the nodes in the network can be monitored for malicious misbehavior and the flow trust value is calculated to penalize the malicious node. This proposed Markov-RED-FT employs the flow trust value to safe guard the legitimate flows. Malicious flows would be with lower trust values while legitimate flows would be with higher ones. Application/Improvements: This research work implemented the proposed Markov-RED-FT and from the results, it is established that the proposed model is performing well as compared with the existing model in terms of average detection delayand network throughput.

The ties that bind: Bi-national trade implications of the US and Canada using bi-national freight movement network via border crossings

This study combines US-Canada bi-national highway network data with a freight flow dataset using ports of entry (POE) via highway border crossings. Through several sub-procedures, the US and Canada highway systems are integrated into a single network dataset. In addition, border wait time dataset was monitored and analyzed to set the border delay baseline. This dataset enables us to explore the freight traffic pattern between the US and Canada. Weighted Eigenvector Score is computed using a Social Network Analysis tool. The results demonstrate that major regional bodies are the primary users of major POE between the US and Canada. This study not only offers an improved understanding of the economic implications of US–Canada border crossings, but also contributes to developing a simulation tool, a bi-national Transportation-combined National Interstate Economic Model. Such a tool is expected to extend and apply to other contexts, such as transportation and national and bi-national security, among other applications. Additionally, this study suggests several important considerations for US and Canadian officials charged with devising policy to protect against security threats while facilitating legitimate flows of goods, services and people across the border.

A router based packet filtering scheme for defending against DoS attacks

The filter-based reactive packet filtering is a key technology in attack traffic filtering for defending against the Denial-of-Service (DoS) attacks. Two kinds of relevant schemes have been proposed as victim-end filtering and source-end filtering. The first scheme prevents attack traffic from reaching the victim, but causes the huge loss of legitimate flows due to the scarce filters (termed as collateral damages); the other extreme scheme can obtain the sufficient filters, but severely degrades the network transmission performance due to the abused filtering routers. In this paper, we propose a router based packet filtering scheme, which provides relatively more filters while reducing the quantity of filtering routers. We implement this scheme on the emulated DoS scenarios based on the synthetic and real-world Internet topologies. Our evaluation results show that compared to the previous work, our scheme just uses 20% of its filtering routers, but only increasing less than 15 percent of its collateral damage.

RED-FT: A Scalable Random Early Detection Scheme with Flow Trust against DoS Attacks

In traditional Active Queue Management algorithms, e.g. RED, each flow, defined with the source and destination IP address of packets, fairly contends for the cache of bottleneck queues. However a malicious flow cannot be identified. And it enables potential network-layer attacks, e.g. the flooding Denial-of-Service (DoS) attack and the low-rate DoS attack. In this letter, we propose a new scheme using the flows trust values to defend against DoS attacks. Different from previous schemes, it employs the flow trust to safeguard legitimate flows. A router monitors network flows and calculates flows trust values, which are used for the relevant queue management. Malicious flows would be with lower trust values while legitimate flows would be with higher ones. Simulation results show that the scheme improves the throughput and delay in DoS attacking scenarios comparing with existing queue management algorithms. We consider the scheme is practical and effective to secure networks.

Flow level detection and filtering of low-rate DDoS

The recently proposed TCP-targeted Low-rate Distributed Denial-of-Service (LDDoS) attacks send fewer packets to attack legitimate flows by exploiting the vulnerability in TCP’s congestion control mechanism. They are difficult to detect while causing severe damage to TCP-based applications. Existing approaches can only detect the presence of an LDDoS attack, but fail to identify LDDoS flows. In this paper, we propose a novel metric – Congestion Participation Rate (CPR) – and a CPR-based approach to detect and filter LDDoS attacks by their intention to congest the network. The major innovation of the CPR-base approach is its ability to identify LDDoS flows. A flow with a CPR higher than a predefined threshold is classified as an LDDoS flow, and consequently all of its packets will be dropped. We analyze the effectiveness of CPR theoretically by quantifying the average CPR difference between normal TCP flows and LDDoS flows and showing that CPR can differentiate them. We conduct ns-2 simulations, test-bed experiments, and Internet traffic trace analysis to validate our analytical results and evaluate the performance of the proposed approach. Experimental results demonstrate that the proposed CPR-based approach is substantially more effective compared to an existing Discrete Fourier Transform (DFT)-based approach – one of the most efficient approaches in detecting LDDoS attacks. We also provide experimental guidance to choose the CPR threshold in practice.

Dynamic Approach to Defend Against Distributed Denial of Service Attacks Using an Adaptive Spin Lock Rate Control Mechanism

Problem statement: The last decade has seen many prominent Distributed Denial of Service (DDoS) attacks on high profile webservers. In this study, we deal with DDoS attacks by proposing a dynamic reactive defense system using an adaptive Spin Lock Rate control (D3SLR). D3SLR identifies malicious traffic flow towards a target system based on the volume of traffic flowing towards the victim machine. Approach: The proposed scheme uses a divide and conquer approach to identify the infected interface via which malicious traffic are received and selectively implements rate limiting based on the source of traffic flow towards victim and type of packet rather than a collective rate limiting on flow towards victim. Results: The results observed in simulation shows that D3SLR detects the onset of the attacks very early and reacts to the threat by rate limiting the malicious flow. The spin lock rate control adapts quickly to any changes in the rate of flow. Conclusion: D3SLR can be successfully implemented at critical points in the network as autonomous defense systems working independently to limit damage to the victim and also allows legitimate flows towards the target system with a higher degree of accuracy.

An Adaptive Approach for Defending against DDoS Attacks

In various network attacks, the Distributed Denial-of-Service (DDoS) attack is a severe threat. In order to deal with this kind of attack in time, it is necessary to establish a special type of defense system to change strategy dynamically against attacks. In this paper, we introduce an adaptive approach, which is used for defending against DDoS attacks, based on normal traffic analysis. The approach can check DDoS attacks and adaptively adjust its configurations according to the network condition and attack severity. In order to insure the common users to visit the victim server that is being attacked, we provide a nonlinear traffic control formula for the system. Our simulation test indicates that the nonlinear control approach can prevent the malicious attack packets effectively while making legitimate traffic flows arrive at the victim.