Mitigate Denial Of Service Attacks Research Articles

TPAAD: Two‐phase authentication system for denial of service attack detection and mitigation using machine learning in software‐defined network

AbstractSoftware‐defined networking (SDN) has received considerable attention and adoption owing to its inherent advantages, such as enhanced scalability, increased adaptability, and the ability to exercise centralized control. However, the control plane of the system is vulnerable to denial‐of‐service (DoS) attacks, which are a primary focus for attackers. These attacks have the potential to result in substantial delays and packet loss. In this study, we present a novel system called Two‐Phase Authentication for Attack Detection that aims to enhance the security of SDN by mitigating DoS attacks. The methodology utilized in our study involves the implementation of packet filtration and machine learning classification techniques, which are subsequently followed by the targeted restriction of malevolent network traffic. Instead of completely deactivating the host, the emphasis lies on preventing harmful communication. Support vector machine and K‐nearest neighbours algorithms were utilized for efficient detection on the CICDoS 2017 dataset. The deployed model was utilized within an environment designed for the identification of threats in SDN. Based on the observations of the banned queue, our system allows a host to reconnect when it is no longer contributing to malicious traffic. The experiments were run on a VMware Ubuntu, and an SDN environment was created using Mininet and the RYU controller. The results of the tests demonstrated enhanced performance in various aspects, including the reduction of false positives, the minimization of central processing unit utilization and control channel bandwidth consumption, the improvement of packet delivery ratio, and the decrease in the number of flow requests submitted to the controller. These results confirm that our Two‐Phase Authentication for Attack Detection architecture identifies and mitigates SDN DoS attacks with low overhead.

Moving Target Defense-Based Denial-of-Service Mitigation in Cloud Environments: A Survey

With the increased frequency and intensity of denial-of-service (DoS) attacks on critical cloud-hosted services, resource adaptation schemes adopted by the cloud service providers (CSPs) need to be intelligent. Specifically, they need to be adaptable to attack behavior and be dynamic to curb resource over-utilization. The concept of moving target defense (MTD) has recently emerged as an effective and agile defense mechanism against DoS attacks that particularly target cloud-hosted applications. However, the existing surveys that seek to explore this space either focus more on MTD for generic cyberattack mitigation or on DoS attack defense on cloud systems. In this survey, we particularly provide an in-depth analysis on how MTD can help recover critical cloud assets in the face of DoS attacks and how emerging programmable technologies such as software-defined networking (SDN) can be leveraged to achieve that goal. Unlike existing surveys, we categorize DoS attacks on cloud platforms based on their working mechanism. We also discuss the non-MTD-based DoS defense strategies for both cloud and non-cloud infrastructures in order to highlight the pros and cons of MTD-based strategies. We introduce MTD working mechanisms and present how existing research is envisioning MTD’s application in mitigating DoS attacks, both with and without SDN. We also take an in-depth look at the testbed implementations and resilience and performance evaluations of MTD approaches. Finally, we articulate the existing challenges in MTD for DoS mitigation in cloud systems and how these challenges are shaping the future research in this domain.

DoSGuard: Mitigating Denial-of-Service Attacks in Software-Defined Networks.

Software-defined networking (SDN) is a new networking paradigm that realizes the fast management and optimal configuration of network resources by decoupling control logic and forwarding functions. However, centralized network architecture brings new security problems, and denial-of-service (DoS) attacks are among the most critical threats. Due to the lack of an effective message-verification mechanism in SDN, attackers can easily launch a DoS attack by faking the source address information. This paper presents DoSGuard, an efficient and protocol-independent defense framework for SDN networks to detect and mitigate such attacks. DoSGuard is a lightweight extension module on SDN controllers that mainly consists of three key components: a monitor, a detector, and a mitigator. The monitor maintains the information between the switches and the hosts for anomaly detection. The detector utilizes OpenFlow message and flow features to detect the attack. The mitigator protects networks by filtering malicious packets. We implement a prototype of DoSGuard in the floodlight controller and evaluate its effectiveness in a simulation environment. Experimental results show the DoSGuard achieves 98.72% detecion precision, and the average CPU utilization of the controller is only around 8%. The results demonstrate that DoSGuard can effectively mitigate DoS attacks against SDN with limited overhead.

A Deep Learning-Based Intrusion Detection and Preventation System for Detecting and Preventing Denial-of-Service Attacks

This document classifies, selects and trains a deep learning algorithm to create an IDS/IPS (Intrusion Prevention/Detection System) called Dique, which can detect and prevent denial of service (DoS) attacks. To mitigate DoS attacks, the IDS/IPS system, using the proposed deep learning model, classifies incoming packets to the web server into two classes: benign (which are normal traffic packets) and malicious (which the system considers to contain possible DoS attacks). Dique has a Graphical User Interface (GUI) where "in real time" you can display graphically and textually the information of captured and classified packets, and allows you to switch between the IDS mode and the IPS mode of the system operation. The proposed DoS attack classification model uses a multi-layered Deep Feed Forward neural network, the CICDDoS2019 Dataset was used for training and an accuracy of 0.994 was achieved. In addition, an offensive system called Diluvio was developed to verify the functioning of the Dique system. In Diluvio seven different types of DoS attacks were implemented (five contents in the training Datset and two that are not in said dataset) that users can selectively launch against a web server.

An Overview of Moderation Strategies of Refusal of-Administration Assault on Web of Things

IoT is a new technology that is making its presence felt in various domains, including industry, home appliances, and the automobile sector, among others. One of the primary objectives of IoT devices is to capture data and seamlessly exchange it within an information network. However, the vulnerability of IoT networks to numerous attacks raises significant security concerns for IoT devices. One such attack is the Denial of Service (DoS) attack, which blocks legitimate users from accessing the network, rendering network resources unavailable for an uncertain period. To mitigate the impact of DoS attacks, there is a need for techniques that can detect and prevent these attacks from harming the network. This paper aims to review various methods and techniques and recommends the use of AI, ML, and trust-based mechanisms to mitigate DoS attacks on IoT.

IPv6 Cryptographically Generated Address: Analysis, Optimization and Protection

In networking, one major difficulty that nodes suffer from is the need for their addresses to be generated and verified without relying on a third party or public authorized servers. To resolve this issue, the use of self-certifying addresses have become a highly popular and standardized method, of which Cryptographically Generated Addresses (CGA) is a prime example. CGA was primarily designed to deter the theft of IPv6 addresses by binding the generated address to a public key to prove address ownership. Even though the CGA technique is highly effective, this method is still subject to several vulnerabilities with respect to security, in addition to certain limitations in its performance. In this study, the authors present an intensive systematic review of the literature to explore the technical specifications of CGA, its challenges, and existing proposals to enhance the protocol. Given that CGA generation is a time-consuming process, this limitation has hampered the application of CGA in mobile environments where nodes have limited energy and storage. Fulfilling Hash2 conditions in CGA is the heaviest and most time-consuming part of SEND. To improve the performance of CGA, we replaced the Secure Hash Algorithm (SHA1) with the Message Digest (MD5) hash function. Furthermore, this study also analyzes the possible methods through which a CGA could be attacked. In conducting this analysis, Denial-of-Service (DoS) attacks were identified as the main method of attack toward the CGA verification process, which compromise and threaten the privacy of CGA. Therefore, we propose some modifications to the CGA standard verification algorithm to mitigate DoS attacks and to make CGA more security conscious.

AN INTELLIGENT SOFTWARE DEFINED NETWORKING CONTROLLER COMPONENT TO DETECT AND MITIGATE DENIAL OF SERVICE ATTACKS

Despite many advantages of software defined networking (SDN) such as manageability, scalability, and performance, it has inherent security threats. In particular, denial of service (DoS) attacks are major threats to SDN. The controller’s processing and communication abilities are overwhelmed by DoS attacks. The capacity of the flow tables in the switching device is exhausted due to excess flows created by the controller because of malicious packets. DoS attacks on the controller cause the network performance to drop to a critical level. In this paper, a new SDN controller component was proposed to detect and mitigate DoS attacks in the SDN controller. POX layer three controller component was used for underlying a testbed for PacketIn messages. Any packet from the host was incremented to measure the rate of packet according to its device identification and its input port number. Considering the rate of packets received by the controller and threshold set, malicious packets could be detected and mitigated easily. A developed controller component was tested in a Mininet simulation environment with an hping3 tool to build artificial DoS attacks. Using the enhanced controller component, DoS packets were prevented from accessing the controller and thus, the data plane (switching devices) was prevented from being filled with unwanted flows.

Modern Machine Learning for Cyber-Defense and Distributed Denial-of-Service Attacks

In computer networks, denial-of-service (DoS) attacks attempt to make computers or network resources unavailable for their intended use. DoS attacks are difficult to detect and mitigate since they normally do not attempt to access the private data of their intended victim, but rather intend to disrupt the publicly available resources their victims provide. This article discusses methods for detecting and mitigating DoS attacks with a focus on techniques that leverage machine learning algorithms. Such algorithms promise to: (a) detect when computer services are being used in an adversarial fashion, (b) separate network traffic into nominal and anomalous components, and (c) provide opportunities for mitigating the attacks while maintaining the integrity of the effected services. The key ingredient of the ideas presented here is the use of correlations and dependencies in computer access patterns, and the larger context in which they exist, to separate the “wheat” – the real users of the services – from the “chaff” –the perpetrators who are attempting to disrupt the services.

PYGRID: A software development and assessment framework for grid‐aware software defined networking

AbstractThe Internet of Things (IoT) envisions to connect Advanced Metering Infrastructure (AMI) to the Internet to facilitate efficient resource management in smart cities. Smart grid is the evolutionary approach towards a more dynamic, situation‐aware, and elastic power systems in smart cities. However, due to the huge scale, heterogeneity and complexity of the many interconnected cyber and physical devices, current network and security technologies are incapable of best serving these needs. Destructive attacks targeting these components such as Denial of Service (DoS) may fully use grid structure and disrupt its crucial service. Recent researches offer the use of modern Software Defined Networking (SDN) to solve synonymous Cyber Physical Systems (CPS) network and security challenges. These researches noted the lack of an adequate platform to simulate grid systems network infrastructure. Therefore, in this paper, we present PYGRID, a software development and assessment framework for grid‐aware SDN. Additionally, a top level SDN application is developed in SDN‐enabled smart grid network to demonstrate the effectiveness of such merger and to mitigate DoS attacks. PYGRID is developed using PYTHON, an OSI‐approved open source language considering standard client and server industrial communication protocols. IEEE 14‐bus power system is adopted to demonstrate the potent and effectiveness of the proposed solution. We conducted multiple experiments to validate the developed framework over 14‐bus system using PYPOWER. To the best of our knowledge, the resulted platform may be considered the first completely open source implementation of a secure SDN enabled smart grid simulator.

Mitigating DoS Attacks Against Pseudonymous Authentication Through Puzzle-Based Co-Authentication in 5G-VANET

The upcoming Fifth Generation (5G) networks can provide ultra-reliable ultra-low latency vehicle-to-everything for vehicular ad hoc networks (VANET) to promote road safety, traffic management, information dissemination, and automatic driving for drivers and passengers. However, 5G-VANET also attracts tremendous security and privacy concerns. Although several pseudonymous authentication schemes have been proposed for VANET, the expensive cost for their initial authentication may cause serious denial of service (DoS) attacks, which furthermore enables to do great harm to real space via VANET. Motivated by this, a puzzle-based co-authentication (PCA) scheme is proposed here. In the PCA scheme, the Hash puzzle is carefully designed to mitigate DoS attacks against the pseudonymous authentication process, which is facilitated through collaborative verification. The effectiveness and efficiency of the proposed scheme is approved by performance analysis based on theory and experimental results.

Global experimental verification of Docker-based secured mVoIP to protect against eavesdropping and DoS attacks

The cloud-computing paradigm has been driving the cloud-leveraged refactoring of existing information and communications technology services, including voice over IP (VoIP). In this paper, we design a prototype secure mobile VoIP (mVoIP) service with the open-source Asterisk private branch exchange (PBX) software, using Docker lightweight virtualization for mobile devices with the immutable concept of continuous integration and continuous deployment (CI/CD). In addition, the secure mVoIP service provides protection against eavesdropping and denial-of-service (DoS) attacks, using secure voice coding and real-time migration. We also experimentally verify the quality of the secure voice and the associated communication delay over a distributed global connectivity environment to protect against eavesdropping and real-time migration to mitigate DoS attacks.

A hybrid multiobjective RBF-PSO method for mitigating DoS attacks in Named Data Networking

Named Data Networking (NDN) is a promising network architecture being considered as a possible replacement for the current IP-based (host-centric) Internet infrastructure. NDN can overcome the fundamental limitations of the current Internet, in particular, Denial-of-Service (DoS) attacks. However, NDN can be subject to new type of DoS attacks namely Interest flooding attacks and content poisoning. These types of attacks exploit key architectural features of NDN. This paper presents a new intelligent hybrid algorithm for proactive detection of DoS attacks and adaptive mitigation reaction in NDN. In the detection phase, a combination of multiobjective evolutionary optimization algorithm with PSO in the context of the RBF neural network has been applied in order to improve the accuracy of DoS attack prediction. Performance of the proposed hybrid approach is also evaluated successfully by some benchmark problems. In the adaptive reaction phase, we introduced a framework for mitigating DoS attacks based on the misbehaving type of network nodes. The evaluation through simulations shows that the proposed intelligent hybrid algorithm (proactive detection and adaptive reaction) can quickly and effectively respond and mitigate DoS attacks in adverse conditions in terms of the applied performance criteria.

Uniform DoS traceback

Denial of service (DoS) is a significant security challenge in the Internet. Identifying the attackers so that their attack traffic can be blocked at source is one strategy that can be used to mitigate DoS attacks. However, determining the source can be difficult due to the inherent connectionless nature of IP. Traceback using various marking schemes that overload, mostly unused, fields in the IP header are promising techniques to identify the source of the attack. This paper shows that the marking probability used in two existing techniques: probabilistic packet marking (PPM) and dynamic probabilistic packet marking (DPPM) are not optimal and derives an optimal marking scheme called uniform probabilistic packet marking (UPPM). The performance of UPPM is shown to be improved compared to PPM and DPPM by performing comparative numerical analysis. One significant advantage of UPPM over these earlier techniques is that it performs marking at the level of autonomous systems (ASs) rather than at every router. This has advantages both in terms of marking overhead and allowing the optimal formulation of marking probability by utilizing metrics readily available from BGP-4, the inter-AS routing protocol.

Trusted Puzzle Solvers without Clock Support against Spam and Denial-of-Service Attacks

Spam and Denial-of-Service (DoS) attacks are growing threats on the Internet. Cryptographic puzzles can be used to address the problem effectively. Additionally, the Trusted Puzzle Solver (TPS), which is similar to the Trusted Platform Module (TPM), is also proposed to help constructing crypto puzzles that may have some outstanding specialties in security and efficiency. Based on the analysis and discussion of two existing crypto puzzles relying on the TPS with a trusted clock, two new improved crypto puzzles are presented, and all the drawbacks found in the old ones are eliminated. The TPS in the new crypto puzzles doesn't have to be equipped with a clock thus can be realized by the TPM without modification. Also, prototype experiments show that the new crypto puzzles can do better in mitigating DoS attacks.

Modular square root puzzles: Design of non-parallelizable and non-interactive client puzzles

Denial of Service (DoS) attacks aiming to exhaust the resources of a server by overwhelming it with bogus requests have become a serious threat. Especially protocols that rely on public key cryptography and perform expensive authentication handshakes may be an easy target. A well-known countermeasure against resource depletion attacks are client puzzles. The victimized server demands from the clients to commit computing resources before it processes their requests. To get service, a client must solve a cryptographic puzzle and submit the right solution. Existing client puzzle schemes have some drawbacks. They are either parallelizable, coarse-grained or can be used only interactively. In case of interactive client puzzles where the server poses the challenge an attacker might mount a counterattack on the clients by injecting faked packets with bogus puzzle parameters bearing the server's sender address. In this paper we introduce a novel scheme for client puzzles which relies on the computation of square roots modulo a prime. Modular square root puzzles are non-parallelizable, i.e., the solution cannot be obtained faster than scheduled by distributing the puzzle to multiple machines or CPU cores, and they can be employed both interactively and non-interactively. Our puzzles provide polynomial granularity and compact solution and verification functions. Benchmark results demonstrate the feasibility of our approach to mitigate DoS attacks on hosts in 1 or even 10 Gbit networks. In addition, we show how to raise the efficiency of our puzzle scheme by introducing a bandwidth-based cost factor for the client. Furthermore, we also investigate the construction of client puzzles from modular cube roots.

Keeping Denial-of-Service Attackers in the Dark

We consider the problem of overcoming (distributed) denial-of-service (DoS) attacks by realistic adversaries that have knowledge of their attack's successfulness, for example, by observing service performance degradation or by eavesdropping on messages or parts thereof. A solution for this problem in a high-speed network environment necessitates lightweight mechanisms for differentiating between valid traffic and the attacker's packets. The main challenge in presenting such a solution is to exploit existing packet-filtering mechanisms in a way that allows fast processing of packets but is complex enough so that the attacker cannot efficiently craft packets that pass the filters. We show a protocol that mitigates DoS attacks by adversaries that can eavesdrop and (with some delay) adapt their attacks accordingly. The protocol uses only available efficient packet-filtering mechanisms based mainly on addresses and port numbers. Our protocol avoids the use of fixed ports and instead performs pseudorandom port hopping. We model the underlying packet-filtering services and define measures for the capabilities of the adversary and for the success rate of the protocol. Using these, we provide a novel rigorous analysis of the impact of DoS on an end-to-end protocol and show that our protocol provides effective DoS prevention for realistic attack and deployment scenarios.

Mitigating denial of service attacks

This tutorial describes what Denial of Service (DOS) attacks are. how they can be carried out in IP networks, and how one can defend against them. Distributed DoS (DDoS) attacks are included here a...