SYN Flood Attack Research Articles

Prevention of a SYNflood attack using ExtremeXOS modular operating system

Network security has become a critical concern for protecting systems from attackers. Even though by securing these systems, a skilled attacker may use some techniques to launch a sophisticated attack. SYNflood attack is the commonly evolving attack which is a form of denial-of-service (DoS) attack, where an attacker sends SYNflood in a form of request to the target's system in a successive manner causing the system unresponsive to the legitimate request. Thereby, this attack causes bandwidth congestion by reducing the processing capability of network systems and servers. In this paper, we proposed a scheme for preventing SYNflood based on statistical parameters of incoming traffic using the hard threshold method which is implemented by using ExtremeXOS software. It is a software embedded with the switch for controlling network traffic statistical parameters.

Rule Generation for TCP SYN Flood attack in SIEM Environment

Security Information and Event Management (SIEM) is a combination of Security Information Management and Security Event Management. SIEM helps in the collection of events from heterogeneous devices and ordering into Common Event Format. The events collected are correlated and observed for changes in the system behaviour. Homogeneous Events such as DoS/Probe attacks can be detected by monitoring single event source. In this paper, TCP SYN flood attack is considered. RETE algorithm is applied on the network event attributes to formulate the rules and stored in database. An alert is triggered, when the rule for TCP SYN attack is matched.

Prevention of a SYNflood attack using ExtremeXOS modular operating system

Prevention of a SYNflood attack using ExtremeXOS modular operating system

Efficient Data Transfer Rate and Speed of Secured Ethernet Interface System

Embedded systems are extensively used in home automation systems, small office systems, vehicle communication systems, and health service systems. The services provided by these systems are available on the Internet and these services need to be protected. Security features like IP filtering, UDP protection, or TCP protection need to be implemented depending on the specific application used by the device. Every device on the Internet must have network interface. This paper proposes the design of the embedded Secured Ethernet Interface System to protect the service available on the Internet against the SYN flood attack. In this experimental study, Secured Ethernet Interface System is customized to protect the web service against the SYN flood attack. Secured Ethernet Interface System is implemented on ALTERA Stratix IV FPGA as a system on chip and uses the modified SYN flood attack protection method. The experimental results using Secured Ethernet Interface System indicate increase in number of genuine clients getting service from the server, considerable improvement in the data transfer rate, and better response time during the SYN flood attack.

Robust dynamic network traffic partitioning against malicious attacks

The continual growth of network traffic rates leads to heavy packet processing overheads, and a typical solution is to partition traffic into multiple network processors for parallel processing especially in emerging software-defined networks. This paper is thus motivated to propose a robust dynamic network traffic partitioning scheme to defend against malicious attacks. After introducing the conceptual framework of dynamic network traffic partitioning based on flow tables, we strengthen its TCP connection management by building a half-open connection separation mechanism to isolate false connections in the initial connection table (ICT). Then, the lookup performance of the ICT table is reinforced by applying counting bloom filters to cope with malicious behaviors such as SYN flooding attacks. Finally, we evaluate the performance of our proposed traffic partitioning scheme with real network traffic traces and simulated malicious traffic by experiments. Experimental results indicate that our proposed scheme outperforms the conventional ones in terms of packet distribution performance especially robustness against malicious attacks.

Impact of DoS Attack in Software Defined Network for Virtual Network

A virtual network is a computer network which does not contain any physical link between two computational nodes instead they connect through the virtual links. In recent years the virtual network is managed by Software Defined Network (SDN). SDN is one of the most emerging network technologies in the current trends. Most of the companies configure their networks in SDN. It has been found important to understand the security issues that are being raised in any large scale developments from any new technologies that have been raised in recent years. Though the system acquires lot of benefits from SDN the system have to do some little work in security phase. This work confers four kinds of Denial-of-Service (DoS) attacks that are specific to networks in the OpenFlow SDN in different layers. Those attacks are Ping of Death, HTTP Unbearable Load King, SYN flood and Smurf attack. We introduced these attacks in SDN. These have been emulated on Mininet and an analysis is provided that was obtained on the consequence of these attacks. The DoS attack that is more severe than others has been found out and a suitable prevention techniques for that DoS attack is suggested.

CPU Load Analysis & Minimization for TCP SYN Flood Detection

Denials of service attacks are well-known as one of the major threats in today's Internet services. Majority VOIP services, DNS servers, online gaming and e-commerce applications are suffering and targeted by hackers using the execution of denial of service attack. Web application attacks and denial of service attacks in distributed architecture is significantly increases day by day. The denial of service attack hampers the load on CPU of web servers during the attack. Therefore, there is a need to minimize the load of CPU after effective attack detection.This paper proposes and implemented denial of service detection framework which consists of packet sniffer, feature extraction, attack detection and output module. The proposed framework detects denial of service attack such as TCP SYN Flood based on threshold and misuse detection. The system is analyzed with the help of CPU load and the load of CPU is minimized after TCP SYN flood attack detection.

Detection of SYN Flooding Attack in Mobile Ad hoc Networks with AODV Protocol

Mobile ad hoc networks (MANETs) play a vital role in ubiquitous computing. Multimedia communication is the main aspect of MANETs in emergency networks. Security is the major concern in such networks. MANETs are prone to many security problems because of their dynamic changing nature. One of the main attacks that affect any communication in a MANET is the denial-of-service attack. In this paper, such an attack called SYN flooding attack and its detection method are discussed. The presence of the SYN flooding attack in networks may not be identified correctly at an early stage. This leads to the denial of legitimate services at the multimedia server. An algorithm is presented in this paper to detect the presence of the SYN flooding attack at an early stage. The malicious node, instead of launching the SYN flooding attack, may try to delay the communication. This algorithm also finds such malicious nodes which try to affect the multimedia communication in MANETs by introducing unnecessary delays. The solution method involves game theory to form a game between the malicious node and the multimedia server node. The performance of the detection algorithm is verified by analyzing the various quality of service parameters relevant to multimedia communication.

OPERETTA: An OPEnflow-based REmedy to mitigate TCP SYNFLOOD Attacks against web servers

TCP SYNFLOOD attacks are a type of Distributed Denial of Service (DDoS) attacks usually carried out against web servers. TCP SYNFLOOD rely on the normal TCP Three-Way Handshake mechanism to consume resources on the targeted server. In this way server resources are blocked and the server is made unresponsive. To this purpose, the attacker sends multiple fake SYN packets as if it wants to set several TCP connections up, but then it does not finalize the Three-Way Handshake. In this way, it blocks the resources of the attacked server, uselessly. In traditional networks, these attacks have been counteracted by means of firewalls and intrusion detection schemes. However, these solutions are not effective since can be violated. Software Defined Networks (SDNs) offer new features like network programmability which make solutions to TCP SYNFLOOD attacks more effective. In fact, in SDN networks intelligence for counteracting security menaces can be moved to a single network element, i.e., the Controller, which has complete information about the network and is in the best condition to identify ongoing attacks. However, in this way TCP SYNFLOOD attacks can turn into attacks to the Controller, which becomes a unique point of failure for the network. In this paper we propose OPERETTA, an OPEnflow-based Remedy to TCP SYNFLOOD Attacks. OPERETTA is implemented in the Controller which manages incoming TCP SYN packets and rejects fake connection requests. The OPERETTA protocol works in heterogeneous networks, as it can be implemented not only on a centralized Controller, but also on delocalized Controllers available in the access routers at the users’ premises. OPERETTA has been tested using MININET and to this purpose prototypes of the relevant Control Plane functions have been implemented starting from the POX Controller. Numerical results show that OPERETTA achieves good performance in terms of resilience to TCP SYNFLOOD attacks and low level of CPU and memory consumption.

Using Data Mining Techniques in Building Dataset for Network Intrusion Detection

In this paper we will implement a software component for filtering rough network traffic to extract TCP traffic, and process it into structured connection records using data mining techniques to build a training data set; consisting of multi features items and usable in detecting some types of DOS (Denial of service) attacks like SynFlood attack; when the destination is flooded by connection requests via spoofed IP addresses within a small time window. This data set would be formatted with ARFF format and used in evaluating some classification algorithms implemented in WEKA machine learning framework to extract the best detection model for the purpose of improving the efficiency of network intrusion detection within audit trails.

Design of System on Chip for Generating SYN Flood Attack to Test the Performance of the Security System

DDoS attack is generated by the attacker on the server, so that the genuine clients will not have access to the services provided by server. To protect servers from such attacks, large variety of security systems are available. The best security system can be selected by comparing the performance of these systems. There is a need to generate attacks at very high speed to test the performance of security system. This manuscript presents the design of FPGA based reconfigurable hardware System-on-Chip (SoC), that can generate the SYN flood attacks at high speed in real time. The SoC SYN flood attack is implemented using the soft core NIOS II processor, Triple_Speed Ethernet, etc. The manuscript also compares the attacks generated using such hardware based SoC SYN flood attacker with the SYN flood attacks generated using purely software based tool hping3. It is found that the attacks generated using FPGA based system is much faster than software based tool. The same hardware design can be used to generate many different types of attacks such as spoofed, non-spoofed, layer 3 , layer 4 attacks like TCP flood attack, UDP attack, ICMP flood attack, TCP SYN-ACK attack, TCP FIN-ACK attack, etc. Such attacks are essential to benchmark the security systems. The proposed technique can be used as industry standard to benchmark the performance of the security systems. General Terms Security, syn flood attack, fpga.

SDN 환경에서의 목적지 주소별 패킷 샘플링을 이용한 SYN Flooding 공격 방어기법

SDN(Software Defined Networking) has been considered as a new future computer network architecture and DDoS(Distributed Denial of Service) is the biggest threat in the network security. In SDN architecture, we present the technique to defend the DDoS SYN Flooding attack that is one of the DDoS attack method. First, we monitor the Backlog queue in order to reduce the unnecessary monitoring resources. If the Backlog queue of the certain server is occupied over 70%, the sFlow performs packet sampling with the server address as the destination address. To distinguish between the attacker and the normal user, we use the source address. We decide the SYN packet threshold using the remaining Backlog queue that possible to allow the number of connections. If certain sources address send the SYN packet over the threshold, we judge that this address is attacker. The controller will modify the flow table entry to block attack traffics. By using this method, we reduce the resource consumption about the unnecessary monitoring and the protection range is expanded to all switches. The result achieved from our experiment show that we can prevent the SYN Flooding attack before the Backlog queue is fully occupied.

Detection of DDoS attacks in Windows Communication Foundation Services

Internet provides many critical services so it has become very important to monitor the network traffic so that the resources of the network can be prevented from being depleted from malicious hackers. In this paper, we have presented a mechanism to detect and defense a web-server against a Distributed Denial of Service (DDoS) attack. We have presented simulation of specific kind of DDoS attack i.e. identity spoofing and SYN flood attack on an application similar to shopping portal and its results to demonstrate the effectiveness of the mechanism. Then, the attack is monitored in resource monitor of the server side monitor showing CPU utilization.Also,some defense mechanisms to defend the server against such attacks has been presented.

Defense against SYN-flooding Attacks by using Game Theory

Connection Management phase of TCP is susceptible to a classic attack that is called SYN-flooding. In this attack, source sends many SYN packets to the victim computer, but does not complete three-way handshaking algorithms. This quickly consumes the resources allocated for communication in the under attack system and hence prevents it from serving other connection requests. This attack causes the victim host to populate its backlog queue with forged TCP connections. In other words it increases the number of legal connections rejected due to limited buffer space. In this paper, the under attack system are modeled by using queuing theory and then a game theoretic approach is employed to defend against SYNflooding attacks. The simulation results show that the proposed defense mechanism improves performance of the under attack system in terms of the ration of blocked connections and the buffer space occupied by attack requests.

MODIFICATION OF TCP SYN FLOOD (DOS) ATTACK DETECTION ALGORITHM

MODIFICATION OF TCP SYN FLOOD (DOS) ATTACK DETECTION ALGORITHM

The Attack Principle and Defense Strategy of SYN Flood under Windows

SYN Flood is a typical distributed denial of service attack technology. SYN Flood, which is one of the most popular attack method of DDos, destroys the network by the Loophole occurred when three-way handshake of TCP protocol happens. It describes the principle of SYN Flood attack in the paper, explores defense strategy and implementation method under Windows. These defensive measures can resist the SYN Flood attack rather well, It has good practicability and reference value.

Utilizing OpenFlow and sFlow to Detect and Mitigate SYN Flooding Attack

Software Defined Network (SDN) is a new technology in computer network area which enables user to centralize control plane. The security issue is important in computer network to protect system from attackers. SYN flooding attack is one of Distributed Denial of Service attack methods which are popular to degrade availability of targeted service on Internet. There are many methods to protect system from attackers, i.e. firewall and IDS. Even though firewall is designed to protect network system, but it cannot mitigate DDoS attack well because it is not designed to do so. To improve performance of DDOS mitigation we utilize another mechanism by using SDN technology such as OpenFlow and sFlow. The methodology of sFlow to detect attacker is by capturing and sum cumulative traffic from each agent to send to sFlow collector to analyze. When sFlow collector detect some traffics as attacker, OpenFlow controller will modify the rule in OpenFlow table to mitigate attacks by blocking attack traffic. Hence, by combining sum cumulative traffic use sFlow and blocking traffic use OpenFlow we can detect and mitigate SYN flooding attack quickly and cheaply.

A Comparative Study of Defense Mechanisms against SYN Flooding Attack

Distributed Denial-of-Service (DDoS) flooding attacks are a serious threat to the security of the internet. A DDoS attack makes a machine or network resources not usable by the legitimate clients. A SYN flood is a form of denial-of-service attack. An attacker sends SYN requests continuously to a target system to consume enough server resources and to make the system unable to respond to legitimate traffic. It is a threat to the network as the flooding of packets may delay other legitimate users from accessing the server and in severe cases may result the server to be shut down, wasting valuable resources. The objective of this paper is to review the detection mechanisms for SYN flooding. The advantages and disadvantages for some detection schemes are examined and their performance is compared.

Defense against SYN flooding attacks: A particle swarm optimization approach

SYN flooding attack is a threat that has been designed based on vulnerabilities of the connection establishment phase of the TCP protocol. In this attack some sources send a large number of TCP SYN segments, without completing the third handshake step to quickly exhaust connection resources of the victim server. Hence, a main part of the server’s buffer space is allocated to the attack half open connections and incoming new connection requests will be blocked. This paper proposes a novel framework, in which, the defense issue is formulated as an optimization problem. Then it employs the particle swarm optimization (PSO) algorithm to solve this optimization problem. Our theoretical analysis and packet-level simulations in ns-2 environment show that the proposed defense strategy called PSO_SYN decreases the number of blocked TCP connection requests and cuts down share of attack connections from the buffer space.

Detecting an Anomalous Traffic Attack Area based on Entropy Distribution and Mahalanobis Distance

This paper deals with detecting an anomalous traffic area based on its distribution and distance measurements. On detecting anomalous traffic such as flooding attack traffic we should consider the packet attribute of the traffic. In order to identify that traffic, we compute entropy of selected packet attribute and Mahalanobis distance between normal and abnormal traffics. Chi-square test is used to evaluate the proposed method. Detection accuracy and performance are analyzed using real network traffic trace which consists the mostly backscatter of SYN flooding attack from LANDER project. The result of our proposed method indicates that it can show and offer significantly an accurate result.