TCP Handshake Research Articles

Countering DDoS threats: leveraging ensemble methods for detection and mitigation

Cloud computing is the modern concept of distributing numerous services through the Internet, such as web applications, databases, and programmers that operate on several servers. As Cloud computing technologies evolve, increasing susceptibility to attack may result from service outages during data storage and transmission. The most common sort of assault against Cloud settings is distributed denial-of-service (DDoS). Several approaches for detecting and mitigating these attacks have been offered, however they are ineffective. In this research, we propose a method for detecting and mitigating DDoS attacks in their early phases, considering top-layer advances at the application layer and the TCP handshake mechanism. This study employs a variety of ensemble-based machine learning approaches to classify incoming data as legitimate or malicious to respond to DDoS attacks at the application layer. Furthermore, the double TCP connection concept is used to prevent DDoS. Experiments show that the stacked voting system detects DDOS attacks with the best F-score of 99.9%.

A Novel Authentication and Communication Protocol for Urban Traffic Monitoring in VANETs Based on Cluster Management

City zones have become increasingly overcrowded due to the extensive population widening ratio and the swift relocation of people from villages. The traffic monitoring process is a significant issue in these areas due to the massive traffic flow on the roads. This research proposed a cluster-based improved authentication and communication protocol for an Intelligent Transportation System in Vehicular AdHoc Networks (VANETs). Our primary objective is to optimize resource sharing in vehicular communication. We enhanced the reliability, scalability, and stability of fast-moving VANETs by introducing cluster-based routing protocols for Vehicle-to-Vehicle (V2V) and Vehicle-to-Infrastructure (V2I) communications. We used a third-party certification authority for vehicle authentication to address security and privacy concerns. Our proposed protocol support minimizes the end-to-end (E2E) delay and route request and reduces link failure. Our protocol’s leading yield includes throughput enhancement, TCP Socket Initialization time minimization, TCP handshake response speedup, and DNS lookup improvement. The protocols are centered on short-range peer-to-peer (P2P) wireless communication in a 400 m radius cluster. They include innovative P2P wireless communications on VANET using minimized resources. The proposed protocols deliver a secure authentication mechanism with a securely generated vehicle authentication key provided by a certification authority. Furthermore, we have developed RESTful APIs in vehicular communication for implementation purposes and also offered and implemented algorithms for resource sharing regarding V2V and V2I communication. Ultimately, we evaluated the performance of our experiments.

Detectable, Traceable, and Manageable Blockchain Technologies BHE: An Attack Scheme against Bitcoin P2P Network

As the most successful cryptocurrency, bitcoin has become the primary target of attackers. The security risks existing in bitcoin network (P2P networks) may pose serious threats to itself. It has been proved that network attackers of the autonomous system level could isolate a specific set of bitcoin nodes using prefix hijacking attacks; since this attack achieves bitcoin partition by deleting all data packets of the victim node, it is easy to be discovered by the victim node, and cannot maintain a long-term connection (the partition will disappear after canceling the BGP hijacking) (Apostolaki M et al. (2017)). This paper proposes a new attack scheme—eclipse attack method based on BGP hijacking (BHE). The attack can occupy the network connection of the victim node, and only need to delete part of the TCP handshaking packets of the victim node during the attack, and it makes the attack more hidden and can occupy the network connection of the victim node for a long time. The innovation of the BHE attack is that it can control the peering decision of the victim node by controlling the victim node’s internal peer database (new table and tried table) and preventing the victim node from establishing a good connection. It enables the attacker to occupy all network connections of the victim node and become its natural network middleman. We verify the feasibility of the BHE attack through experimental evaluation and demonstrate that an attacker who can launch BGP hijacking may occupy all connections of the victim node within 20 minutes (ignoring the time of traffic diversion). To reduce the attack’s impact, the paper provides some countermeasures that can use in practice according to the basic characteristics of the attack.

Implementation and Evaluation of HTTP/3 Connectivity Check Using Happy Eyeballs Algorithm

The HTTP Alternative Services (Alt-Svc) method is defined as an application to check connectivity in HTTP/3. This method is designed based on the fact that communication with old HTTP is guaranteed and the HTTP/3 adoption rate is not necessarily dominant, and it is considered effective in the early stages of transition. However, once HTTP/3 has reached its peak and the transitional period has passed, the uncertainty and redundancy of the Alt-Svc procedure become detrimental. In Alt-Svc, the procedure involves first completing the old HTTP connection to use HTTP/3, and then migrating to HTTP/3 if possible; however, because HTTP/3 is a protocol that eliminates the waste of the old HTTP handshake (TCP handshake followed by TLS handshake), HTTP/3 does not fully benefit from the rapid connection establishment of HTTP/3. Therefore, we propose a method to apply the Happy Eyeballs algorithm, which is used for IPv4 and IPv6 connectivity checks, to the old HTTP and HTTP/3 connectivity checks. The Happy Eyeballs algorithm performs the two selections in parallel to eliminate the delay that occurs in sequential processing, but the proposed method differs from the conventional Happy Eyeballs algorithm in that, even if the old HTTP is adopted once, it switches to the HTTP/3 connection if it is possible to connect using HTTP/3. The proposed method differs from the conventional Happy Eyeballs algorithm by introducing a mechanism to switch to HTTP/3 connections when HTTP/3 connections are available, even when the old HTTP is adopted. Results of the evaluation experiments demonstrated that the adoption rate of HTTP/3 increases in environments with high communication latency because the old HTTP performs the TLS handshake after the TCP handshake, but with this improvement, HTTP/3 is preferentially selected even in low latency environments when it is selectable.

SDNShield: NFV-Based Defense Framework Against DDoS Attacks on SDN Control Plane

Software-defined networking (SDN) is increasingly popular in today’s information technology industry, but existing SDN control plane is insufficiently scalable to support on-demand, high-frequency flow requests. Weaknesses along SDN control paths can be exploited by malicious third parties to launch distributed denial-of-service (DDoS) attacks against the SDN control plane. Recently proposed solutions only partially solve the problem, by protecting either the SDN network edges or the centralized controller. We propose SDNShield, a solution based on emerging network function virtualization (NFV) technologies, which enforces more comprehensive defense against potential DDoS attacks on SDN control plane. SDNShield incorporates a three-stage overload control scheme. The first stage statistically identifies legitimate flows with low complexity and performance overhead. The second stage further performs in-depth TCP handshake verification to ensure good flows are eventually served. The third stage intellectually salvages the misclassified legitimate flows that are falsely dropped from the first two stages. Prototype tests and real data-driven simulation results show that SDNShield can achieve high resilience against brute-force attacks, and maintain good flow-level service quality at the same time.

Achieving fast page load for websites across multiple domains

AbstractThe dependencies between the resources on web page slow down the page load process, resulting in degradation of user experience and provider revenue. Recent solutions reprioritize requests at client side to fetch resources according to the page's dependency structure. However, since resources on modern web pages are often served by the direct‐connect and multiple third‐party domains, optimizing web performance only at the client side is not able to minimize the long waiting time for the resources across multiple domains. To address this inefficiency problem, we present fast page load (FPL), a scheme of restructuring the interaction between multiple domains to accelerate web page loads. The key of our solution is that the credible servers in third‐party domains proactively push resources to client with the aid of server in the direct‐connect domain. Therefore, FPL eliminates the waiting time of resource requesting and TCP handshaking between the client and servers in third‐party domains. Furthermore, we propose FPL+ to schedule resources based on the dependency and size of objects to improve user perception and experience in terms of time‐to‐first‐paint. Experiment results show that our approach FPL and FPL+ effectively reduces the median page load time by up to 44% across popular websites.

Enhanced Performance and Privacy for TLS over TCP Fast Open

Abstract Small TCP flows make up the majority of web flows. For them, the TCP three-way handshake induces significant delay overhead. The TCP Fast Open (TFO) protocol can significantly decrease this delay via zero round-trip time (0-RTT) handshakes for all TCP handshakes that follow a full initial handshake to the same host. However, this comes at the cost of privacy limitations and also has some performance limitations. In this paper, we investigate the TFP deployment on popular websites and browsers. We found that a client revisiting a web site for the first time fails to use an abbreviated TFO handshake in 40% of all cases due to web server load-balancing using multiple IP addresses. Our analysis further reveals significant privacy problems of the protocol design and implementation. Network-based attackers and online trackers can exploit TFO to track the online activities of users. As a countermeasure, we introduce a novel protocol called TCP Fast Open Privacy (FOP). TCP FOP prevents tracking by network attackers and impedes third-party tracking, while still allowing 0-RTT handshakes as in TFO. As a proof-of-concept, we have implemented the proposed protocol for the Linux kernel and a TLS library. Our measurements indicate that TCP FOP outperforms TLS over TFO when websites are served from multiple IP addresses.

BiRe: A client-side Bi-directional SYN Reflection mechanism against multi-model evil twin attacks

The evil twin attack (ETA) has been a persistent security threat for decades in wireless local area networks (WLANs). An ETA refers to a rogue access point (RAP) impersonating a legal access point (LAP) to allure wireless users’ connection. Such attacks give rise to serious privacy leakage and property damages, motivating intensive research on ETA detection in both academic and manufacturing communities. Among existing ETA detection methods, those deployed at client side are superior to the typical admin-side ones because of the particular requirements on dedicated equipments at admin side and the lack of real-time protection. Unfortunately, available client-side ETA detection mechanisms are simply targeted to specific evil twin model and fail to provide adequate detection rate. In this paper, we propose a multi-model ETA detection mechanism at client side, called BiRe. Inspired by the request-response reflection stated in TCP handshake process, BiRe employs a novel Bi-directional TCP SYN Reflection to determine the existence of an ETA and differentiate among various attack models. A pair of wireless adapters are employed to cooperatively initiate TCP handshakes and monitor the absence of the expected TCP SYN-ACK packets. The remarkable feature of BiRe is to make the number of such absences as a feasible indicator for the ETA model identification. The results from extensive real-world experiments demonstrate the distinguishing performance of BiRe, achieving as high as 100% detection rate in multi-model ETA scenarios. Moreover, a free lightweight Linux tool has been developed based on BiRe to automate client-side ETA detection.

Value-Dependent Session Design in a Dependently Typed Language

Session Types offer a typing discipline that allows protocol specifications to be used during type-checking, ensuring that implementations adhere to a given specification. When looking to realise global session types in a dependently typed language care must be taken that values introduced in the description are used by roles that know about the value. We present Sessions, a Resource Dependent EDSL for describing global session descriptions in the dependently typed language Idris. As we construct session descriptions the values parameterising the EDSLs' type keeps track of roles and messages they have encountered. We can use this knowledge to ensure that message values are only used by those who know the value. Sessions supports protocol descriptions that are computable, composable, higher-order, and value-dependent. We demonstrate Sessions expressiveness by describing the TCP Handshake, a multi-modal server providing echo and basic arithmetic operations, and a Higher-Order protocol that supports an authentication interaction step.

RepNet: Cutting Latency with Flow Replication in Data Center Networks

Data center networks need to provide low latency, especially at the tail, as demanded by many interactive applications. To improve tail latency, existing approaches require modifications to switch hardware and/or end-host operating systems, making them difficult to be deployed. We present the design, implementation, and evaluation of RepNet, an application layer transport that can be deployed today. RepNet exploits the fact that only a few paths among many are congested at any moment in the network, and applies simple flow replication to mice flows to opportunistically use the less congested path. RepNet has two designs for flow replication: (1) RepSYN, which only replicates SYN packets and uses the first connection that finishes TCP handshaking for data transmission, and (2) RepFlow which replicates the entire mice flow. We implement RepNet on node.js , one of the most commonly used platforms for networked interactive applications. node 's single threaded event-loop and non-blocking I/O make flow replication highly efficient. Performance evaluation on a real network testbed and in Mininet reveals that RepNet is able to reduce the tail latency of mice flows, as well as application completion times, by more than 50 percent.

A Hybrid Web Browser Architecture for Mobile Devices

Web browsing on mobile networks is slow in comparison to wired or Wi-Fi networks. Particularly, the connection establishment phase including DNS lookups and TCP handshakes takes a long ...

SYN flooding attack detection by TCP handshake anomalies

ABSTRACTWe present an original approach to identify synchronize (SYN) flooding attacks from the victim's side, on the basis of a classification of the different forms that TCP handshakes can take during a connection set‐up between a client and a server (e.g. for Web traffic). We first identify the unusual handshake sequences that result from an attack and show how such observations can be used for SYN flooding attack detection. We then introduce a data structure to monitor, in real time, the state of the TCP handshake and study its performance. In addition, we explain the management of the data structure for operations such as initialization, adding and removing flows. Finally, we analyse the effectiveness of our TCP handshake monitoring to identify the presence of SYN flooding attacks by applying it to real traffic traces. To allow quick protection and help guarantee a proper defence, the detection is done in real time. Our detection system uses a non‐parametric cumulative sum algorithm (CUSUM), which has the benefit of not requiring a detailed model of the normal and attack traffic while achieving excellent detection levels. Copyright © 2011 John Wiley & Sons, Ltd.

Throttling spoofed SYN flooding traffic at the source

TCP-based flooding attacks are a common form of Distributed Denial-of-Service (DDoS) attacks which abuse network resources and can bring about serious threats to the Internet. Incorporating IP spoofing makes it even more difficult to defend against such attacks. Among different IP spoofing techniques, which include random spoofing, subnet spoofing and fixed spoofing, subnet spoofing is the most difficult type to fight against. In this paper, we propose a simple and efficient method to detect and defend against TCP SYN flooding attacks under different IP spoofing types, including subnet spoofing. The method makes use of a storage-efficient data structure and a change-point detection method to distinguish complete three-way TCP handshakes from incomplete ones. This lightweight approach makes it relatively easy to deploy the scheme as its resource requirement is reasonably low. Simulation experiments consistently show that our method is both efficient and effective in defending against TCP-based flooding attacks under different IP spoofing types. Specifically, our method outperforms others in achieving a higher detection rate yet with lower storage and computation costs.