TCP SYN Research Articles

ProDetect: A Proactive Detection Approach of the TCP SYN Flooding Attack in the SDN Controller

The TCP SYN flooding attack or assault is one of the most prominent methods for the controller layer and the target server exhaustion in software-defined networking (SDN). The switches in the data layer or plane are forced to transfer an enormous amount of illicit SYN requests that the adversary creates to the controller because there are no forwarding rules. This extensive forwarding strains the computing capacity of both the data layer and the control layer and clogs the transmission route connecting them. We suggest a dynamic threshold-based countermeasure in this research, named ProDetect, to proactively cater to the SYN flooding attack in the SDN environment. We have fully implemented ProDetect as a security extension on the SDN controller for verifying inbound TCP connections. For SYN requests those that pass through ProDetect's validation test, the controller installs data forwarding policies for them and other malicious hosts sending forged requests are blocked. Therefore, these hosts are barred from sending any new TCP requests to the switches present inside the data layer. We have also employed a strategy to cope with forged MAC addresses in this work. When compared with the existing approaches, the evaluation of performance conducted by the simulation data reveals that ProDetect demonstrates low side effects for legitimate TCP requests and increases the total response time through an onset of SYN flooding operation.

SDN Network DDOS Detection Using ML

This paper describes a technique that uses the Ryu Controller and Mininet to identify and mitigate Distributed Denial of Service (DDoS) threats in Software Defined Networks (SDN). Using Mininet, the suggested method entails building a virtual network topology with connected switches and hosts. The Ryu Controller gathers traffic data while Mininet simulates several DDoS attack types, such as ICMP flood, land assault, TCP SYN flood, and UDP attacks. The Ryu Controller collects both benign and DDoS traffic into a dataset that is used to build a machine learning (ML) model that can detect DDoS attacks in real time.

SYNTROPY: TCP SYN DDoS attack detection for Software Defined Network based on Rényi entropy

The rapidly evolving landscape of network security, particularly in Software Defined Networks (SDNs), presents a critical need for efficient and adaptive DDoS attack detection methods, especially in the face of TCP SYN DDoS attacks. These attacks pose significant threats to network resources and service availability. Current state-of-the-art solutions, predominantly based on Shannon entropy, have inherent limitations, that give equal weightage to all frequency probability. This inherent assumption often leads to inadequate detection in complex and dynamic network environments, where attack patterns are increasingly sophisticated and variable. In this paper, we present a novel framework called SYNTROPY that is designed to detect TCP SYN DDoS attacks in SDN environments. The proposed SYNTROPY framework leverages Rényi entropy to effectively generalize the measurement of uncertainty in the network traffic. Unlike Shannon entropy, Rényi entropy offers the flexibility to adjust sensitivity to varying network conditions and attack patterns, thereby enhancing detection accuracy. It filters benign, flash, and suspicious traffic and employs a min–max threshold to identify attack patterns accurately. Our framework is implemented using the Ryu Controller, thus enabling seamless integration with SDN systems. The experiment is conducted to evaluate the SYNTROPY performance using the CAIDA UCSD DDoS 2007 Attack Dataset. The comparative analysis demonstrates that SYNTROPY performs better across various metrics than state-of-the-art solutions. It includes a 40% reduction in average CPU load, 59% enhancement in average detection time, 13% increase in true positives rate, 34% decrease in false negatives rate, 10% recall improvement, and 8% higher F1-Score. These promising results showcase the potential of SYNTROPY as a robust and effective solution for addressing TCP SYN DDoS attacks in SDNs.

SPARQ: SYN Protection using Acyclic Redundancy check and Quartile range on P4 switches

Software-defined networking (SDN), enabled by high-performance programmable switches, offers a new avenue to counter cyber attacks. Programmable switches offer the ability to customize and conduct in-depth packet analysis, thus providing efficient and timely responses to DDoS attacks. However, implementing sophisticated DDoS detection may be a challenge in programmable switches because the p4 language does not support floating-point arithmetic, logarithmic functions, or loops. Furthermore, the limited SRAM and TCAM memory on programmable switches makes storing the network connection state difficult. Hence, effective deployment of DDoS detection techniques remains challenging due to these limitations and the rising complexity of the attacks. Many researchers proposed the DDoS detection solution directly on a programmable switch, ignoring the pressing need for a distributed solution. Therefore, this paper presents an innovative, decentralized traffic analysis framework called SPARQ that optimally utilizes the data and control planes. SPARQ is based on Rényi entropy that filters TCP SYN DDoS attacks. It leverages the programming ability of data planes for traffic classification and utilizes the control plane to calculate the metrics and acyclic redundancy checks within the traffic. Moreover, SPARQ uses quartile ranges to track packet inter-arrival time so that abnormal traffic patterns can be identified. We implement SPARQ in a BMv2 switch using the p4runtime controller, enabling seamless integration with SDN systems. We compare the performance of SPARQ with state-of-the-art solutions using the CAIDA dataset. The comparative analysis demonstrates that SPARQ provides a 20.59% reduction in CPU load, an average detection time shorter than 88%, and a 17.8% improvement in true positive rate (TPR).

Retracted: Lightweight Statistical Approach towards TCP SYN Flood DDoS Attack Detection and Mitigation in SDN Environment

Retracted: Lightweight Statistical Approach towards TCP SYN Flood DDoS Attack Detection and Mitigation in SDN Environment

How Polynomial Regression Improves DeNATing

The ubiquity of Network Address Translation (NAT) and mobile hotspots that aggregate source IP addresses of connected devices to a single IP address makes it difficult for an observer in the Internet to learn anything about the internal network. The IP Identification header field of Domain Name System requests and the TCP Timestamp (TCP TS) header field of TCP SYN packets are the main features for counting devices in the internal network and association of packets to these devices, also known as DeNATing. This paper introduces a new method that relies on polynomial least-squares curve fitting for DeNATing. Evaluation of our model is performed on multiple real-world datasets containing Windows and Unix devices behind a router using NAT and a mobile hotspot. The proposed method outperforms other state-of-the-art methods for all of the used datasets on all types of devices. Successful DeNATing may help in cybersecurity, anti-fraud, and other use cases.

Detecting and Preventing of DDoS Attack in Cloud Computing Environment Based on Hybrid Technique (Cloudflare and WAF)

The adoption of cloud computing has revolutionized data storage and processing globally. Nevertheless, the need for a close watch on security is paramount. Hence, the aim of this paper, to develop a cloud security model that detects and prevents the risks of Distributed Denial of Service (DDoS) attacks in cloud computing systems which are gravely potent and, on the increase, today. This was done using two approaches: analyzing Transmission Control Protocol/Internet Protocol (TCP/IP) header features of incoming packets in cloud computing environment in order to detect and classify spoofed IP address during DDoS attack via a custom-made Web Application Firewall (WAF); and the integration of the cloud resources with Cloudflare. The result shows that a total of 1,625,192 packets were transmitted in a short period which were captured and analyzed via Wireshark. Several TCP errors were observed over a very short time interval which indicated successful DDoS attack effectively crashing the system. The result varied when the custom-made WAF was put in place, and the attacking lab machine launched a TCP syn flood attack against the web server on port http port 80. A total of 2,353,585 packets were transmitted in a short period which were captured and analyzed using Wireshark and contained less TCP errors indicating successful mitigation of DDoS attacks. When the resources were hosted online and integrated with Cloudflare, integrity checks were successful before the resources were loaded, indicating complete mitigation of attacks. Keywords: Bandwidth, Botnet, Cloudflare, Wireshark and Zombie

The evolution of Mirai botnet scans over a six-year period

The proliferation of Internet of Things devices has resulted in an increase in security vulnerabilities and network attacks. The Mirai botnet is a well-known example of a network used for malicious activities, detected for the first time by the white-hat research group in August 2016. Since then, Mirai initiated massive DDoS attacks by scanning for and exploiting vulnerabilities in network devices. In this paper, we investigate the evolution of the Mirai botnet over a six-year period, analyzing the TCP SYN packets using Mirai signature, i.e. with TCP sequence number equal to the destination IP address. Our analysis stands out as we extensively investigate the evolution of Mirai scans over a prolonged six-year period (2016–2022). Our findings reveal that the Mirai signature is still implemented by malicious actors today, in contrast with previous works. Moreover, we observe that the number of hijacked devices and TCP SYN packets involved in the scanning phase have increased over time. We also confirm that cybercriminals generally target Telnet port 23, followed by fewer requests on Telnet port 2323. Conversely, the number of probes on the SSH ports decreases over time, followed by a subsequent increase in 2022. Lastly, we identify several ports that had not been contacted until 2018 but have since received a large number of TCP SYN packets that verify the Mirai’s signature. These ports are linked with the emergence of new variants of the Mirai botnet.

Server load estimation by Burr distribution mixture analysis of TCP SYN response time

Server load estimation is key in balancing traffic between servers when optimizing data center resources. Intrusive methods are sometimes difficult or impossible to implement. Therefore, non-intrusive estimation methods are the best alternative in these cases. The objective of this paper is to present a server load estimation method based on external network traffic measurements obtained in a vantage point close to the server. Statistical distributions of TCP SYN response time, that is, the time from SYN to SYN+ACK segments at the server side, are used to fit Burr Type XII heavy tail distribution mixtures. The fitting algorithm, based on maximum likelihood estimation, is developed in detail in this paper. Experimental data shows that the median of the fitted distribution correlates within the 95% confidence interval of the server load figures and, thus, it can be used as a non-intrusive and accurate method to measure it. This new method can be applied to almost any existing load balancing algorithm, as it does not make any assumption about the server, which is considered a black box.

On the Protection of a High Performance Load Balancer Against SYN Attacks** This is an extended journal version of [2

SYN flooding is a simple and effective denial-of-service attack. In this attack, many TCP SYN requests are sent to the targeted server, in an attempt to consume its resources and make it unresponsive to legitimate traffic. While SYN attacks have traditionally targeted web servers, they are also known to be very harmful to intermediate cloud devices, and in particular to stateful load balancers (LBs). Fighting against a SYN attack without negatively affecting legitimate connections is not easy, especially if the LB needs to perform frequent server pool updates during the attack, which is very likely since attacks can often last for many hours or even days. This paper is the first to propose LB schemes that guarantee high throughput of one million connections per second, while supporting a high pool update rate without breaking connections and fighting against a high rate SYN attack. Using an analysis and a proof of concept, we show that the LB can handle up to 10 million fake SYNs per second when the RTT is 10ms, and up to 5 million fake SYNs per second when the RTT is 20ms.

Detection of DDOS Attack using Decision Tree Classifier in SDN Environment

Software Defined Networking (SDN) is a dynamic architecture that employs a variety of applications for making networks more adaptable and centrally controlled. It is easy to attack the entire network in SDN because the control plane and data plane are separated. DDoS attack is major danger to SDN service providers because it can shut down the entire network and stop services to all customers at any time. One of the key flaws of most SDN architectures is lack of susceptibility to DDoS attacks with its types like TCP flooding, UDP flooding, SYN flooding, ICMP flooding and DHCP flooding for detecting those kinds of attacks. The machine learning algorithms are widely used in recent years to identify DDoS attacks. This research utilizes Decision Tree Classifier for detection and classification of DDoS attacks on SDN. The Forward Feature Selection technique is also used in the research to select the best features from the dataset and from that dataset the data are employed to train and test the model by Decision Tree Classifier Algorithm. The decision Tree Classifier technique is a supervised method used to forecast desired values of observations using rudimentary machine learning decision rules derived from training data. Based on the accuracy of decision tree techniques, in future, a hybrid learning model will be designed for detecting the Distributed Denial of Services in an SDN environment with high accuracy and a low false negative rate.

Enhancement of the Detection of the TCP SYN Flooding (DDoS) Attack

The major of DDoS attacks use TCP protocol and the TCP SYN flooding attack is the most common one among them. The SYN Cookie mechanism is used to defend against the TCP SYN flooding attack. It is an effective defense, but it has a disadvantage of high calculations and it doesn’t differentiate spoofed packets from legitimate packets. Therefore, filtering the spoofed packet can effectively enhance the SYN Cookie activity. Hop Count Filtering (HCF) is another mechanism used at the server side to filter spoofed packets. This mechanism has a drawback of being not a perfect and final solution in defending against the TCP SYN flooding attack. An enhanced mechanism of Integrating and combining the SYN Cookie with Hop Count Filtering (HCF) mechanism is proposed to protect the server from TCP SYN flooding. The results show that the defense against SYN flood DDoS attack is enhanced, since the availability of legitimate packets is increased and the time of SYN Cookie activity is delayed.

Detection and Mitigation of SYN Flooding Attacks through SYN/ACK Packets and Black/White Lists.

Software-defined networking (SDN) is a new network architecture that provides programmable networks, more efficient network management, and centralized control than traditional networks. The TCP SYN flooding attack is one of the most aggressive network attacks that can seriously degrade network performance. This paper proposes detection and mitigation modules against SYN flooding attacks in SDN. We combine those modules, which have evolved from the cuckoo hashing method and innovative whitelist, to get better performance compared to current methods Our approach reduces the traffic through the switch and improves detection accuracy, also the required register size is reduced by half for the same accuracy.

Attack Detection and Prediction Using Machine Learning

Data plane and control plane are divided by Software Defined Networking (SDN). A centralized controller oversees and manages the entire network. With SDN, the network may be programmed and flow regulations can be created dynamically. Numerous benefits including adaptability, programmability, and centralized management are offered by this decoupling. However, SDN also creates new vulnerabilities as a result of desired data plane and control plane connectivity. Attacks on switch buffer overflows and control plane saturation are two examples of threats that exploit such flaws. The controller is vulnerable to Distributed Denial of Service (DDoS) attacks, which induce resource exhaustion and impair the controller's capacity to provide services. By flooding the control plane with TCP SYN packets from the data plane (i.e., switches), several attacks can be launched. SVM is the most popular and often used classifier, both for classification and regression, thanks to its high accuracy and low false positive rate. For DDoS detection, the SVM classifier is examined and contrasted with other classifiers. In order to identify anomalies, such as malicious traffic, and report them, Snort, an intrusion detection system, examines the traffic and packets. The entropy approach is used to assess the flow data's randomness. An IP address for the intended recipient and a few TCP flag attributes make up the entropy information. We implement it as an additional module in the Floodlight Controller and assess its viability and efficacy. We thoroughly evaluate how we have implemented things via Mininet, substantial emulation.

SAFE: EFFICIENT DDOS ATTACK DEFENSE WITH ELASTIC TRAFFIC FLOW INSPECTION IN SDN-BASED DATA CENTERS

In this paper, we propose an efficient distributed denial-of-Service (DDoS) Attack deFEnse solution, namely SAFE, which utilizes an elastic traffic flow inspection mechanism, for Software-Defined Networking (SDN) based data centers. In particular, we first examine a leaf-spine SDN-based data center network, which is highly vulnerable to volumetric DDoS attacks. Next, we develop a rank-based anomaly detection algorithm to recognize anomalies in the amount of incoming traffic. Then, for the traffic flow inspection, we introduce a component called DFI (Deep Flow Inspection) running an Open vSwitch (OvS) that can be dynamically initiated (as a virtual machine) on-demand to collect traffic flow statistics. By utilizing deep reinforcement learning-based traffic monitoring from our previous study, the DFIs can be protected from the flow-table overflow problem while providing more detailed traffic flow information. Afterward, a machine learning-based attack detector analyzes the gathered flow rule statistics to identify the attack, and appropriate policies are implemented if an attack is recognized. The experiment results show that the SAFE can effectively defend against volumetric DDoS attacks while assuring a reliable Quality-of-Service level for benign traffic flows in SDN-based data center networks. Specifically, for TCP SYN and UDP floods, the SAFE attack detection performance is improved by approximately 40% and 30%, respectively, compared to the existing SATA solution. Furthermore, the attack mitigation performance, the ratio of dropped malicious packets obtained by the SAFE is superior by approximately 48% (for TCP SYN flood) and 52% (for UDP flood) to the SATA.

Early detection and mitigation of TCP SYN flood attacks in SDN using chi-square test

Early detection and mitigation of TCP SYN flood attacks in SDN using chi-square test

Comparison of Feature Selection Methods for DDoS Attacks on Software Defined Networks using Filter-Based, Wrapper-Based and Embedded-Based

The development of internet technology is growing very rapidly. Moreover, keeping internet users protected from cyberattacks is part of the security challenges. Distributed Denial of Service (DDoS) is a real attack that continues to grow. DDoS attacks have become one of the most difficult attacks to detect and mitigate appropriately. Software Defined Network (SDN) architecture is a novel network management and a new concept of the infrastructure network. A controller is a single point of failure in SDN, which is the most dangerous of various attacks because the attacker can take control of the controller so that it can control all network traffic. Various detection and mitigation methods have been offered, but not many consider the capacity of the SDN controller. In this research, we propose a feature selection method for DDoS attacks. This research aims to select the most important features of DDoS attacks on SDN so that the detection of DDoS on SDN can be lightweight and early. This research uses a dataset [1] generated by a Mininet emulator. The simulation runs for benign TCP, UDP, and ICMP traffic and malicious traffic, which is the collection of TCP SYN attacks, UDP Flood attacks, and ICMP attacks. A total of 23 features are available in the dataset, some are extracted from the switches, and others are calculated. By using three methods, filter-based, wrapper-based, and embedded-based, we get consistent results where the pktcount feature is the highest feature importance of DDoS attacks on SDN.

ML‐IDSDN: Machine learning based intrusion detection system for software‐defined network

SummarySoftware‐defined networking (SDN) has been developed to separate network control plane from forwarding plane which can decrease operational costs and the time it takes to deploy new services compared to traditional networks. Despite these advantages, this technology brings threats and vulnerabilities. Consequently, developing high‐performance real‐time intrusion detection systems (IDSs) to classify malicious activities is a vital part of SDN architecture. This article introduces two created datasets generated from SDN using Mininet and Ryu controller with different feature extraction tools that contain normal traffic and different types of attacks (Fin flood, UDP flood, ICMP flood, OS probe scan, port probe scan, TCP bandwidth flood, and TCP syn flood) that is used for training a number of supervised binary classification machine learning algorithms such as k‐nearest neighbor, AdaBoost, decision tree (DT), random forest, naive Bayes, multilayer perceptron, support vector machine, and XGBoost. The DT algorithm has achieved high scores to fit a real‐time application achieving F1 score on attack class of 0.9995, F1 score on normal class of 0.9983, and throughput score of 6,737,147.275 samples per second with a total number of three features. In addition, using data preprocessing to reduce the model complexity, thereby increasing the overall throughput to fit a real‐time system.

The impact of DoS (Denial of Service) cyberattacks on a Local Area Network (LAN)

In this paper I will highlight a modus operandi of hackers launching Denial of Service (DoS) cyberattacks. I will theoretically show how CAM Overflow and TCP SYN Flood attacks can be performed, using Kali Linux, a Linux distribution used by cyber criminals to launch MitM (Man-in-the-Middle) attacks, DoS attacks, observing traffic in a computer network, etc. Hackers can affect the functioning of devices on an organization’s local network (server, router, switch, etc.) by sending thousands of packets per second to the target device. CAM Overflow is an attack where a hacker aims to overcrowd the CAM table of a switch with MAC addresses, and TCP SYN Flood is an attack that can be launched against a server in the computer network.

As 5G Mobile Private Security Analysis Based on Cloud Computing

As time passes by, the increasing demands from 4G technology services to 5G technology are getting bigger. In line with the development of 5G, there are several open sources such as Free5gc, Open5gs which already provide core 5G network services so that they can help create and simulate private 5G networks. By using free5gc open source, it still needs more attention from the security side, especially from common attacks such as DDoS. Then the attack scenario is carried out from the inner network side, namely from the UE with the TCP SYN Flood and Ping of Death attack methods. The results of the attack contained comparisons for CPU and memory usage parameters. Then the TCP SYN Flood attack had an impact on the core network function components, namely Access and Mobility Management (AMF), which in 5G services experienced errors or crashes after receiving large packets. Thus, users cannot use the service because if an error occurs in the core network function (AMF), then the connection to gNB and the UE will also be lost