TCP SYN Research Articles

DI-ADS: A Deep Intelligent Distributed Denial of Service Attack Detection Scheme for Fog-Based IoT Applications

Nowadays, fog computing plays a very vital role in providing many services to end-based IoT (Internet of Things) systems. The end IoT devices communicate with the middle layer fog nodes and to the above cloud layer to process the user tasks. However, this large data communication experiences many security challenges as IoT devices are being compromised and thus the fog nodes at the fog layer are more prone to a very critical attack known as Distributed Denial of Service (DDoS) attack. The attackers or the compromised IoT devices need to be detected well in the network. Deep Learning (DL) plays a prominent role in predicting the end-user behavior by extracting features and classifying the adversary in the network. But, due to IoT device’s constrained nature in computation and storage facilities, DL cannot be administered on those. In this paper, a deep intelligent DDoS attack detection scheme (DI-ADS) is proposed for fog-based IoT applications. The framework mainly uses a deep learning model (DLM) to detect DDoS attacks in the network. The DLM is installed on the computation module of the fog node that predicts the end IoT device behavior. For the selection of the best DLM model at the fog layer, the performance comparison is made on Deep Neural Multilayer Perceptron (DNMLP) and Long Short-Term Memory (LSTM) models along with the conventional machine learning (ML) models such as Support Vector Machine (SVM), K-Nearest Neighbours (KNN), Logistic Regression (LR), and Random Forest (RF). The simulation is performed using the Python Anaconda platform by considering a new DDoS-SDN (Mendeley Dataset) dataset that consists of three DDoS attacks such as TCP Syn, UDP Flood, and ICMP attacks. From the results, DNMLP showed the best accuracy of 99.44% as compared to other DL and ML models. By outperforming nature in the detection of DDoS attacks, DNMLP is considered in the proposed framework for being implemented at the fog layer.

A DDoS attack detection and countermeasure scheme based on DWT and auto-encoder neural network for SDN

Software Defined Networking provides new functionalities to easily manage, configure, and optimize network resources by introducing a clear separation between the control entity and the forwarding devices. Such functionalities also help network operators detect and mitigate the security attacks to the network and provide better security level when compared to the traditional networks. However, some security threats, particularly distributed denial of service (DDoS) attacks, keep their effectiveness in degrading the availability of the networks even if the networking paradigm have changed. Existing DDoS attack detection approaches for SDN are mainly based on statistical (threshold-based) and Machine Learning-based (ML) approaches. Considering the dynamic characteristics of the network traffic, finding a dynamic threshold is somehow problematic. On the other hand, finding an appropriate feature that can discriminate DDoS attack from normal traffic is challenging for ML-based approaches. Therefore, to address the aforementioned issues, in this work, we propose a DDoS attack detection and countermeasure scheme based on discrete wavelet transform (DWT) and auto-encoder neural network for SDN. The proposed scheme extracts statistical features from the wavelet transform to be processed by an auto-encoder neural network to detect samples of DDoS attack traffic. Later, to reduce the computational burden imposed by the neural network model, the average hit rate in the flow table of the switches is used to activate the DDoS detection of the scheme. We also provide a detailed performance analysis by considering the computational cost complexity of the algorithms proposed in scheme and the evaluation of the successful detection rate with simulations. Our experimental results show that the proposed scheme achieves high detection rate against DNS amplification, Network Time Protocol and TCP SYN flood attacks with a remarkably low false alarm rate.

An extensive vulnerability assessment and countermeasures in open network operating system software defined networking controller

AbstractSoftware defined networking (SDN) is the technology that has changed the design and deployment architecture of networks with its benefits like centralization, application awareness, programmability and so forth. But security is one aspect, which needs to be continuously revised according to the new vulnerabilities or bugs found in the network. In this article, penetration testing or vulnerability assessment has been performed on ONOS SDN controller with both single and clustered controller environments. Penetration testing has been performed using DELTA framework, which is solely built for SDN. Apart from using DELTA, python scripting and some popular DDoS tools like Hping3, Nping and Xerxes, are used to perform DDoS (TCP SYN and HTTP) vulnerability assessment. A total of 13 known and unknown vulnerabilities were found with impact of six each listed in high, and medium, while one vulnerability has low‐impact. The impact level is measured using common vulnerability scoring system (CVSS) 3.1. Vulnerabilities have been found on the ONOS deployments with default parameters and results achieved can be used to strengthen the security of ONOS SDN controller. Our research puts major emphasis on finding both known and unknown vulnerabilities in ONOS SDN controller and their countermeasures to prevent or mitigate these vulnerabilities.

Performance Evaluation of Different Raspberry Pi Models as MQTT Servers and Clients

Performance analysis for devices in Internet of Things (IoT) environments is an important consideration, especially with their increasing integration in technological solutions, worldwide. The Single Board Computers (SBCs) of the Raspberry Pi Foundation have been widely accepted by the community, and hence, they have been incorporated in numerous IoT projects. To ease their integration, it is essential to assess their network performance. In this paper, we made an empirical performance evaluation of one of the most popular network protocols for IoT environments, named the Message Queuing Telemetry Transport (MQTT) protocol, on Raspberry Pi. To do so, we set up two different testbeds scenarios and assessed the performance with benchmarks. At the software level, we focused on Mosquitto, a popular open-source MQTT broker implementation and client library. Our principal metric is the transmission time, but we also investigated the throughput. In our experiments, we varied several parameters, such as the size of the payload of the published messages, the WiFi bandwidth, the QoS level, the security level (MQTT vs. MQTT with TLS), and the hardware for the clients and broker. We focus mainly on packet sizes ranging from 100 to 25,000 bytes. We also investigate how these low-cost devices handle a TCP SYN flood attack. In the research work presented within this paper, we aim to guide developers, researchers, network administrators, and hobbyists who plan to use these low-cost devices in an MQTT or IoT network by showing the performance that they should expect according to different Raspberry Pi options.

Lightweight Statistical Approach towards TCP SYN Flood DDoS Attack Detection and Mitigation in SDN Environment

Distributed Denial of Service (DDoS) attack is known to be one of the most lethal attacks in traditional network architecture. In this attack, the attacker uses botnets to overwhelm network resources. Botnets can be randomly compromised computers or IoT devices that are used to generate excessive traffic towards the victim, and as a result, legitimate users cannot access the services. In this research, software-defined networking (SDN) has been suggested as a solution to fight DDoS attacks. SDN uses the idea of centralized control and segregation of the data plane from the control plane. SDN is more flexible, and policy implementation on the centralized controller is easy. SDN is now being widely used in modern network paradigms because it has enhanced security. In this work, an entropy-based statistical approach has been suggested to detect and mitigate TCP SYN flood DDoS attacks. The proposed algorithm uses a three-phased detection scheme to minimize the false-positive rate. Entropy, standard deviation, and weighted moving average have been used for intrusion detection. Multiple experiments were performed, and the results show that the suggested approach is more reliable and lightweight and has a minimal false-positive rate.

R-IDPS: Real Time SDN-Based IDPS System for IoT Security

The advent of the latest technologies like the Internet of things (IoT) transforms the world from a manual to an automated way of lifestyle. Meanwhile, IoT sector open numerous security challenges. In traditional networks, intrusion detection and prevention systems (IDPS) have been the key player in the market to ensure security. The challenges to the conventional IDPS are implementation cost, computing power, processing delay, and scalability. Further, online machine learning model training has been an issue. All these challenges still question the IoT network security. There has been a lot of research for IoT based detection systems to secure the IoT devices such as centralized and distributed architecture-based detection systems. The centralized system has issues like a single point of failure and load balancing while distributed system design has scalability and heterogeneity hassles. In this study, we design and develop an agent-based hybrid prevention system based on software-defined networking (SDN) technology. The system uses lite weight agents with the ability to scaleup for bigger networks and is feasible for heterogeneous IoT devices. The baseline profile for the IoT devices has been developed by analyzing network flows from all the IoT devices. This profile helps in extracting IoT device features. These features help in the development of our dataset that we use for anomaly detection. For anomaly detection, support vector machine has been used to detect internet control message protocol (ICMP) flood and transmission control protocol synchronize (TCP SYN) flood attacks. The proposed system based on machine learning model is fully capable of online and offline training. Other than detection accuracy, the system can fully mitigate the attacks using the software-defined technology SDN technology. The major goal of the research is to analyze the accuracy of the hybrid agent-based intrusion detection systems as compared to conventional centralized only solutions, especially under the flood attack conditions generated by the distributed denial of service (DDoS) attacks. The system shows 97% to 99% accuracy in simulated results with no false-positive alarm. Also, the system shows notable improvement in terms of resource utilization and performance under attack scenarios. The R-IDPS is scalable, and the system is suitable for heterogeneous IoT devices and networks.

An IoT-Based Intrusion Detection System Approach for TCP SYN Attacks

The success of Internet of Things (IoT) deployment has emerged important smart applications. These applications are running independently on different platforms, almost everywhere in the world. Internet of Medical Things (IoMT), also referred as the healthcare Internet of Things, is the most widely deployed application against COVID-19 and offering extensive healthcare services that are connected to the healthcare information technologies systems. Indeed, with the impact of the COVID-19 pandemic, a large number of interconnected devices designed to create smart networks. These networks monitor patients from remote locations as well as tracking medication orders. However, IoT may be jeopardized by attacks such as TCP SYN flooding and sinkhole attacks. In this paper, we address the issue of detecting Denial of Service attacks performed by TCP SYN flooding attacker nodes. For this purpose, we develop a new algorithm for Intrusion Detection System (IDS) to detect malicious activities in the Internet of Medical Things. The proposed scheme minimizes as possible the number of attacks to ensure data security, and preserve confidentiality of gathered data. In order to check the viability of our approach, we evaluate analytically and via simulations the performance of our proposed solution under different probability of attacks.

Comparative Study on TCP SYN Flood DDoS Attack Detection: A Machine Learning Algorithm Based Approach

A most common attack on the internet network is a Distributed Denial of Service (DDoS) attack, which involves occupying computational resources and bandwidth to suppress services to potential clients. The attack scenario is to massively flood the packets. The attack is called a denial of service (DoS) if the attack originates from a single server, and a distributed denial of service (DDoS) if the attack originates from multiple servers. Control and mitigation of DDoS attacks have been a research goal for many scholars for over a decade, and they have achieved in delivering a few major DDoS detection and protection techniques. In the current state of internet use, how quickly and early a DDoS attack can be detected in broadcasting network transactions remains a key research goal. After the development of a machine learning algorithm, many potential methods of DDoS attack detection have been developed. The work presents the results of various experiments carried out using data mining and machine learning algorithms as well as a combination of these algorithms on the commonly available dataset named CAIDA for TCP SYN flood attack detection. Also, this work analysis the various performance metrics such as false positive rate, precision, recall, F-measure and receiver operating characteristic (ROC) using various machine learning algorithm. One-R(OR) with an ideal FPR value of 0.05 and recall value of 0.95,decision stump(DS) with an ideal precision value of o.93,PART with an excellent F-measure value of 0.91 are some of the performance metric values while performing TCP SYN flood attack detection.

SDNDefender: A Comprehensive DDoS Defense Mechanism Using Hybrid Approaches over Software Defined Networking

In traditional networks, DDoS attacks are often launched in the network layer or the transport layer. Researchers had explored this problem in depth and put forward plenty of solutions. However, these solutions are only suitable for scenarios such as a single link or victim side network and could not analyse traffic distribution from the angle of the global network. Also, the TCP/IP network architecture lacks abilities to quickly conduct resource deployment and traffic scheduling. When DDoS attacks occur, victims usually could not respond in time. With the superiorities of centralized control mode and global topological view, Software-Defined Networking (SDN) provides a new way to get over the above issues. In this paper, we adopt a combination of diverse technologies to design SDNDefender, a SDN-based DDoS detection and defense mechanism, which is composed of two core components aiming to counter the most popular DDoS attacks including IP spoofing attack and TCP SYN flood attack. We carry out quantitative simulation experiments for evaluating SDNDefender from many metrics. The experimental results show that in contrast to other DDoS defense algorithms, SDNDefender not only efficiently validates spoofed packets and withstands well-known attacks but also defends unknown attacks according to the target’s available resources. Besides, SDNDefender could significantly reduce TCP half-open connections and improve detection accuracy, alleviating attack influences that exhaust the server’s resources and network bandwidth.

Towards Detecting Flooding DDOS Attacks Over Software Defined Networks Using Machine Learning Techniques

Distributed Denial of Service Attack (DDoS) has emerged as a major threat to cyber space. A DDoS attack aims at exhausting the resources of the victim causing financial and reputational damages to it. The availability of free software make launching of DDoS attacks easy. The difficulty in differentiating a DDoS traffic from a legitimate traffic burst such as a flash crowd makes DDoS difficult to be identified. A wide range of techniques have been used in conventional networks to detect and mitigate DDoS attacks. Though the advent of Software Defined Networking (SDN) makes a network easy to be managed even SDN is vulnerable to DDoS attacks. In this case, the controller of the SDN gets overloaded with the incoming packets from the switches. In fact, a solution based on security analytics can be put in place to ward off this threat as a proactive security measure using the flow level statistics available from the SDN. Compared to the packet analysis used in traditional networks which is resource expensive the flow level statistics is relatively inexpensive. This paper focuses on the design and implementation of an attack detection system for detecting the flooding DDoS attacks TCP SYN flooding attacks, HTTP request flooding attacks, UDP flooding attacks and ICMP flooding attacks over SDN network traffic. The system uses various classification algorithms to classify a traffic into normal or attack. The feature sets for classification were arrived at using a feature selection module with ANOVA (Analysis of Variance) F-Test statistical method. Performance evaluation of each of the classifiers was carried out for the three feature sets obtained from the feature selection module using various performance measures and the results have been tabulated. The feature set which gives the best performance in detecting malicious traffic has been identified.

Anomaly detection framework to prevent DDoS attack in fog empowered IoT networks

Internet of things or in short IoT is a network of interconnected entities such as computing devices, mechanical machines, digital gadgets etc. Cloud based IoT infrastructures are susceptible to Distributed Denial of Service (DDoS) attacks. A DDoS attack may render the server useless for a long period of time causing the services to crash due to extensive load. In this project we will try to introduce the concept of fog computing and try to explain its importance in a 3-tier architecture. We have proposed an anomaly detection architecture for IoT networks where the detection actually happens on the fog layer. The algorithm is based on the CRPS metric which is a single variable algorithm which is the case in most statistical algorithms. Therefore, we have proposed a way to use multiple variables and shown why it is required in a heterogeneous network like IoT. For detection purposes(testing data) we have used Week 5 Day 1 data of DARPA 99 as it contains a TCP SYN attack initiated once for a duration of 6 min 51 s and for ICMP Week 4 Day 1 data of DARPA 99 is used it has 2 attacks for 1s each. The algorithm is able to identify these attacks correctly.

FUPE: A security driven task scheduling approach for SDN-based IoT–Fog networks

Fog computing is a paradigm to overcome the cloud computing limitations which provides low latency to the users’ applications for the Internet of Things (IoT). Software-defined networking (SDN) is a practical networking infrastructure that provides a great capability in managing network flows. SDN switches are powerful devices, which can be used as fog devices/fog gateways simultaneously. Hence, fog devices are more vulnerable to several attacks. TCP SYN flood attack is one of the most common denial of service attacks, in which a malicious node produces many half-open TCP connections on the targeted computational nodes so as to break them down. Motivated by this, in this paper, we apply SDN concepts to address TCP SYN flood attacks in IoT–fog networks . We propose FUPE, a security-aware task scheduler in IoT–fog networks. FUPE puts forward a fuzzy-based multi-objective particle swarm Optimization approach to aggregate optimal computing resources and providing a proper level of security protection into one synthetic objective to find a single proper answer. We perform extensive simulations on IoT-based scenario to show that the FUPE algorithm significantly outperforms state-of-the-art algorithms. The simulation results indicate that, by varying the attack rates, the number of fog devices, and the number of jobs, the average response time of FUPE improved by 11% and 17%, and the network utilization of FUPE improved by 10% and 22% in comparison with Genetic and Particle Swarm Optimization algorithms, respectively.

Multifractal detrended fluctuation analysis based detection for SYN flooding attack

The TCP SYN flooding (half-open connection) attack is a type of DDoS attack, which denies the services by consuming the server resources. This attack prevents legitimate users from using their desired service. The SYN flooding attack exploits the normal TCP three-way handshake by sending stream of SYN packets to the server with spoofed IP addresses. The detection of this attack is hard since the internet routing infrastructure cannot differentiate between legitimate and spoofed SYN packets. In this paper we present a new detection method for the SYN flooding attack based on Multifractal Detrended Fluctuation Analysis (MFDFA) in addition to an adaptive threshold, thus we can detect the abnormal behavior in the TCP protocol time series.

Security Verification in the Context of 5G Sensor Networks

In order to develop reliable safety standards for 5G sensor networks (SN) and the Internet of Things, appropriate verification tools are needed, including those offering the ability to perform automated symbolic analysis process. The Tamarin prover is one of such software-based solutions. It allows to formally prove security protocols. This paper shows the modus operandi of the tool in question. Its application has been illustrated using an example of an exchange of messages between two agents, with asynchronous encryption. The scheme may be implemented, for instance, in the TLS/DTLS protocol to create a secure cryptographic key exchange mechanism. The aim of the publication is to demonstrate that automated symbolic analysis may be relied upon to model 5G sensor networks security protocols. Also, a use case in which the process of modeling the DTLS 1.2 handshake protocol enriched with the TCP SYN Cookies mechanism, used to preventing DoS attacks, is presented

DETECTION OF ANOMALIES IN THE TELECOMMUNICATIONS TRAFFIC BY STATISTICAL METHODS

Anomaly detection is an important task in many areas of human life. Many statistical methods are used to detect anomalies. In this paper, statistical methods of data analysis, such as survival analysis, time series analysis (fractal), classification method (decision trees), cluster analysis, entropy method were chosen to detect anomalies. A description of the selected methods is given. To analyze anomalies, the traffic and attack implementations from an open dataset were taken. More than 3 million packets from the dataset were used to analyze the described methods. The dataset contained legitimate traffic (75%) and attacks (25%). Simulation modeling of the selected statistical methods was performed on the example of network traffic implementations of telecommunication networks of different protocols. To implement the simulation, programs were written in the Pyton programming language. DDoS attacks, UDP-flood, TCP SYN, ARP attacks and HTTP-flood were chosen as anomalies. A comparative analysis of the performance of these methods to detect anomalies (attacks) on such parameters as the probability of anomaly detection, the probability of false positive detection, the running time of each method to detect the anomaly was carried out. Experimental results showed the performance of each method. The decision tree method is the best in terms of anomaly identification probability, fewer false positives, and anomaly detection time. The entropy analysis method is slightly slower and gives slightly more false positives. Next is the cluster analysis method, which is slightly worse at detecting anomalies. Then the fractal analysis method showed a lower probability of detecting anomalies, a higher probability of false positives and a longer running time. The worst was the survival analysis method.

Evaluation of Data Center Network Security based on Next-Generation Firewall

This study aims to create a network security system that can mitigate attacks carried out by internal users and reduce attacks from internal networks. Further, a network security system is expected to overcome the difficulty of mitigating attacks carried out by internal users. The goal of this research is to analyze the effectiveness of the Next-Generation Firewall implemented to improve network security. The method used in this research is the comparison method with a test of TCP SYN attack, UDP flood attack, ICMP smurf attack, and DHCP starvation attack on a company network. From the experiment results, it can be concluded that the Next-Generation Firewall has significantly better performance for protecting mitigating attacks carried out by internal users on a company network. It can increase the security of data communication networks against threats from the internal networks.

PACKET THRESHOLD ALGORITHM COUPLED WITH MACHINE LEARNING FOR DDoS CLASSIFICATION ATTACKS

Today, DDoS attacks are the most common Internet threats. DDoS attacks are generated by attackers from anywhere to disable a company's servers from being accessed by users worldwide. An attacker can easily launch one or more types of DDoS attacks at a time. DDoS attacks that can be generated by attackers include Slowloris, UDP flood, Smurf, HTTP flood, TCP SYN flood and more. Therefore, we have proposed a technique called the Packet Threshold Algorithm (PTA) in this paper, where it is combined with several machine learning to classify normal packet and DDoS attacks, namely UDP flood, Smurf, TCP SYN flood and Ping of Death. There are four machine learning, which are K-Nearest Neighbor (KNN), Naïve Bayes, Logistic Regression and Support Vector Machine (SVM) combined with the Packet Threshold Algorithm (PTA) to reduce the false positive rate to obtain high detection accuracy. Among the four combinations of techniques, PTA-KNN has been considered the best technique in the context of the reduction of false positive rates. The determination of this best technique is based on the PTA-KNN has achieved the highest detection accuracy (99.83%) compared to the other three techniques with only a 0.02% false positive rate. The determination of this best technique is based on the PTA-KNN has achieved the highest detection accuracy (99.83%) compared to the other three techniques with only a 0.02% false positive rate.

AEGIS: Detection and Mitigation of TCP SYN Flood on SDN Controller

Software-Defined Network (SDN) segregates the control plane and the data plane to bring about a programmable network. The controller at the control plane runs network modules and sets rules for forwarding the packets in the switches that resides at the data plane. Though advantageous in several ways, SDN can fail when the controller is saturated by a flood of TCP SYN packets. SYN flood can be created using malicious spoofing of IP or MAC addresses or flash crowd. The existing solutions to mitigate SYN flood against the controller does not adequately handle MAC spoofing based SYN flood, and these are unable to distinguish between flash crowd and malicious traffic. To overcome some limitations in existing solutions, we propose a novel mechanism called AEGIS , which detect and mitigate SYN flood against the controller in SDN. AEGIS runs in the controller, and it regularly checks if there is a performance lag in the controller due to an ongoing SYN flood. If a performance degradation is detected, then AEGIS takes it an indication of SYN flood and it identifies whether it is due to spoofed addresses or flash crowd. Once the reason is found, the appropriate mitigation procedure is triggered. We evaluate AEGIS in testbed and emulator settings, and we compare the results of the evaluation with state-of-the-art solutions. The performance evaluation of AEGIS shows that it identifies the malicious SYN at an accuracy of 97.78%. Moreover, when there is no SYN flood, AEGIS takes 0.0637s to set up a successful TCP connection, which is 53.81% less than the time taken by the state-of-the-art solution, thus, it proves that AEGIS is lightweight.

Boğaziçi University distributed denial of service dataset.

Distributed Denial of Service (DDoS) attacks is one of the most troublesome intrusions for online services on the internet. In general DDoS attacks are divided into two categories as bandwidth depletion and resource depletion attacks. We generate resource depletion-type DDoS attacks on the campus network of Boğaziçi University and recorded the ongoing traffic from the backbone router's mirrored port. We generate TCP SYN, and UDP flooding packets using Hping3 traffic generator software by flooding. This dataset includes attack-free user traffic and attack traffic, which is suitable for evaluating network-based DDoS detection methods. Attacks are towards one victim server connected to the backbone router of the campus. Attack packets have randomly generated spoofed source IP addresses. We removed payloads of packets and anonymized the source IP addresses of legitimate users for the confidentiality of legitimate users.

TCP SYN Flood (DoS) Attack Prevention Using SPI Method on CSF: A PoC

TCP SYN Flood as one kind of Denial of Service (DoS) attack, still popular to flood the server connection, by sending SYN packets to the target. Because of the risk caused by this attack, there is a need for a network security mechanism. In this paper, one of the security mechanisms proposed is using Stateful Packet Inspection (SPI) method on Configserver Security and Firewall (CSF). By using SPI method, CSF has capabilities to responsible for separating packets of data, that may be entered with data packets that should not be entered into the server. For example: port to be opened, port closed, and IP Address that may access the server for anywhere. This paper combines both of CSF and SPI method to prevent TCP SYN Flood (DoS) with Proof of Concept (PoC) at the Linux operating system. The security process is done in 3 ways: configuring a maximum connection from an IP Address to a server, securing an incoming SYN packet per second, and counting how many times an IP Address violates the minimum SYN packet rule per second before being blocked by a firewall.