Three-way Handshake Mechanism Research Articles

On the Detection of Low-Rate Denial of Service Attacks at Transport and Application Layers

Distributed denial of service (DDoS) attacks aim to deplete the network bandwidth and computing resources of targeted victims. Low-rate DDoS attacks exploit protocol features such as the transmission control protocol (TCP) three-way handshake mechanism for connection establishment and the TCP congestion-control induced backoffs to attack at a much lower rate and still effectively bring down the targeted network and computer systems. Most of the statistical and machine/deep learning-based detection methods proposed in the literature require keeping track of packets by flows and have high processing overheads for feature extraction. This paper presents a novel two-stage model that uses Long Short-Term Memory (LSTM) and Random Forest (RF) to detect the presence of attack flows in a group of flows. This model has a very low data processing overhead; it uses only two features and does not require keeping track of packets by flows, making it suitable for continuous monitoring of network traffic and on-the-fly detection. The paper also presents an LSTM Autoencoder to detect individual attack flows with high detection accuracy using only two features. Additionally, the paper presents an analysis of a support vector machine (SVM) model that detects attack flows in slices of network traffic collected for short durations. The low-rate attack dataset used in this study is made available to the research community through GitHub.

Neighbor Discovery Algorithm in Wireless Local Area Networks Using Multi-beam Directional Antennas

Neighbor discovery is an important step for Wireless Local Area Networks (WLAN) and the use of multi-beam directional antennas can greatly improve the network performance. However, most neighbor discovery algorithms in WLAN, based on multi-beam directional antennas, can only work effectively in synchronous system but not in asynchro-nous system. And collisions at AP remain a bottleneck for neighbor discovery. In this paper, we propose two asynchrono-us neighbor discovery algorithms: asynchronous hierarchical scanning (AHS) and asynchronous directional scanning (ADS) algorithm. Both of them are based on three-way handshaking mechanism. AHS and ADS reduce collisions at AP to have a good performance in a hierarchical way and directional way respectively. In the end, the performance of the AHS and ADS are tested on OMNeT++. Moreover, it is analyzed that different application scenarios and the factors how to affect the performance of these algorithms. The simulation results show that AHS is suitable for the densely populated scenes around AP while ADS is suitable for that most of the neighborhood nodes are far from AP.

ANALYSIS OF MULTI-CHANNEL TWO-DIMENSIONAL PROBABILITY CSMA AD HOC NETWORK PROTOCOL BASED THREE-WAY HANDSHAKE MECHANISM

Abstract In wireless Ad Hoc networks, large number and flexible mobility of terminals lead to the rarity of wireless channel resources. Also the hidden and exposed terminal problem exists in the Ad Hoc network which is the major factors restricting its development and applying. Considering these factors, this paper proposes a new CSMA protocol: multi-channel two-dimensional probability CSMA for wireless Ad Hoc network protocol based on three-way handshake mechanism, and analyzes the system throughput, delay of information packet, energy consumption and other properties under the control of the proposed protocol. By using the cycle analysis method, computer simulation results not only verify the theoretical analysis, but also show that the protocol has the optimum performance. The proposed protocol can not only reduce the collision probability of information packets to some extent, improving the channel utilization, reducing the waste of channel resources, but also achieve the balancing of load in a variety of wireless Ad Hoc network services, meeting the needs by different priorities with different QoS, and ensuring the systematic efficiency and fairness.

OPERETTA: An OPEnflow-based REmedy to mitigate TCP SYNFLOOD Attacks against web servers

TCP SYNFLOOD attacks are a type of Distributed Denial of Service (DDoS) attacks usually carried out against web servers. TCP SYNFLOOD rely on the normal TCP Three-Way Handshake mechanism to consume resources on the targeted server. In this way server resources are blocked and the server is made unresponsive. To this purpose, the attacker sends multiple fake SYN packets as if it wants to set several TCP connections up, but then it does not finalize the Three-Way Handshake. In this way, it blocks the resources of the attacked server, uselessly. In traditional networks, these attacks have been counteracted by means of firewalls and intrusion detection schemes. However, these solutions are not effective since can be violated. Software Defined Networks (SDNs) offer new features like network programmability which make solutions to TCP SYNFLOOD attacks more effective. In fact, in SDN networks intelligence for counteracting security menaces can be moved to a single network element, i.e., the Controller, which has complete information about the network and is in the best condition to identify ongoing attacks. However, in this way TCP SYNFLOOD attacks can turn into attacks to the Controller, which becomes a unique point of failure for the network. In this paper we propose OPERETTA, an OPEnflow-based Remedy to TCP SYNFLOOD Attacks. OPERETTA is implemented in the Controller which manages incoming TCP SYN packets and rejects fake connection requests. The OPERETTA protocol works in heterogeneous networks, as it can be implemented not only on a centralized Controller, but also on delocalized Controllers available in the access routers at the users’ premises. OPERETTA has been tested using MININET and to this purpose prototypes of the relevant Control Plane functions have been implemented starting from the POX Controller. Numerical results show that OPERETTA achieves good performance in terms of resilience to TCP SYNFLOOD attacks and low level of CPU and memory consumption.

Funneling media access control (MAC) protocol for underwater acoustic sensor networks

Due to the characteristics of the underwater acoustic channel, such as long propagation delay and low available bandwidth, the media access control (MAC) protocol designed for underwater acoustic sensor networks (UWASNs) is quite different from that for terrestrial wireless sensor networks. In this paper, we propose a MAC protocol for the UWASNs, named the funneling MAC (FMAC-U), which is a contention-based MAC protocol with a three-way handshake. The FMAC-U protocol uses an improved three-way handshake mechanism and code division multiple access (CDMA) based technology for request-to-send (RTS) signals transmitting to the sink in order that the sink can receive packets from multiple neighbors in a fixed order during each round of handshakes. The mechanism reduces the packet collisions and alleviates the funneling effect, especially alleviating the choke point of the UWASNs. Simulation results show that the proposed FMAC-U protocol achieves higher throughput, smaller packet drop ratio, lower end-to-end delay, and lower overhead of the control packet compared to the existing MAC protocols for UWASNs.

VCHR: Virtual Cluster-Based Hybrid Routing Protocol

There are a couple of inherent shortcomings which are hard to be overcome in single topology network; thus we propose a novel routing protocol—VCHR, i.e., Virtual Cluster-based Hybrid Routing, which employs hybrid topology, bears the stamp of flat and hierarchical routing protocol. At stage of hierarchical routing, VCHR draws on the idea of the virtual cluster; base station controls clustering process based on network coverage control criteria in centralized model, and ensuring the reliability of virtual clusters by making use of the three-way handshake mechanism. Flat routing employs shortest path routing protocol to get the optimized routing path to base station. In context of low algorithm complexity, the protocol could realize full network coverage control, effectively balance energy load among sensor nodes and quickly respond to network dynamic changes.