DoS/DDoS attacks on the Internet have increased in frequency, rigor and complexity, where they have become one of the most dangerous threats over the Internet. DDoS attacks operate on a larger scale in which a large number of vulnerable and/or compromised hosts making up a botnet are exploited to initiate parallel attacks simultaneously. These attacks drain the network and server(s) resources of a targeted system as a result, this prevents legitimate users from accessing the network/server resources. Denial of Service (DoS) attacks have been a major challenge in the field of cybersecurity for more than 20 years.
Among these, availability has been one of the largest challenges. In the early 2000s, communication networks faced many challenges in providing reliable levels of security by achieving the well-known three pillars of information security, i.e., confidentiality, integrity and availability . The results are validated using extensive simulation runs. The proposed solution has low computation and message overhead, efficient detection and tracing time, and converges in near optimal time. To our knowledge, this is the first research that efficiently traces these kinds of attacks while they are running.
The proposed algorithm suggests that edge routers-where the attack starts from-observe the traffic pattern passing through, and if the observed traffic carries the signature of TCP SYN-Flood DDoS attack and a high percentage of it is destined to a particular web server(s), it starts the tracing process by generating an IP trace packet, which accompanies the attack path recording the routers’ IP addresses on the path between the attacker/daemon and the victim, which can extract the path and react properly upon receiving it by discarding any SYN packets originating from that attacker/daemon. In this paper, a resilient, efficient, lightweight, and robust IP traceback algorithm is proposed using an IP tracing packet for each attack path.
This type of attack uses spoofed Internet Protocol (IP) addresses for SYN packets by exploiting the weakness in Transmission Control Protocol (TCP) 3-Way handshake used by the TCP/IP suite of protocols, which make the web servers unreachable for legitimate users or even worse, it might lead to server crash. In this paper, a common type of DDoS attacks known as “TCP SYN-Flood” is studied. In a DDoS attack, the attacker controls a botnet of daemons residing in vulnerable hosts that send a significant amount of traffic to flood the victim or the network infrastructure. In the recent past, Distributed Denial of Service (DDoS) attacks have become more abundant and present one of the most serious security threats.
0 kommentar(er)
