Detecting Flooding-Based DDoS Attacks

a serious nuisance for network security could be a Distributed Denial of Service (DDoS) attack. The advent of the technological era has also brought along the threat of DDoS attacks for a variety of services and applications that use the Internet. Firms can incur huge financial losses even if there is a disruption in services for a fraction of a period. Analogous to a DDoS attack is the Flash Crowd (FC), in which a particular service is assessed by many legitimate users concurrently, which results in the denial of service. Overloading of network resources is a common issue associated with both these events, which impact CPU, available bandwidth, and memory for legitimate users, thereby leading to limited accessibility. Many researchers have put effort to differentiate between these two kinds of traffic, but none could come up with an effective solution. In this study, we propose an adaptive agent-based model, known as an adaptive application layer flooding protection (AALFP) model, for DDoS and FC flooding attacks. The AALFP model is aimed to protect the network application layer (NAL) against such attacks. Importantly, the model distinguishes and separates normal from abnormal traffic, and then blocks illegitimate traffic. Note that, to operate two traffic filters, the agent relies on the following three parameters of normal traffic intensity, traffic attack behaviour, and IP address history log. An example scenario is provided to simulate the model's application.

Abstract: DDoS attacks also known as distributed denial of service (DDoS) attacks have emerged as one of the most serious and fastest-growing threats on the Internet. Denial-of-service (DDoS) attacks are an example of cyber-attacks that target a specific system or network in an attempt to render it inaccessible or unusable for a period of time. As a result improving the detection of diverse types of DDoS cyber threats with better algorithms and higher accuracy while keeping the computational cost under control has become the most significant component of detecting DDoS cyber threats. DDoS (distributed denial-of-service) attack originates from many sources scattered over multiple network locations. DoS attacks are primarily motivated by the desire to significantly degrade the performance or completely consume a certain resource and a process to exploit a machine defect and cause failure of a processing or exhausting the system resources by exploiting a system flaw. Yet another method of assaulting the target system is to flood the network and monopolies it so preventing anyone else from utilizing it. DDoS attack has a high impact on crashing the network resources making the target servers unable to support the valid users.

Today Distributed Denial of Service (DDoS) attacks are causing major threat to perform online business over the Internet. Our previous work proposed an automated model with a new packet marking technique and agent design to counteract DDoS within a single ISP domain. Our approach has many features that are required to minimize the DDoS attacks. For example, our model is invoked only during attack times, identifies the approximate source of attack with a single packet even in case of spoofed source address, identifies different attack signatures for different attacking sources, prevents the attack nearest to the attacking source, has very fast response for any changes in attack traffic pattern, is simple in its implementation and can be incrementally deployed. Though the proposed model has several advantages, prevention of the attack is limited to a single ISP domain. In this paper we extend our model to prevent DDoS attacks in multiple ISP domains by retaining all the advantages achieved in our previous work. We also propose a practical implementation of the extended model with a presently working architecture.

In specific conditions and crisis situations such as the pandemic of coronavirus (SARS-CoV-2), or the COVID-19 disease, e-learning systems be-came crucial for the smooth performing of teaching and other educational pro-cesses. In such scenarios, the availability of e-learning ecosystem elements is further highlighted. An indicator of the importance for securing the availability of such an ecosystem is evident from the DDoS (Distributed Denial of Service) attack on AAI@EduHr as a key authentication service for number of e-learning users in Republic of Croatia. In doing so, numerous users (teach-ers/students/administrators) were prevented from implementing and participat-ing in the planned teaching process. Given that DDoS as an anomaly of network traffic has been identified as one of the key threats to the e-learning ecosystem in crisis scenarios, this research will focus on overview of methodology for de-veloping a model for proactive detection of DDoS traffic. The challenge in de-tection is to effectively differentiate the increased traffic intensity and service requests caused by legitimate user activity (flash crowd) from the illegitimate traffic caused by a DDoS attack. The DDoS traffic detection model developed by following analyzed methodology would serve as a basis for providing further guidelines and recommendations in the form of response to events that may negatively affect the availability of e-learning ecosystem elements such as DDoS attack.

Notice of Violation of IEEE Publication Principles<br><br>"An Effective Defense Against Distributed Denial of Service in Grid"<br>by Mohan H.S. and A. Raji Reddy,<br>in the Proceedings of the First International Conference on Integrated Intelligent Computing, August 2010, pp. 84-89<br><br>After careful and considered review of the content and authorship of this paper by a duly constituted expert committee, this paper has been found to be in violation of IEEE's Publication Principles.<br><br>This paper is a duplication of the original text from the paper cited below. The original text was copied without attribution (including appropriate references to the original author(s) and/or paper title) and without permission.<br><br>Due to the nature of this violation, reasonable effort should be made to remove all past references to this paper, and future references should be made to the following article:<br><br>"An Effective Defense Against Distributed Denial of Service in Grid"<br>by N. Venkatesu, V. Deepan Chakravarthy, D. Sathya<br> in the Proceedings of the First International Conference on Emerging Trends in Engineering and Technology, July 2008, pp. 373-378<br><br> <br/> IP spoofing has been exploited by Distributed Denial of Service (DDoS) attacks to conceal flooding sources and localities in flooding traffic, and prevent legitimate hosts into becoming reflectors, redirecting and amplifying flooding traffic. Thus, the ability to filter spoofed IP packets near victims is essential to their own protection as well as to their avoidance of becoming congestion and involuntary DoS reflectors. Although an attacker can forge any field in the IP header, he or she cannot falsify the number of hops an IP packet takes to reach its destination. This hop count information can be inferred from the Time- to-Live (TTL) value in the IP header. Using a mapping between IP addresses and their hop-counts to an Internet server, the server can distinguish spoofed IP packets from legitimate ones. Based on this observation, we present a novel filtering technique that is immediately deployable to weed out spoofed IP packets. We have an IP to Hop Count Mapping Table (IP2HC) to store the Hop Count Values. We implement HCF in the Linux kernel, demonstrating its benefits using experimental measurements. We deploy the security mechanism in Globus Toolkit (GT4) to ensure that HCF can identify the spoofed packet in a Grid Environment.

The Internet of Things (IoT) is a network of sensors that helps collect data 24/7 without human intervention. However, the network may suffer from problems such as the low battery, heterogeneity, and connectivity issues due to the lack of standards. Even though these problems can cause several performance hiccups, security issues need immediate attention because hackers access vital personal and financial information and then misuse it. These security issues can allow hackers to hijack IoT devices and then use them to establish a Botnet to launch a Distributed Denial of Service (DDoS) attack. Blockchain technology can provide security to IoT devices by providing secure authentication using public keys. Similarly, Smart Contracts (SCs) can improve the performance of the IoT–blockchain network through automation. However, surveyed work shows that the blockchain and SCs do not provide foolproof security; sometimes, attackers defeat these security mechanisms and initiate DDoS attacks. Thus, developers and security software engineers must be aware of different techniques to detect DDoS attacks. In this survey paper, we highlight different techniques to detect DDoS attacks. The novelty of our work is to classify the DDoS detection techniques according to blockchain technology. As a result, researchers can enhance their systems by using blockchain-based support for detecting threats. In addition, we provide general information about the studied systems and their workings. However, we cannot neglect the recent surveys. To that end, we compare the state-of-the-art DDoS surveys based on their data collection techniques and the discussed DDoS attacks on the IoT subsystems. The study of different IoT subsystems tells us that DDoS attacks also impact other computing systems, such as SCs, networking devices, and power grids. Hence, our work briefly describes DDoS attacks and their impacts on the above subsystems and IoT. For instance, due to DDoS attacks, the targeted computing systems suffer delays which cause tremendous financial and utility losses to the subscribers. Hence, we discuss the impacts of DDoS attacks in the context of associated systems. Finally, we discuss Machine-Learning algorithms, performance metrics, and the underlying technology of IoT systems so that the readers can grasp the detection techniques and the attack vectors. Moreover, associated systems such as Software-Defined Networking (SDN) and Field-Programmable Gate Arrays (FPGA) are a source of good security enhancement for IoT Networks. Thus, we include a detailed discussion of future development encompassing all major IoT subsystems.

One of the major threats to cyber security is distributed denial of service (DDoS) attacks. In this paper, we reveal the non-negative and cumulative increment effect of DDoS traffic throughput that is the feature accurately distinguished DDoS attacking traffic from normal flash crowd traffic. Our scheme can detect a DDoS attack in its early stages based on these feature. It can differentiate DDoS from flash crowd traffic effectively even if DDoS is potential. This scheme detects DDoS attacks with on-line and distributed characteristics. Simulation shows the algorithm's validity and accuracy.

Recently the notorious Distributed Denial of Service (DDoS) attacks made people aware of the importance of providing available data and services securely to users. A DDoS attack is characterized by an explicit attempt from an attacker to prevent legitimate users of a service from using the desired resource (CERT, 2006). For example, in February 2000, many Web sites such as Yahoo, Amazon.com, eBuy, CNN.com, Buy. com, ZDNet, E*Trade, and Excite.com were all subject to total or regional outages by DDoS attacks. In 2002, a massive DDoS attack briefly interrupted Web traffic on nine of the 13 DNS “root” servers that control the Internet (Naraine, 2002). In 2004, a number of DDoS attacks assaulted the credit card processor Authorize. net, the Web infrastructure provider Akamai Systems, the interactive advertising company DoubleClick (left that company’s servers temporarily unable to deliver ads to thousands of popular Web sites), and many online gambling sites (Arnfield, 2004). Nowadays, Internet applications face serious security problems caused by DDoS attacks. For example, according to CERT/CC Statistics 1998-2005 (CERT, 2006), computer-based vulnerabilities reported have increased exponentially since 1998. Effective approaches to defeat DDoS attacks are desperately demanded (Cisco, 2001; Gibson, 2002).

The detection of distributed denial of service (DDoS) attacks is one of the hardest problems confronted by the network security researchers. Flash event (FE), which is caused by a large number of legitimate requests, has similar characteristics to those of DDoS attacks. Moreover DDoS attacks and FEs require altogether different handling procedures. So discriminating DDoS attacks from FEs is very important. But the research involving DDoS detection has not laid enough emphasis on including FEs scenarios in the experiments. In this paper, we are using traffic cluster entropy as detection metric not only to detect DDoS attacks but also to distinguish DDoS attacks from FEs. We have validated our approach on cyber-defense technology experimental research laboratory (DETER) testbed. Different emulation scenarios are created on DETER using mix of legitimate, flash, and different types of attacks at varying strengths. It is found that, when flash event is triggered, source address entropy increases but the corresponding traffic cluster entropy does not increase. However, when DDoS attack is launched, traffic cluster entropy also increases along with source address entropy. An analysis of live traces on DETER testbed clearly manifests supremacy of our approach.

Distributed Denial of Service (DDoS) attacks grow in volume, sophistication and impact. An example is the largest DDoS attack ever recorded against the developer platform GitHub, that reached 1.35 terabytes per second - an unprecedented volume of malicious traffic. DDoS attacks have been detected or mitigated only when they are in unrecoverable stages, being late to prevent their effects. Thus, differently from other works, we advocate for the early prediction of DDoS attacks to assist in reducing or avoiding costs and losses resulted from DDoS attacks. This paper presents STARK, a self- adaptable DDoS attack prediction system. STARK identifies signs of attack before it reaches an unrecoverable stage being founded on the metastability theory. Its evaluation follows a trace-driven approach, taking as input two databases containing records of DDoS attacks. Results show the prediction of DDoS attacks with minutes or hours in advance.

The integration of cloud computing with Software Defined Networking (SDN) addresses several challenges of a typical cloud infrastructure such as complex inter-networking, data collection, fast response, etc. Though SDN-based cloud opens new opportunities, the SDN controller may itself become vulnerable to several attacks. The unique features of SDN are used by the attackers to implement the severe Distributed Denial of Service (DDoS) attacks. Several approaches are available in literature to defend against the traditional DDoS flooding attacks in SDN-cloud. To elude the detection systems, attackers try to employ the cultivated attack strategies. Such sophisticated DDoS attack strategies are implemented by generating low-rate attack traffic. The most common type of Low-Rate DDoS (LR-DDoS) attack is the Shrew attack. The existing approaches are not capable to detect, mitigate, and traceback such attacks. Thus, this work discusses a new mechanism which not only detects and mitigates the shrew attack but traces back the location of the attack sources as well. The attack is detected using the information entropy variations, and the attack sources are traced-back using the deterministic packet marking scheme. The experiments are performed in a real SDN-cloud scenario, and the experimental results show that the approach requires 1 packet and 8.27 packets on an average to locate the bots and attackers respectively. The approach detects and traces back the attack sources in between 14.45 ms to 10.02 s and provides 97.6% accuracy.

Distributed Denial of Service (DDoS) attack is a serious threat to commercial service network. DDoS attack has been studied for years. However, detecting and relieving DDoS attacks are still a problem. Especially, nowadays more and more DDoS attacks produce heavy network traffic, it is hard to response rapidly because that needs high processing performance to process massive traffic data. With big data technology, volumes of network traffic data can be processed much faster. Apache Spark can process a great amount of data in a reasonable time so that DDoS attack can be detected in time. Besides, it is difficult to modify the network configuration in traditional network. With Software-Defined Networking (SDN), a new paradigm in networking, networking can be controlled by programs, which makes modifying the network configuration easier. In this paper, a DDoS detection and mitigation system framework in SDN is introduced, a framework that can control network based on analyzing the network traffic data. Comparing to the traditional defense methods of DDoS attack, the framework can response to DDoS attack by rules automatically.

Distributed denial of service (DDoS) attacks have become a prominent threat in the digital landscape, with their frequency and impact magnifying during geopolitical conflicts. The Ukraine-Russia conflict, which commenced in February 2022, witnessed a surge in DDoS attacks, becoming the most common type of cyber assault during this period. This study examines the frequency and patterns of DDoS attacks throughout the Russo-Ukraine cyberwarfare, identifying the sectors most affected. By analyzing messages from Telegram channels containing IP addresses and URLs, we identified 4,612 unique victim domain names, with 3,090 targeted by Ukrainian hacktivist groups (pro-Ukrainian) and 1,522 by Russian hacktivist groups (pro-Russian). We observed distinct DDoS attack patterns between pro-Ukrainian and pro-Russian collectives. Ukrainian groups exhibited peak activity during May, June, and July, with a noticeable decline towards the end of 2022. In contrast, the pro-Russian group’s activities intensified in late 2022. Our investigation highlights that pro-Ukrainian collectives, particularly ‘IT Army of Ukraine 2022’, were the most active in conducting DDoS attacks and operated with higher synchronicity. Our findings also indicate that crucial portals for information and services, particularly those related to news, government, business, finance, and travel, were consistently targeted by DDoS attacks. The majority of these victim domains lacked adequate DDoS protection during the assaults, with few improving their security measures post-attack. The study also reveals that DDoS attacks predominantly occurred on Saturdays, Sundays, and Mondays. Our results underscore the necessity for enhanced cybersecurity measures in vulnerable sectors to mitigate the impact of DDoS attacks during times of conflict.

One of the most notorious security issues in the IoT is the Distributed Denial of Service (DDoS) attack. Using a large number of agents, DDoS attack floods the host server with a huge number of requests causing interrupting and blocking the legitimate user requests. This paper proposes a detection and prevention algorithm for DDoS attacks. It is divided into two parts, one for detecting the DDoS attack in the IoT end devices and the other for mitigating the impact of the attack placed on the border router. Also, it has the ability to differentiate the High-rate from the Lowrate DDoS attack accurately and defend against these two types of attacks. It is implemented and tested against different scenarios to dissect their efficiency in detecting and mitigating the DDoS attack.

With the increasing number of Internet users, cybersecurity is becoming more and more critical. Denial of service (DoS) and distributed denial of service (DDoS) attacks are two of the most common types of attacks that can severely affect a website or a server and make them unavailable to other users. The number of DDoS attacks increased by 55% between the period January 2020 and March 2021. Some approaches for detecting the DoS and DDoS attacks employing different machine learning and deep learning techniques are reported in the literature. Recently, it is also observed that the attackers have started leveraging state-of-the-art AI tools such as generative models for generating synthetic attacks which fool the standard detectors. No concrete approach is reported for developing and training the models which are not only robust in the detection of standard DDoS attacks but which can also detect adversarial attacks which are created synthetically by the attackers with harmful intentions. To that end, in this work, we employ a generative adversarial network (GAN) to develop such a robust detector. The proposed framework can generate and classify the synthetic benign (normal) and malignant (DDoS) instances which are very similar to the corresponding real instances as evaluated by similarity scores. The GAN-based model also demonstrates how effectively the malicious actors can generate adversarial DDoS network traffic instances which look like normal instances using feature modification which are very difficult for the classifier to detect. An approach on how to make the classifiers robust enough to detect such kinds of deliberate adversarial attacks via modifying some specific attack features manually is also proposed. This work provides the first step towards developing a generic and robust detector for DDoS attacks originating from various sources.