Layer-4 service differentiation and resource isolation

Internet-based computing has lead to an emergence of a large number of threats. One of the major threat is DDoS (Distributed Denial of Service) attack. Recent incidents have shown that DDoS attacks have the capability of shutting a business not for a day but weeks. DDoS attacks have a greater impact on multi-tenant clouds than traditional infrastructure. DDoS attacks in the cloud, take the shape of EDoS (Economic denial of sustainability) attacks. In EDoS, instead of “Service Denial”, economic harms occur due to fake resource usage and subsequent addition or buying of resources using on-demand provisioning. To detect and mitigate DDoS attacks in the cloud, we argue that on-demand resource allocation (known as auto-scaling) should also be looked, in addition to network or application layer mitigation. We have proposed a novel mitigation strategy, DARAC, which makes auto-scaling decisions by accurately differentiating between legitimate requests and attacker traffic. Attacker traffic is detected and dropped based on human behavior analysis based detection. We also argue that most of the solutions in the literature, do not pay much attention to the service quality to legitimate requests during an attack. We calculate the share of legitimate clients in resource addition/buying and make subsequent accurate auto-scaling decisions. Experimental results show that DARAC mitigates various DDoS attack sets and take accurate and quick auto-scaling decisions for various legitimate and attacker traffic combinations saving from EDoS. We also show how proposed mechanism could make “arms-race” very difficult for the attackers as the resource need to defeat DARAC mechanism on a very small capacity server is huge. Results also show significant improvements in the average response time of the web-service under attack, in addition to infrastructure cost savings up to 50 % in heavy attack cases.KeywordsCloud ComputingVirtual MachineAttack ScenarioIdle ResourceCloud ConsumerThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

As the main guarantee of power grid operation, the security and stability control system can flexibly carry diversified new services through 5G network slicing technology, and establish a network with large-capacity, rigidity and low-latency simultaneously. For the channel-related risks brought by network slicing, this paper proposes a network slice mapping algorithm for stability control systems (SM-SC). The algorithm jointly considers remaining processing resources of nodes in optical access network, available bandwidth of optical interface and transmission distance. It can realize the allocation of heterogeneous network resources for slices under DDoS (Distributed denial of service) attack, on the premise of ensuring the QoS (Quality of Service) of different network slices. The simulation results show that compared with benchmark algorithm, the proposed algorithm can reduce the slice blocking ratio by an average of 3.26% under DDoS attack.

Notice of Violation of IEEE Publication Principles<br><br>"An Effective Defense Against Distributed Denial of Service in Grid"<br>by Mohan H.S. and A. Raji Reddy,<br>in the Proceedings of the First International Conference on Integrated Intelligent Computing, August 2010, pp. 84-89<br><br>After careful and considered review of the content and authorship of this paper by a duly constituted expert committee, this paper has been found to be in violation of IEEE's Publication Principles.<br><br>This paper is a duplication of the original text from the paper cited below. The original text was copied without attribution (including appropriate references to the original author(s) and/or paper title) and without permission.<br><br>Due to the nature of this violation, reasonable effort should be made to remove all past references to this paper, and future references should be made to the following article:<br><br>"An Effective Defense Against Distributed Denial of Service in Grid"<br>by N. Venkatesu, V. Deepan Chakravarthy, D. Sathya<br> in the Proceedings of the First International Conference on Emerging Trends in Engineering and Technology, July 2008, pp. 373-378<br><br> <br/> IP spoofing has been exploited by Distributed Denial of Service (DDoS) attacks to conceal flooding sources and localities in flooding traffic, and prevent legitimate hosts into becoming reflectors, redirecting and amplifying flooding traffic. Thus, the ability to filter spoofed IP packets near victims is essential to their own protection as well as to their avoidance of becoming congestion and involuntary DoS reflectors. Although an attacker can forge any field in the IP header, he or she cannot falsify the number of hops an IP packet takes to reach its destination. This hop count information can be inferred from the Time- to-Live (TTL) value in the IP header. Using a mapping between IP addresses and their hop-counts to an Internet server, the server can distinguish spoofed IP packets from legitimate ones. Based on this observation, we present a novel filtering technique that is immediately deployable to weed out spoofed IP packets. We have an IP to Hop Count Mapping Table (IP2HC) to store the Hop Count Values. We implement HCF in the Linux kernel, demonstrating its benefits using experimental measurements. We deploy the security mechanism in Globus Toolkit (GT4) to ensure that HCF can identify the spoofed packet in a Grid Environment.

Modern methods of analyzing and protecting network infrastructure against DDoS (Distributed Denial of Service) attacks are discussed. A DDoS detection model has been developed using statistical techniques, which highlights the main stages of the attacks and key characteristics of network traffic that are crucial for detecting an attack. Potential and attack power are introduced as main concepts in assessing DDoS activity. To identify the type of attack, it is suggested to increase the sensitivity of the model by identifying key characteristics that distinguish between different attack stages. The features of various DDoS attack types, such as UDP Flood, UDP Reflection/Amplification, and TCP SYN Flood, are considered. A framework for modeling DDoS network attacks has been created. DDoS attacks including UDP Flood, UDP Reflection/Amplification and TCP SYN Flood were simulated using traffic data collected via the NetFlow protocol. The proposed attack characteristics, including speed, flow volume, and flow rate, allowed us to evaluate the attack's power and consider how to change the key characteristics of network traffic.

The exponential growth of interconnected systems across the Internet of Things (IoT), Software-Defined Networks (SDN), and cloud environments has led to a drastic increase in the scale and advancement of Distributed Denial of Service (DDoS) attacks. Conventional defences based on machine learning are often static, traffic-centric, and lack adaptivity to dynamic network behaviour, resulting in high false-positive rates and delay in mitigation responses. To address these challenges, this paper presents a conceptual framework for an AI-driven, context-aware DDoS detection and mitigation system. The proposed approach employs a optimized Convolutional Neural Network–Bidirectional Long Short-Term Memory (CNN–BiLSTM) model for efficient, real-time detection of DDoS attacks. The model captures spatial and temporal correlations in traffic while incorporating contextual parameters such as Quality of Service (QoS), Service Level Agreement (SLA) priority, and workload telemetry. These contextual attributes enable the model to distinguish legitimate network fluctuations from malicious activities, so that the false positive rate will be reduced without compromising accuracy. For adaptive response, a Reinforcement Learning (RL)-based mitigation layer—exploiting Deep Q-Network (DQN) and Actor–Critic (AC) variants—continuously learns optimal mitigation actions based on real-time feedback. The interaction between detection and mitigation components forms a context-aware feedback loop, enabling dynamic policy refinement and continuous system improvement. Comprehensive literature analysis reveals that existing AI-based DDoS defense mechanisms lack integration between detection and mitigation, and often overlook contextual intelligence. The proposed framework bridges this gap by introducing a self-adaptive, feedback-driven defense system capable of maintaining detection precision, low latency, and QoS preservation in heterogeneous environments.

Distributed Denial of Service (DDoS) is a type of attack using the volume, intensity, and more costs mitigation to increase in this era. Attackers used many zombie computers to exhaust the resources available to a network, application or service so that authorize users cannot gain access or the network service is down, and it is a great loss for Internet users in computer networks affected by DDoS attacks. In the Network Forensic, a crime that occurs in the system network services can be sued in the court and the attackers will be punished in accordance with law. This research has the goal to develop a new approach to detect DDoS attacks based on network traffic activity were statistically analyzed using Naive Bayes method. Data were taken from the training and testing of network traffic in a core router in Master of Information Technology Research Laboratory University of Ahmad Dahlan Yogyakarta. The new approach in detecting DDoS attacks is expected to be a relation with Intrusion Detection System (IDS) to predict the existence of DDoS attacks.

Cloud computing is a technological marvel that transcends conventional boundaries by utilizing an Internet-based network of remote servers to store, manage, and process data and many other services. It represents a contemporary paradigm for delivering information technology services. Today, cloud computing services have become indispensable for both individuals and corporations. However, adopting cloud services presents fresh challenges in terms of service quality, resource optimization, data integration, cost governance, and operational security. The security of cloud services is of supreme importance, given the open and distributed nature of the environment, making it susceptible to various cyberattacks, such as Denial of Service (DoS) or Distributed DoS (DDoS) attacks, among others. Cyberattacks can have severe repercussions on the availability of cloud services, potentially causing complete DoS. In numerous instances, the detection of attacks is delayed, pushing cloud platforms to a breaking point. Emphasizing the importance of proactive measures, it becomes crucial to identify and alert about any suspicious access long before the latter reaches a critical stage, mitigating the risks and preventing potential service disruptions. This study introduces a preventive approach that utilizes artificial intelligence techniques to improve the security of cloud services. The proposed method aims to detect and flag potential attack behaviors well in advance before they affect service quality. To achieve this, the particular method involves periodic identification and measurement of critical information on service access and resource utilization. This can be accomplished by analyzing cloud server logs or integrating dedicated sniffing software to capture and store technical traffic details. Subsequently, the collected data are processed by analyzing traffic properties to proactively identify and report any indications of cyberattacks.

Cloud computing became popular due to nature as it provides the flexibility to add or remove the resources on-demand basis. This also reduces the cost of investments for the enterprises significantly. The adoption of cloud computing is very high for enterprises running their online applications. The availability of online services is critical for businesses like financial services, e-commerce applications, etc. Though cloud provides availability, still these applications are having potential threats of going down due to the slow HTTP Distributed Denial of Service (DDoS) attack in the cloud. The slow HTTP attacks intention is to consume all the available server resources and make it unavailable to the real users. The slow HTTP DDoS attack comes with different formats such as slow HTTP headers attacks, slow HTTP body attacks and slow HTTP read attacks. Detecting the slow HTTP DDoS attacks in the cloud is very crucial to safeguard online cloud applications. This is a very interesting and challenging topic in DDoS as it mimics the slow network. This paper proposed a novel method to detect slow HTTP DDoS attacks in the cloud. The solution is implemented using the OpenStack cloud platform. The experiments conducted exhibits the accurate results on detecting the attacks at the early stages. The slowHTTPTest open source tool is used in this experiment to originate slow HTTP DDoS attacks.

A distributed denial of service (DDoS) attack is widely regarded as a major threat for the current Internet because of its ability to create a huge volume of unwanted traffic. It is hard to detect and respond to DDoS attacks due to large and complex network environments. In this paper, we introduce two distance-based DDoS detection techniques: average distance estimation and distance-based traffic separation. They detect attacks by analyzing distance values and traffic rates. The distance information of a packet can be inferred from the time- to-live (TTL) value of the IP header. In the average distance estimation DDoS detection technique, the prediction of mean distance value is used to define normality. The prediction of traffic arrival rates from different distances is used in the distance-based traffic separation DDoS detection technique. The mean absolute deviation (MAD)-based deviation model provides the legal scope to separate the normality from the abnormality for both the techniques. The results obtained from the NS2-based simulations of the proposed techniques show that the techniques can detect attacks

IP spoofing has been exploited by Distributed Denial of Service (DDoS) attacks to (1) conceal flooding sources and localities in flooding traffic, and (2) coax legitimate hosts into becoming reflectors, redirecting and amplifying flooding traffic. Thus, the ability to filter spoofed IP packets near victims is essential to their own protection as well as to their avoidance of becoming involuntary DoS reflectors. Although an attacker can forge any field in the IP header, he or she cannot falsify the number of hops an IP packet takes to reach its destination. This hop-count information can be inferred from the Time-to-Live (TTL) value in the IP header. Using a mapping between IP addresses and their hop-counts to an Internet server, the server can distinguish spoofed IP packets from legitimate ones. Base on this observation, we present a novel filtering technique that is immediately deployable to weed out spoofed IP packets. Through analysis using network measurement data, we show that Hop-Count Filtering (HCF) can identify close to 90% of spoofed IP packets, and then discard them with little collateral damage. We implement and evaluate HCF in the Linux kernel, demonstrating its benefits using experimental measurements.

QoS routing in GMPLS-capable integrated IP/WDM networks with router cost constraints

Quality of service (QoS) in wireless 802.11 networks cannot be achieved without the support for service differentiation at the medium access layer. IEEE802.11 suffers from QoS limitations that have often been summarized in the literature. We present simulation results to show the effectiveness of several proposed techniques of improving the QoS in the IEEE802.11 protocol. Specifically, we closely examine the sliding contention window (SCW) technique and present a performance study that augments the work done by the original authors, by considering the determinism of QoS achieved. We find that simple approaches such as priority queuing and differential inter-frame spacing provide service differentiation at a single station but are not successful in providing it across a number of stations. Further, we find that the SCW approach provides a high service differentiation and deterministic QoS guarantees. It achieves these by a strict separation of the contention window range of different priority classes. Further, it measures and reacts to losses suffered by high priority flows at the MAC layer and to the increase in network load. These cross layer design techniques help SCW maintain good performance even at high network load. However, this strict service differentiation comes at the cost of reduced performance of low priority flows at heavy load.

Greater complexity in current computer networks, introduced in response to cloud computing, Internet of Things (IoT), and 5G technologies, has made complex approaches towards managing, optimizing, and securing network systems prominent.The traditional network management techniques, rooted primarily in strict rules and human intervention, are unable to cope with the amount of data and dynamics of current networks.Therefore, the use of Artificial Intelligence (AI) in networking is becoming a game-changer.Artificial Intelligence (AI) through such technologies as machine learning (ML), deep learning (DL), reinforcement learning (RL), and natural language processing (NLP) can indeed assist in enhancing the design, management, and security of the network system.There are a number of ways by which AI can optimize the networks.Traffic patterns for smart traffic control as well as resource allocation can be forecast using machine learning algorithms.The anomaly detection capabilities of machine learning-based systems also provide real-time security attack detection, hence mitigating the impact of attack vectors such as Distributed Denial of Service (DDoS) or malware attacks.Lastly but not the least, AI is capable of offering self-healing networks that automatically detect faults and heal themselves as required without human intervention, a business of unimaginable value in enormous systems.Reinforcement learning is very beneficial for dynamic routing and load balancing through constant adjustment of network parameters to changing conditions.Other applications of AI in the networks include optimization of Quality of Service (QoS), where applications with high priority such as video streaming or gaming are assigned the bandwidth, they require to function efficiently.In addition, with edge computing and 5G networks, the work of AI is ensuring that network resources are optimally distributed to edge devices for maximum scalability and performance.However, there are some limitations in the use of AI for networking.It needs to be extensively tested with data privacy issues, interpretability of the model, and computational complexity of the AI model.The requirement for high real-time performance puts constraints in processing the network, which can be itself a limiting factor for the use of AI in some applications.Even with these challenges, the potential of AI to revolutionize networking cannot be overstated, and work on network systems with AI at its foundation will probably yield more intelligent, more autonomous, and more secure networking choices.

A Distributed Denial-of-Service (DDoS) attack is a strenuous attack to defend, mainly due to a server’s inability to control the amount and the origin of requests. It is easily performed by utilizing the weakness of the network protocol. DDoS attack is considered to be a major threat among security problems in today’s Internet. TCP/IP protocol suite is the most widely used protocol suite for data communication. While SYN flooding exploits the TCP three-way handshake process by sending many connection requests using spoofed source IP addresses to a victim server. The IP protocol specifies no method for validating the authenticity of the packet’s source. This implies that an attacker can forge the source address to their desire. These kinds of attack are potentially severe. They bring down business of company drastically. DDoS attack can easily exhaust the computing and communication resources of its victim within a short period of time. This paper deals on attacks that consume all the bandwidth available to the victim machine. The TCP SYN flood works by exhausting the TCP connection queue of the host and thus denying legitimate connection requests. There are various methods used to detect and prevent this attack, one of which is to block the packet based on SYN flag count from the same IP address. This kind of prevention methods becomes unsuitable when the attackers use the Spoofed IP address. For the prevention of this kind of attacks, the TCP specific probing is used in the proposed scheme where the client is requested to change the windows size/ cause packet retransmission while sending the ACK in the three way hand shake. We also use the DHCP to statically assign the IP address based on the MAC address in a private environment. This is very useful to find the Spoofed IP Packets/TCP SYN flood and preventing them.

Distributed Denial of Service (DDOS) remains a threat to exhaust network bandwidth and host resources. Majority of DDOS attack tools utilize IP Spoofing technology that makes it very difficult to filter illegitimate packets from aggregated traffic. Contrast to easy forgery of source IP address in the IP header, Time-to-Live (TTL) value is steady relatively. Based on this observation, Wang proposed a scheme called hop-count filtering (HCF) for filtering illegitimate packets from aggregated traffic. Wang&apos;s HCF is located in an end-system. In this paper, we introduce a method called distributed HCF (DHCF). Different DHCF is put in an intermediate-system. It has the advantage for resolving the problems of network bandwidth jam and host resources exhaustion. Comparing the performances of DHCF to HCF on the platform of NS2, our experiments exhibit that DHCF has better performance to relax network jam and maintain normal users&apos; access.