Lightweight Denial of Service (DOS) Detection System Algorithm (LIDSA)

Internet of Things (IoT) becomes more popular, and things are connected to each other through wired or wireless communication methods. Though things are connected with various methods easily, it attracts network attackers who exploit these open and convenient network connections in order to obtain unjustified information and benefits or to subvert various IoT systems. Especially, Denial of Service (DoS) attack becomes a serious problem on IoT system where huge number of devices are connected to. These devices are usually connected to IoT gateways in order to send packets to Internet. However, currently the impact of DoS attack on an IoT gateway, which has various interfaces such as wireless LAN interface and wired LAN interface, is not well examined. In this paper, we assess the impact of DoS attack on an IoT gateway with various scenarios. We implemented a prototype of an IoT gateway which has wired and wireless network interfaces by using Raspberry Pi, OpenWRT, and OVS (Open vSwitch). With this prototype, we evaluated various DoS attack scenarios on this IoT gateway. Through this evaluation, we observed the severity of DoS attack on IoT gateways, especially for wireless connections.

The Internet of Things (IoT) has gained remarkable acceptance from millions of individuals. This is evident in the extensive use of intelligent devices such as smartphones, smart television, speakers, air conditioning, lighting, and high-speed networks. The general application area of IoT includes industries, hospitals, schools, homes, sports, oil and gas, automobile, and entertainment, to mention a few. However, because of the unbounded connection of IoT devices and the lack of a specific method for overseeing communication, security concerns such as distributed denial of service (DDoS), denial of service (DoS), replay, botnet, social engineering, man-in-the-middle, and brute force attacks have posed enormous challenges in the IoT environment. Regarding these enormous challenges, this study focuses on DDoS and DoS attacks. These two attacks have the most severe consequences in the IoT environment. The solution proposed in this study can also help future researchers tackle the expansion of IoT security threats. Moreover, the study conducts rigorous experiments to assess the efficiency of the proposed approach. In summary, the experimental results show that the proposed hybrid approach mitigates data exfiltration caused by DDoS and DoS attacks by 95.4%, with average network lifetime, energy consumption, and throughput improvements of 15%, 25%, and 60%, respectively.

In the IEEE S&P 2017, Ronen et al. exploited side-channel power analysis (SCPA) and approximately 5 000 power traces to recover the global AES-CCM key that Philip Hue lamps use to decrypt and authenticate new firmware. Based on the recovered key, the attacker could create a malicious firmware update and load it to Philip Hue lamps to cause Internet of Things (IoT) security issues. Inspired by the work of Ronen et al., we propose an AES-CCM-based firmware update scheme against SCPA and denial of service (DoS) attacks. The proposed scheme applied in IoT terminal devices includes two aspects of design (i.e., bootloader and application layer). Firstly, in the bootloader, the number of updates per unit time is limited to prevent the attacker from acquiring a sufficient number of useful traces in a short time, which can effectively counter an SCPA attack. Secondly, in the application layer, using the proposed handshake protocol, the IoT device can access the IoT server to regain update permission, which can defend against DoS attacks. Moreover, on the STM32F405+M25P40 hardware platform, we implement Philips’ and the proposed modified schemes. Experimental results show that compared with the firmware update scheme of Philips Hue smart lamps, the proposed scheme additionally requires only 2.35 KB of Flash memory and a maximum of 0.32 s update time to effectively enhance the security of the AES-CCM-based firmware update process.

The Internet of Things (IoT) consists of resource-constrained devices (e.g., sensors and actuators) which form low power and lossy networks to connect to the Internet. With billions of devices deployed in various environments, IoT is one of the main building blocks of future Internet of Services (IoS). Limited power, processing, storage and radio dictate extremely efficient usage of these resources to achieve high reliability and availability in IoS. Denial of Service (DoS) and Distributed DoS (DDoS) attacks aim to misuse the resources and cause interruptions, delays, losses and degrade the offered services in IoT. DoS attacks are clearly threats for availability and reliability of IoT, and thus of IoS. For highly reliable and available IoS, such attacks have to be prevented, detected or mitigated autonomously. In this study, we propose a comprehensive investigation of Internet of Things security for reliable Internet of Services. We review the characteristics of IoT environments, cryptography-based security mechanisms and D/DoS attacks targeting IoT networks. In addition to these, we extensively analyze the intrusion detection and mitigation mechanisms proposed for IoT and evaluate them from various points of view. Lastly, we consider and discuss the open issues yet to be researched for more reliable and available IoT and IoS.

The increasing use of Internet of Things (IoT) devices has led to a rise in Distributed Denial of Service (DDoS) and Denial of Service (DoS) attacks on these networks. These attacks can have severe consequences, resulting in the unavailability of critical services and financial losses. In this paper, we propose an Intrusion Detection System (IDS) based on a Conditional Tabular Generative Adversarial Network (CTGAN) for detecting DDoS and DoS attacks on IoT networks. Our CGAN-based IDS utilizes a generator network to produce synthetic traffic that mimics legitimate traffic patterns, while the discriminator network learns to differentiate between legitimate and malicious traffic. The syntactic tabular data generated by CTGAN is employed to train multiple shallow machine-learning and deep-learning classifiers, enhancing their detection model performance. The proposed approach is evaluated using the Bot-IoT dataset, measuring detection accuracy, precision, recall, and F1 measure. Our experimental results demonstrate the accurate detection of DDoS and DoS attacks on IoT networks using the proposed approach. Furthermore, the results highlight the significant contribution of CTGAN in improving the performance of detection models in machine learning and deep learning classifiers.

Internet of Things (IoT) devices are basic units in edge computing. Denial of service (DoS) attack is a great threat to low-cost IoT devices, even worse in privacy-preserving authentication protocols for radio frequency identification (RFID) tags. During DoS attacks, the attacker consumes the legal states in a target tag by continuous scanning and further observes its behavior in authentication to break privacy. Due to lack of adequate energy and computing power, it is hard for passive backscattering RFID tags to defend against DoS attacks. In this work, we cast a new insight on the DoS attacks to RFID tags and leverage the malicious scanning behavior as a new energy source. In this way, a passive tag gains more and more energy and can afford more and more complex cryptography computation under a DoS attack. Finally, the victim tag with adequate energy achieves to complete the complicated public key cryptographic computations and defend against the DoS attack. We further propose a protocol, namely the RUND protocol. We define the tracking privacy model and introduce in the notion of tracking interval to define the tracking privacy other than indistinguishable privacy. To guarantee the security and tracking privacy properties of our protocol, we propose 3 rules as designing guidelines. The analysis shows that our approach can achieve $O$ (1) efficiency while providing DoS-defending privacy-preserving authentication. Furthermore, with proper parameters our approach can save about 40% boosting time at least, compared to the directly charging for public key cryptographic computation method.

This chapter focuses on the very serious problem of denial of service (DoS) attacks against computer systems and networks. DoS attacks are attacks designed to disrupt, overwhelm, and/or damage computing resources and data. These attacks are aimed not against confidentiality of data or integrity of systems and data, but rather against availability of systems and data. Attackers launch DoS attacks for a wide variety of reasons. The probability of success is high, due in large part to the fact that the Internet itself has not been designed for security. The cost of DoS attacks is often high—several well‐known attacks have reportedly cost organizations billions of dollars. Many types of DoS attacks have surfaced so far, including resource starvation attacks, buffer overflow attacks, and packet fragmentation attacks. Distributed denial of service (DDoS) attacks, attacks in which programs planted in multiple systems cooperate, represent an even higher level of threat. Preventing DoS attacks is difficult in the first place due to a plethora of reasons; limiting the potential for damage and disruption is often the most cost‐effective strategy. Hot sites, cold sites, use of uninterruptible power supplies (UPSs) and Redundant Array of Independent Drives (RAID) solutions, and other measures can limit the damage from DoS attacks. Using properly configured and maintained firewalls is one of the best single prevention measures. Additionally, using packet filters on systems, keeping up with patches, limiting services that run on these systems, and using other measures go a long way in helping prevent susceptibility to DoS attacks.

To measure the degree of basic service of wireless sensor network (WSN) with denial of service (DoS) attacks, it is necessary to evaluate survivability of WSN. This paper presents new method based on services and Markov Chain. It distinguishes services, analyzes influence of services under DoS attacks, gets the formula of survivability. Probability of states is obtained by markov chain, then the quantitve survivability is getted in different states. Simulations prove that DoS attacks obviously decrease the survivability of WSN, but adding node energy and improving node density in certain range can reduce the influence of DoS attacks.

Denial of Service (DOS) attacks are a major threat faced by all types of networks. The effect of DOS in a delay tolerant network (DTN) is even more aggravated due to the scarcity of resources. Perpetrators of DOS attacks in DTN-like environments look beyond the objective of rendering a target node useless. The aim of an attacker is to cause a network-wide degradation of resources, service and performance. This can easily be achieved by exhausting node or link resources and partitioning the network. In this paper we seek to provide a proactive approach in making the DTN authentication process robust against DOS. Our aim is to make security protocols which provide mandatory DTN security services resilient to DOS attacks. The overall objective is to make it hard to launch a DOS attack and ensure the availability of DTN services. A DTN-cookie mechanism has been proposed to quickly identify and filter out illegitimate traffic.

Internet of Things (IoT) is a platform where every day devices become smarter, every day processing becomes intelligent, and every day communication becomes informative. Numerous challenges prevent to secure IoT devices and their end-to-end communication in an IoT environment. In fact, the IoT security is still an open challenge. The purpose of this work is to examine a distributed strategy for mitigating Denial of Service (DoS) attacks against the fog node in an edge computing context in which the nodes exchange messages through Message Queue Telemetry Transport (MQTT) protocol. The proposed strategy is based on a dynamic message sending frequency of the lightweight nodes. It is also mitigated data tampering and eavesdropping by using Elliptic Curve Cryptography (ECC).

In WSN, DoS (denial of service) attack makes shortcoming system. The packets travel over and over in the sensor network. By that, all the assets like data transmission, memory, and vitality are squandered by this attack. However, the attacker ought to optimize its attacker plan for request to boost the impact on the system performance because of the deficiency of vitality at the aggressor side. Denial of service (DoS) attack on the Internet has become a squeezing issue. By staying away from these sorts of attacks, network performance can be improved. Therefore, security is a fundamental requirement for these networks. Effective routing is necessary in order to overcome the issued faced by the crosslayer in the DOS attack of the WSN network for the purpose of good transmission. This research work mainly focuses on performance evaluation using optimization methods. To establish the efficient path in the crosslayer against DoS attack, this paper has proposed enhanced lion optimization with an efficient path routing equalization technique (LOEPRE). If any failure node occurs in the network, then the node is recognized and the transfer of the data packet is done to the other node. Retransmission of data causes overload in the network. The proposed model focuses on these issues and overcomes these issues by improving the path efficiently with robust security. It consists of three phases: the initial phase includes the route discovery in the network. In the second phase, the transfer of data is done in the high router path for security purposes. Finally, the efficient path routing equalization technique is used for minimizing the overload in the network; it provides the equalized path length in the network and is highly efficient. Hence, the proposed LOEPRE technique is used to achieve energy efficiency in wireless network for prolonged network lifetime and minimum packet latency and minimize consumption of energy. Moreover, the simulation outcome of the proposed LOEPRE method is highly robust while comparing to the existing methods EFCRS, SSPRA ELOER, EFLOR, and TSTP. It achieves better performance than existing algorithms in comparing metric connectivity ratio, end-to-end delay, overhead, throughput, and packet delivery ratio.

Sensors have varied constraints, which makes the network challenging for communicating with its peers. In this paper, an extension to the security of physical layer of a predictive sensor network model using the ant system is proposed. The Denial of Service (DoS) attack on sensor networks not only diminishes the network performance but also affects the reliability of the information making detection of a DoS threat is more crucial than recovering from the attack. Hence, in this paper, a novel approach in detecting the DoS attack is introduced and analyzed for a variety of scenarios. The DoS attack is dependent on the vulnerabilities in each layer, with the physical layer being the lowest layer and the first to be attacked by jammers. In this paper, the physical layer DoS attack is analyzed and a defense mechanism is proposed. Classification of the jammer under various attack scenarios is formulated to predict the genunity of the DoS attacks on the sensor nodes using receiver operating characteristics (ROC). This novel approach helps in achieving maximum reliability on DoS claims improving the Quality of Service (QoS) of WSN.

Denial of Service (DoS) or Distributed Denial of Service (DDoS) is a powerful attack which prevents the system from providing services to its legitimate users. Several approaches exist to filter network-level attacks, but application-level attacks are harder to detect at the firewall. Filtering at application level can be computationally expensive and difficult to scale, while still creating bogus positives that block legitimate users. In this paper, authors show application layer DoS attack for SIP server using some open source DoS attack tools and also suggest a mechanism that can protect a given SIP server from application-level DoS attacks especially the attacks targeting the resources including CPU, sockets, memory of the victim server. In this paper author’s attempt to illustrate application layer distributed denial of Service (DDoS) attack on SIP Server such as SIP flooding attack, real time transport (RTP) flooding attack using open source DDoS attack tools. We propose a new DDoS defence mechanism that protects SIP servers from application-level DDoS attacks based on the two methodologies: IPtables and fail2ban detection. The attack flow detection mechanism detects attach flows based on the symptom or stress at the server, since it is getting more difficult to identify bad flows only based on the incoming traffic patterns. A popular software known as Wireshark which is a network protocol analyzer is used to capture the packets during DoS attack from the victim server Ethernet interface to detect the attacking host IP address and analysis the types of attack. We evaluate the performance of the proposed scheme via experiment

In ad-hoc and wireless networks, Denial of Service (DoS) attacks has always been problematic during data routing. DoS attacks disrupt the data routing and avert the generated data to reach the destination or the sink nodes. In tunnel attack, which is one of the type of DoS attacks, the intruder attracts all the traffic towards itself and prevent it from forwarding further to the neighboring nodes. Researchers have presented multiple solutions to cater the problem and minimize or avoid the tunnel attacks, but they all have their shortcomings. The main reason behind all the drawbacks is that those solutions have not been confirmed using formal methods. The formal methods can be utilized to authenticate whether or not the solutions are immune to DoS attacks. In our previous researches, it has been revealed that by employing formal methods, our newly developed protocol RAEED can detect and avoid many DoS attacks. In this research paper, it has been proved using model checker that RAEED can efficiently avoid both simple and intelligent tunnel attacks. Moreover, the results of formal methods have been confirmed with the help of computer simulations as well as practical implementation on MicaZ motes. In future we aim to employ formal methods to verify more wireless communication issues in multiple protocols.

The adaptive control of bilateral teleoperation system under denial of service (DoS) attacks is studied in this letter. The model of bilateral teleoperation system under DoS attacks is presented. The adaptive controllers are designed to deal with the influence of data missing caused by packet dropouts and DoS attacks. Two Bernoulli distributed variables are introduced to describe the system dynamic for the case that both packet dropouts and DoS attacks are involved in the communication channels. The globally asymptotically stability criterion is proposed by using Lyapunov functional methods, which implies the dynamics of the Master and the Slave are globally asymptotically synchronized. A numerical example of two degree of freedom bilateral teleoperation system is provided to show the effectiveness of obtained results.