Abstract:The TCP SYN flooding attack is the most prevalent type of DDoS attacks that exhaust network resources. A router based detection scheme has been proposed to detect the SYN flooding agents based on the assumption that the SYN packets from the agent and the SYN/ACK packets from the victimpsilas server pass through different leaf routers. In the current IP spoofing techniques, however, the attacker can spoof a random address from any subnetwork, so the SYN packets from the agent and the SYN/ACK packets from the server may pass through the same leaf router. Therefore, a more general and flexible detection scheme is highly desirable for the efficient detection of these flooding agents under any type of IP spoofing. In this paper, we propose such a scheme to detect the flooding agents by considering all the possible kinds of IP spoofing. The proposed scheme is based on the TCP SYN-SYN/ACK protocol pair with the consideration of packet header information (both sequence and Ack. numbers). The Counting Bloom Filter is used to classify all the incoming SYN/ACK packets to the sub network into two streams, the first SYN/ACK packets (SYN/ACKf ) and the retransmission SYN/ACK packets (SYN/ACKr), to make our scheme generally applicable and the Cumulative Sum algorithm is applied to avoid the dependence of detection on sites and access patterns. Compared to the old detection scheme without the consideration of IP spoofing techniques, the proposed new scheme can significantly improve the accuracy in detecting the SYN flooding agents, as verified by extensive simulation results based on different IP spoofing techniques.

IP Spoofing Attack: Principles, Methods,Tools and Countermeasures

Virtual Mac Spoofing Detection Through Deep Learning

A Backscatter Technology Based Study on Source Address Spoofing

A Distributed IP Spoof Detection System in Intranet

Study on Classification and Characteristics of Source Address Spoofing Attacks in the Internet

Port Scanning Techniques and Analysis of Attack and Defense

Classification of Source Address Spoofing in the Internet

Multi-variant Network Address Hopping to Defend Stealthy Crossfire Attack

Adaptive IP Mutation: A Proactive Approach for Defending against Worm Propagation

SoK: Rethinking Sensor Spoofing Attacks Against Robotic Vehicles from a Systematic View.

Overview of ARP Spoofing Detection and Prevention Techniques

Study on IP Hijack

Detecting SYN Flooding Agents under Any Type of IP Spoofing

An Authentication Based Source Address Spoofing Prevention Method Deployed in IPv6 Edge Network

A Method Based on AMHI for DDoS Attacks Detection and Defense

MASK:An Efficient Mechanism to Extend Inter-Domain IP Spoofing Preventions

Network Working Group J. Wu Internet-Draft Tsinghua University Intended status: Experimental R. Bonica Expires: August 9, 2007 Juniper Networks

Exploiting Cross-Layer Vulnerabilities: Off-Path Attacks on the TCP/IP Protocol Suite

A Two-Level Source Address Spoofing Prevention Based on Automatic Signature and Verification Mechanism

Revisiting Inter-As IP Spoofing Let the Protection Drive Source Address Validation.

Principle analysis and prevention of ARP attack based on local area network