A Defense Strategy Against RoQ Attacks Based on Dynamic Packets Filtering

MU Jun-chen,GAN Zhi-hua,XU Hong-yun

DOI: https://doi.org/10.3969/j.issn.1009-3044.2007.06.029

2007-01-01

Abstract:Discrete Fourier transform based on the time domain sequence TCP flow sample x(n) (0,1) standardization sequences. RoQ attack is detected according to it's periodicity etc. A strategy to defense the RoQ attack is proposed. The algorithm of the strategy is given.

What problem does this paper attempt to address?

Detection and Response of Low-Rate TCP-targeted Denial of Service Attacks

WEI Wei,DONG Ya-bo,LU Dong-ming,JIN Guang

DOI: https://doi.org/10.3785/j.issn.1008-973x.2008.05.007

2008-01-01

Abstract:Low rate TCP-targeted denial of service(DoS) attack makes use of time-out and retransmission mechanism in transmission control protocol(TCP) and could severely decrease the throughput of legitimate TCP traffic.With its attacking traffic pattern,obvious difference was found between the power spectrum density(PSD) of legitimate and attack traffic samples.The statistical characteristic of this difference in history data was analyzed,and a detection method using the summation of low frequency was proposed.Meanwhile,based on the methods of leak bucket and the increasing of routing buffer,a response method was provided,which uses leak bucket periodically for smoothing the flow and uses buffer for holding extra traffic to send in next period,and its reasonable resource requirement was proved.Simulations show that for more general attack scenarios than the existing methods,the detection method has very low positive and negative false ratio,and the response method can depress attack flows more effectively than the previous methods and maintain the legitimate throughput in a normal level while the previous methods failed.
A novel mechanism to defend against low-rate denial-of-service attacks

Wei Wei,Yabo Dong,Dongming Lu,Guang Jin,Honglan Lao

DOI: https://doi.org/10.1007/11760146_23

2006-01-01

Abstract:Low-rate TCP-targeted Denial-of-Service (DoS) attack (shrew) is a new kind of DoS attack which is based on TCP’s Retransmission Timeout (RTO) mechanism and can severely reduce the throughput of TCP traffic on victim. The paper proposes a novel mechanism which consists of effective detection and response methods. Through analyzing sampled attack traffic, we find that there is a stable difference between attack and legitimate traffic in frequency field, especially in low frequency. We use Sum of Low Frequency Power spectrum (SLFP) for detection. In our algorithm the destination IP address is used as flow label and SLFP is applied to every flow traversing edge router. If shrew is found, all flows to the destination are processed by Aggregated Flows Balance (AFB) at a proper upstream router. Simulation shows that attack traffics are restrained and TCP traffics can obtain enough bandwidth. The result indicates that our mechanism is effective and deployable.
Two-stage detection algorithm for RoQ attack based on localized periodicity analysis of traffic anomaly

Kun Wen,Jiahai Yang,Fengjuan Cheng,Chenxi Li,Ziyu Wang,Hui Yin

DOI: https://doi.org/10.1109/ICCCN.2014.6911829

2014-01-01

Abstract:Reduction of Quality (RoQ) attack is a stealthy denial of service attack. It can decrease or inhibit normal TCP flows in network. Victims are hard to perceive it as the final network throughput is decreasing instead of increasing during the attack. Therefore, the attack is strongly hidden and it is difficult to be detected by existing detection systems. Based on the principle of Time-Frequency analysis, we propose a two-stage detection algorithm which combines anomaly detection with misuse detection. In the first stage, we try to detect the potential anomaly by analyzing network traffic through Wavelet multiresolution analysis method. According to different time-domain characteristics, we locate the abrupt change points. In the second stage, we further analyze the local traffic around the abrupt change point. We extract the potential attack characteristics by autocorrelation analysis. By the two-stage detection, we can ultimately confirm whether the network is affected by the attack. Results of simulations and real network experiments demonstrate that our algorithm can detect RoQ attacks, with high accuracy and high efficiency.
Characteristics Extraction and Detection of RoQ Attack

Wen Kun,Yang Jia-hai,Li Chen-xi,Cheng Feng-Juan,Yin Hui

2015-01-01

Abstract:Reduction of quality (RoQ) attack is an atypical denial of service (DoS) attack, which has a strong concealment. Consequently, most traditional methods of detection are no longer applicable. There are a number of new methods developed recently. However, most of these methods have higher false positive rate in varying degree. In this paper, a novel method is proposed based on the principle of time-frequency analysis with Wavelet multi-resolution and Cepstral technique. First, according to different time-domain characteristics, the potential anomaly is detected and the abrupt change point is located. Secondly, the local traffic around the abrupt change point is analyzed by cepstrum. The potential characteristics of attack periodicity is extracted. By the two-stage detection, this new method ultimately can confirm whether the network is affected by the attack. Results of simulations and real network experiments demonstrate that the presented algorithm can detect RoQ attacks accurately with very low false positive rate and false negative rate.
TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Yi Shen,Chunming Wu,Dezhang Kong,Mingliang Yang

DOI: https://doi.org/10.1109/icc40277.2020.9149276

2020-01-01

Abstract:Distributed Denial of Service (DDoS) attack is one of the most severe threats to the current network security. As a new network architecture, Software-Defined Networking (SDN) draws notable attention from both industry and academia. The characteristics of SDN such as centralized management and flow-based traffic monitoring make it an ideal platform to defend against DDoS attacks. When designing a network intrusion detection system (NIDS) in SDN, how to obtain fine-grained flow information with minimal overhead to the SDN architecture is a problem to be solved. In this paper, we propose TPDD, a two-phase DDoS detection system to detect DDoS attacks in SDN. In the first phase, we utilize the characteristics of SDN to collect coarse-grained flow information from the core switches and locate the potential victim. Then we monitor the edge switches located close to the potential victim to obtain finer-grained traffic information in the second phase. The collection method of each phase fully considers the impact on the bandwidth between the controller and switches. Without modifying the existing flow rules, the collection module can obtain sufficient information about traffic. By using entropy-based and machine learning-based methods, the detection module can effectively detect anomalies and identify whether the potential victim marked in the first phase is the target of attacks. Experimental results show that TPDD can effectively detect DDoS attacks with little overhead.
MIL-RoQ:Monitoring,Identifying and Locating the RoQ Attack in Backbone Ne Two Rk

Wen Kun,Yang Jiahai,Cheng Fengjuan,Yin Hui,Wang Jianfeng

DOI: https://doi.org/10.7544/issn1000-1239.2015.20148347

2015-01-01

Journal of Computer Research and Development

Abstract:Reduction of quality (RoQ) attack is an atypical denial of service (DoS) attack ,which exploits the vulnerability of TCP's adaptive behavior that can seriously reduce or inhibit the throughput of TCP flows .While most of the defensive methods are studied on the single network access link (router) ,the RoQ attack can not only launch on the single network link ,but also attack towards several links or even entire network ,which causes more severe consequences .In order to obtain a global perspective from the network and identify the attack ,in this paper we propose a traffic anomaly analysis method to monitor ,identify and locate the RoQ attack in backbone network on the basis of principal component analysis (PCA ) and spectrum analysis techniques .Experimental results demonstrate that our method can analyze and find anomalies in the traffic from several dow nstream links in backbone network ,and also locate and identify the RoQ attacks accurately .Meanwhile ,our method can significantly reduce the computation and complexity as it only needs to analyze local traffic data about anomalous links .
Multi-resource Max-Min Fairness and Support Vector Machine Based DDoS Defense

魏蔚,董亚波,鲁东明

DOI: https://doi.org/10.3785/j.issn.1008-973x.2010.02.010

2010-01-01

Abstract:Distributed denial of service(DDoS)attack was defended by distributed filtering.Distributed defense was restricted inside autonomous system(AS),which was a suitable bound for defense.Both bandwidth and processing capability of victim were considered.The filtering threshold was dynamically adjusted in AS edge according to the throughput of victim in support vector machine(SVM)-based multi-resource max-min fairness(SMMF)algorithm.Then SMMF achieved multi-resource max-min fairness and was much effective.Simulation results demonstrate that attacking traffic can be depressed in a common scenario and the legitimate throughput can be kept in a normal level when current methods fail.A realiza-tion of filters on PC-based router indicates that only a very small amount of memory is needed and the packet throughput is still normal when thousands of filters are installed.
Port Scanning Techniques and Analysis of Attack and Defense

Zhaohui Hu,Qi Chen,Ruizhao Yu

DOI: https://doi.org/10.3321/j.issn:1002-8331.2001.10.020

2001-01-01

Abstract:This article introduces the implementation of TCP Protocol and the technique of Port Scanning based on the characteristic of TCP Protocol,at the same time,the several implementations of Port Scanning are also described. We also analyze the potential external attacks that can be made because of the weakness of operation system and the ways to avoid suck kinds of attack are also put up.
Router based detection for low-rate agents of DDoS attack

Nashat, D.,Xiaohong Jiang,Horiguchi, S.

DOI: https://doi.org/10.1109/HSPR.2008.4734440

2008-01-01

Abstract:The TCP SYN flooding attack is the most prevalent type of DDoS attacks that exhaust network resources. The current detection schemes only work well for the detection of high-rate flooding sources. It is notable, however, that in the current DDoS attacks, the flooding rate is usually distributed among many low-rate flooding agents to make the detection more difficult. Therefore, a more sensitive and fast detection scheme is highly desirable for the efficient detection of these low-rate flooding sources. In this paper, we focus on the low-rate agent and propose a router-based detection scheme for it. The proposed scheme is based on the TCP SYN-SYN/ACK protocol pair with the consideration of packet header information (both sequence and Ack. numbers). To make our scheme more sensitive and generally applicable, the counting bloom filter is used to avoid the effect of SYN/ACK retransmission and the change point detection method is applied to avoid the dependence of detection on sites and access patterns. Extensive trace-driven simulation has been conducted to demonstrate the efficiency of the proposed scheme in terms of its detection probability and also average detection time.
An Approach of Defending Against DDoS Attack

Wu Zhijun,Duan Haixin,Li Xing

DOI: https://doi.org/10.1007/s11767-005-0027-8

2006-01-01

Journal of Electronics (China)

Abstract:An approach of defending against Distributed Denial of Service (DDoS) attack based on flow model and flow detection is presented. The proposed approach can protect targets from DDoS attacking, and allow targets to provide good service to legitimate traffic under DDoS attacking, with fast reaction. This approach adopts the technique of dynamic comb filter, yields a low level of false positives of less than 1.5%, drops similar percentage of good traffic, about 1%, and passes neglectable percentage of attack bandwidth to the victim, less than 1.5%. The prototype of commercial product, D-fighter, is developed by implementing this proposed approach on Intel network processor platform IXP1200.
A Unified and Fully Automated Framework for Wavelet-based Attacks on Random Delay

Qianmei Wu,Fan Zhang,Shize Guo,Kun Yang,Haoting Shen

DOI: https://doi.org/10.1109/tc.2024.3416682

IF: 3.183

2024-01-01

IEEE Transactions on Computers

Abstract:As a common defense against side-channel attacks, random delay insertion introduces noise into the executive flow of encryption, which increases attack complexity. Accordingly, various techniques are exploited to mitigate the defense effect of such insertions. As an advanced mathematical technique, wavelet analysis is considered to be a more effective technology according to its detailed and comprehensive interpretation of signals. In this paper, we propose a unified and fully automated wavelet-based attack framework (denoted as UWAF), whose data processing is kept within one unified wavelet domain, with three enhanced components: denoising, alignment and key extraction. We put forward a new idea of combining machine learning with wavelet analysis to realize the full automation of the program for attack framework, rendering it possible to search exhaustively for the optimal combination of parameter settings in wavelet transform. Our proposal finds a new setting of wavelet parameters that have not been exploited ever before and achieves the performance enhancement for about 20 times fewer traces required for successful key recovery. UWAF is compared with several mainstream attack frameworks. Experimental results show that it outperforms those counterparts, and can be considered as an effective framework-level solution to defeat the countermeasure of random delay insertion.
Detecting SYN Flooding Agents under Any Type of IP Spoofing

Dalia Nashat,Xiaohong Jiang,Susumu Horiguchi

DOI: https://doi.org/10.1109/icebe.2008.18

2008-01-01

Abstract:The TCP SYN flooding attack is the most prevalent type of DDoS attacks that exhaust network resources. A router based detection scheme has been proposed to detect the SYN flooding agents based on the assumption that the SYN packets from the agent and the SYN/ACK packets from the victimpsilas server pass through different leaf routers. In the current IP spoofing techniques, however, the attacker can spoof a random address from any subnetwork, so the SYN packets from the agent and the SYN/ACK packets from the server may pass through the same leaf router. Therefore, a more general and flexible detection scheme is highly desirable for the efficient detection of these flooding agents under any type of IP spoofing. In this paper, we propose such a scheme to detect the flooding agents by considering all the possible kinds of IP spoofing. The proposed scheme is based on the TCP SYN-SYN/ACK protocol pair with the consideration of packet header information (both sequence and Ack. numbers). The Counting Bloom Filter is used to classify all the incoming SYN/ACK packets to the sub network into two streams, the first SYN/ACK packets (SYN/ACKf ) and the retransmission SYN/ACK packets (SYN/ACKr), to make our scheme generally applicable and the Cumulative Sum algorithm is applied to avoid the dependence of detection on sites and access patterns. Compared to the old detection scheme without the consideration of IP spoofing techniques, the proposed new scheme can significantly improve the accuracy in detecting the SYN flooding agents, as verified by extensive simulation results based on different IP spoofing techniques.
SoftGuard: Defend Against the Low-Rate TCP Attack in SDN

Renjie Xie,Mingwei Xu,Jiahao Cao,Qi Li

DOI: https://doi.org/10.1109/icc.2019.8761806

2019-01-01

Abstract:The low-rate TCP attack is essentially a great threat to the Internet. It causes significant throughput degradation of TCP flows by generating periodical pulsing flows. Due to its low rate, the attack is difficult to be detected and throttled. Recently, Software-Defined Networking (SDN) has emerged as a promising network paradigm. Several SDN-based defense systems have been proposed to deal with various Denial of Service (DoS) attacks. However, they fail to consider the low-rate TCP attack. In this paper, we propose SoftGuard, which is an SDN-based defense that effectively detects and mitigates the low-rate TCP attack. SoftGuard detects the attack by installing crafted flow rules to monitor the degradation of aggregated TCP throughput in ports of switches. It confirms the attack by judging whether there is periodicity for aggregated TCP throughput with adaptive Fast Fourier Transform, and accurately identifies attack flows with Mean Euclidean Distance. Identified attack flows will be effectively throttled by installing mitigation rules in ingress switches. We implement SoftGuard in the Floodlight controller. Experiments in a real SDN testbed demonstrate its effectiveness on defending against the low-rate TCP attack.
Analysis and realization of anti-DDoS attack algorithm based on the SYN Cookie mechanism

Qing SHEN,Xin-yu JIN,Qi-min ZHOU

2005-01-01

Journal of Computer Applications

Abstract:The principle of DDoS(Distributed Denial of Service) useing the limitation of TCP/IP was introduced.Based on the monitor on the network packet traffic and the useage of the system resource,a method that leads the RSA algorithm into the SYN Cookie mechanism to encrypt and filtrate the IP packets was proposed,which can detect and reduce the damage of DDoS.The method have maken a good performance in the experimentation.
Robust dynamic network traffic partitioning against malicious attacks.

Bing Xiong,Kun Yang,Jinyuan Zhao,Keqin Li

DOI: https://doi.org/10.1016/j.jnca.2016.04.013

2017-01-01

Abstract:The continual growth of network traffic rates leads to heavy packet processing overheads, and a typical solution is to partition traffic into multiple network processors for parallel processing especially in emerging software-defined networks. This paper is thus motivated to propose a robust dynamic network traffic partitioning scheme to defend against malicious attacks. After introducing the conceptual framework of dynamic network traffic partitioning based on flow tables, we strengthen its TCP connection management by building a half-open connection separation mechanism to isolate false connections in the initial connection table (ICT). Then, the lookup performance of the ICT table is reinforced by applying counting bloom filters to cope with malicious behaviors such as SYN flooding attacks. Finally, we evaluate the performance of our proposed traffic partitioning scheme with real network traffic traces and simulated malicious traffic by experiments. Experimental results indicate that our proposed scheme outperforms the conventional ones in terms of packet distribution performance especially robustness against malicious attacks.
DDoS Defense for IoT: A Stackelberg Game Model-Enabled Collaborative Framework

Xu Chen,Liang Xiao,Wei Feng,Ning Ge,Xianbin Wang

DOI: https://doi.org/10.1109/jiot.2021.3138094

IF: 10.6

2021-01-01

IEEE Internet of Things Journal

Abstract:The proliferation of Distributed Denial of Service (DDoS) attacks in Internet of Things (IoT) not only threatens the security of digital devices and infrastructure but also severely degrades IoT system performance due to the overly consumed network resources. With the knowledge of identity information of devices and signaling data, Internet service providers (ISPs) can detect and block DDoS traffic by monitoring the upstream IoT packets, and thereby, improve network efficiency. However, inspecting all data packets online for DDoS detection will significantly increase both the network delay and the computational overhead. Therefore, the packet sampling strategy is crucial for the defenders to detect DDoS attacks. To this end, this article formulates a Stackelberg game model to analyze the collaborative IoT packet sampling against DDoS attacks. Through the equilibrium analysis of the DDoS game, we derive the lower bound of packet sampling rate (PSR) that can effectively deter potential attackers. Unlike traditional offline detection, our proposed packet sampling strategy can support both the online detection and proactive prevention of DDoS traffic. As a use case, a multipoint DDoS defense framework is developed to address the IP spoofing in 5G networks based on the proposed packet sampling strategy, which deters DDoS attacks and reduces the packet sampling cost, and thereby, maximizes the IoT utility, compared with existing methods. In typical reflection attacks (in which no more than five packets of response are triggered by a request packet), our proposed scheme not only reduces more than 70% of the sampling rate but also demonstrates superior robustness against boundary condition variation.
A Double Horizon Defense Design for Robust Regulation of Malicious Traffic

Ying Xu,Roch Guérin

DOI: https://doi.org/10.1109/SECCOMW.2006.359585

2006-01-01

Abstract:Deploying defense mechanisms in routers holds promises for protecting infrastructure resources such as link bandwidth or router buffers against network denial-of-service (DoS) attacks. However, in spite of their efficacy against brute-force flooding attacks, existing router-based defenses often perform poorly when confronted to more sophisticated attack strategies. This paper presents the design and evaluation of a system aimed at identifying and containing a broad range of malicious traffic patterns. Its main feature is a double time horizon architecture, designed for effective regulation of attacking traffic at both short and long time scales. The short horizon component responds quickly to transient traffic surges that deviate significantly from regular (TCP) traffic, i.e., attackers that generate sporadic short bursts. Conversely, the long horizon mechanism enforces strict conformance with normal TCP behavior, but does so by considering traffic over longer time periods, and is therefore aimed at attackers that attempt to capture a significant amount of link bandwidth. The performance of the proposed system was tested extensively. Our findings suggest that the implementation cost of the system is reasonable, and that it is indeed efficient against various types of attacks while remaining transparent to normal TCP users
RED-FT: A Scalable Random Early Detection Scheme with Flow Trust Against DoS Attacks

Xianliang Jiang,Jiangang Yang,Guang Jin,Wei

DOI: https://doi.org/10.1109/lcomm.2013.022713.122652

IF: 3.5529

2013-01-01

IEEE Communications Letters

Abstract:In traditional Active Queue Management algorithms, e.g. RED, each flow, defined with the source and destination IP address of packets, fairly contends for the cache of bottleneck queues. However a malicious flow cannot be identified. And it enables potential network-layer attacks, e.g. the flooding Denial-of-Service (DoS) attack and the low-rate DoS attack. In this letter, we propose a new scheme using the flows trust values to defend against DoS attacks. Different from previous schemes, it employs the flow trust to safeguard legitimate flows. A router monitors network flows and calculates flows trust values, which are used for the relevant queue management. Malicious flows would be with lower trust values while legitimate flows would be with higher ones. Simulation results show that the scheme improves the throughput and delay in DoS attacking scenarios comparing with existing queue management algorithms. We consider the scheme is practical and effective to secure networks.
Detection and Mitigation of DoS Attacks in Software Defined Networks

Shang Gao,Zhe Peng,Bin Xiao,Aiqun Hu,Yubo Song,Kui Ren

DOI: https://doi.org/10.1109/tnet.2020.2983976

2020-01-01

IEEE/ACM Transactions on Networking

Abstract:The introduction of software-defined networking (SDN) has emerged as a new network paradigm for network innovations. By decoupling the control plane from the data plane in traditional networks, SDN provides high programmability to control and manage networks. However, the communication between the two planes can be a bottleneck of the whole network. SDN-aimed DoS attacks can cause long packet delay and high packet loss rate by using massive table-miss packets to jam links between the two planes. To detect and mitigate SDN-aimed DoS attacks, this paper presents FloodDefender, an efficient and protocol-independent defense framework for SDN/OpenFlow networks. FloodDefender stands between the controller platform and other controller apps, and conforms to the OpenFlow policy without additional devices. The detection module in FloodDefender utilizes new frequency features to precisely identify SDN-aimed DoS attacks. The mitigation module uses three new techniques to efficiently mitigate attack traffic: table-miss engineering to prevent the communication bandwidth from being exhausted; packet filter to filter out attack traffic and save computational resources of the control plane; and flow rule management to eliminate most of useless flow entries in the switch flow table. Our evaluation on a prototype implementation of FloodDefender shows that the defense framework can precisely identify and efficiently mitigate the SDN-aimed DoS attacks with very little overhead.
A DDoS attack detection and defense scheme using time-series analysis for SDN

Ramin Fadaei Fouladi,Orhan Ermiş,Emin Anarim

DOI: https://doi.org/10.1016/j.jisa.2020.102587

IF: 4.96

2020-10-01

Journal of Information Security and Applications

Abstract:Software defined networking (SDN) has emerged as the integral part of cloud services since it provides flexible management capabilities to monitor and to analyze the network traffic with the help of programmable entities. Although, such functionalities play a significant role in terms of protecting the availability of cloud services against the security threats, SDN still has some vulnerabilities such as the distributed denial of service (DDoS) attacks. The DDoS attackers use spurious packets similar to normal ones and endanger the service continuity of SDN. Although conventional packet-based intrusion detection systems have broad databases to detect DDoS attacks, they are impotent of detection when the attack traffic is sheltered by the normal network traffic. The idea is therefore, to come up with a new countermeasure by observing and distinguishing the instant changes in network. In this work, we propose a DDoS attack detection and defense scheme using time-series analysis for SDN. The proposed scheme employs a model based on the upcoming traffic feature forecasting and the chaos theory together with the exponential filter and the dynamic threshold method to detect instant changes in the network. The experimental result shows that our algorithm has high detection rate and low false alarm.

computer science, information systems

A Defense Strategy Against RoQ Attacks Based on Dynamic Packets Filtering

Detection and Response of Low-Rate TCP-targeted Denial of Service Attacks

A novel mechanism to defend against low-rate denial-of-service attacks

Two-stage detection algorithm for RoQ attack based on localized periodicity analysis of traffic anomaly

Characteristics Extraction and Detection of RoQ Attack

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

MIL-RoQ:Monitoring,Identifying and Locating the RoQ Attack in Backbone Ne Two Rk

Multi-resource Max-Min Fairness and Support Vector Machine Based DDoS Defense

Port Scanning Techniques and Analysis of Attack and Defense

Router based detection for low-rate agents of DDoS attack

An Approach of Defending Against DDoS Attack

A Unified and Fully Automated Framework for Wavelet-based Attacks on Random Delay

Detecting SYN Flooding Agents under Any Type of IP Spoofing

SoftGuard: Defend Against the Low-Rate TCP Attack in SDN

Analysis and realization of anti-DDoS attack algorithm based on the SYN Cookie mechanism

Robust dynamic network traffic partitioning against malicious attacks.

DDoS Defense for IoT: A Stackelberg Game Model-Enabled Collaborative Framework

A Double Horizon Defense Design for Robust Regulation of Malicious Traffic

RED-FT: A Scalable Random Early Detection Scheme with Flow Trust Against DoS Attacks

Detection and Mitigation of DoS Attacks in Software Defined Networks

A DDoS attack detection and defense scheme using time-series analysis for SDN