Detection and Defense Algorithms of Different Types of DDoS Attacks

Abstract

Nowadays, computer network is very important because of the many advantages it has. However, it is also vulnerable to a lot of threats from attackers and the most common of such attack is the Distributed Denial of Service (DDoS) attack. This paper presents an overview of the existing detection and defense algorithms to mitigate four types of DDoS attacks and they are the UDP flood, TCP SYN flood, Ping of Death and Smurf attack. A detection and defense algorithm will be proposed in this paper and it will be evaluated using the existing Intrusion Detection and Prevention tool to determine whether it is the best algorithm to mitigate the DDoS attacks on a network environment. The proposed algorithm will be measured in terms of false positive rates and detection accuracy. Index Terms-DDoS, detection and defense algorithm, UDP flood, TCP SYN flood, ping of death and Smurf attack.

Distributed Denial of Service (DDoS) Mitigation Using Blockchain—A Comprehensive Insight

“…A typical setup for an HTTP flood is presented in Figure 2. Slowloris sends incomplete requests at predefined intervals, aiming at keeping the request channels engaged for an extended period of time, preventing legitimate access to the target devices [37][38][39][40][41].…”

“…TCP SYN floods send SYN messages to the victim but provide no confirmation to the victim for establishment of a connection with spoofed source IP addresses. In this manner, the target resources are exhausted over time, since it responds to each hand shake but never receives any confirmation from the attacker [37,41].…”

“…Other examples include Ping of Death, which are ping packets greater than 65,535 bytes, making the victim inaccessible, and Smurf attack, which destabilizes the victim services by sending a large volume of ICMP packets [39,41]. As seen in Figure 4, the attacker creates a network packet attached to a false IP address (spoofing), transmitting an ICMP ping message.…”

“…UDP protocol is commonly used to exploit any excessive increase in packet size. DNS amplification attacks perform service requests to change the source address field with the victim's address, causing response amplification by the servers and exhausting the victim bandwidth, as demonstrated in Figure 3 [37,40,41]. Similarly, ICMP floods send abnormal packets to target servers, making them inaccessible to legitimate requests [39][40][41].…”

A DDoS Attack Mitigation Scheme in ISP Networks Using Machine Learning Based on SDN

“…Defeating against DDoS attacks has been extensively researched recently [4][5][6][7][8][9][10][11][12][13][14][15][16][21][22][23], but there exist some limitations of the current approaches that require further investigation, namely:…”