Detection of Distributed Denial of Service Attacks Using Entropy on Sliding Window with Dynamic Threshold

Saharan, Shail; Gupta, Vishal; Vora, Nisarg; Maheshwari, Mohul

doi:10.1007/978-3-030-99584-3_37

Cited by 2 publications

(2 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The attacker must meet two requirements to execute a DNS reflection attack: the first is spoofing the IP address of the attacked endpoint, and the second is that the attacker must generate replies that are greater than the demand by multiple folds [22], [23]. The attacker gradually increases the request size by modifying the parameters of the EDNS extension mechanisms [24], [25]. As a result, the DNS servers receive a large number of DNS requests sent by the attacker with the original IP address spoofing as the prey is [26].…”

Section: ) Dns Amplification Attack (Ddos)mentioning

confidence: 99%

A Comprehensive Review of DNS-based Distributed Reflection Denial of Service (DRDoS) Attacks: State-of-the-Art

Nuiaa¹,

Manickam²,

ALsaeedi³

2022

Int. J. Adv. Sci. Eng. Inf. Technol.

View full text Add to dashboard Cite

Cyberattacks significantly impact the services based on the internet that is used in our daily lives. Any disruption will make it extremely difficult for us to carry out our daily activities. Cyberattacks will disrupt online services, exploit vulnerabilities to breach databases and servers, and so on. Various systems and services contribute to the Internet's seamless functionality. The Domain Name System (DNS) is one of the most important services. DNS is used to resolve domain names into machine-readable IP addresses. DNS, like many other Internet services, is vulnerable to cyber-attacks. While DNS faces a slew of threats, one in particular appears to stand out. DNS is vulnerable to a variety of distributed denial-of-service attacks. The distributed reflection denial of service (DRDoS) attack, a flooding attack against DNS servers that renders them unavailable, disrupting domain name resolution activities, is one of the most common variants. DRDoS attacks have been on the rise in recent years. DNS lookup outages would significantly impact our online activities in the world of ultra-connectivity because they are typically the first step in establishing a connection with a server. The purpose of this paper is to present a state-of-the-art review of DRDoS attack detection and mitigation algorithms as well as the datasets on which these algorithms operate. Finally, we discussed each of these algorithms' relative merits and demerits.

show abstract

Section: ) Dns Amplification Attack (Ddos)mentioning

confidence: 99%

A Comprehensive Review of DNS-based Distributed Reflection Denial of Service (DRDoS) Attacks: State-of-the-Art

Nuiaa¹,

Manickam²,

ALsaeedi³

2022

Int. J. Adv. Sci. Eng. Inf. Technol.

View full text Add to dashboard Cite

show abstract

“…Saharan et al [19] an effective detection mechanism that is computationally less expensive and capable of detecting various types of attacks with high accuracy is required. As a result, the researchers proposed entropy with dynamic thresholds to detect DDoS attacks in this paper.…”

Section: Introductionmentioning

confidence: 99%

Entropy-based distributed denial of service attack detection in software-defined networking

Kareem

Jasim

2022

IJEECS

View full text Add to dashboard Cite

Software defined networking (SDN) is a new network architecture that allows for centralized network control. The separation of the data plane from the control plane, which establishes a programmable network environment, is the key breakthrough underpinning SDN. The controller facilitates the deployment of services that specify control policies and delivers these rules to the data plane using a common protocol such as OpenFlow at the control plane. Despite the many advantages of this design, SDN security remains a worry because the aforementioned chapter expands the network's attack surface. In fact, denial of service (DoS) assaults pose a significant threat to SDN settings in a variety of ways, owing to flaws in the data and control layers. This work shows how distributed denial of service (DDoS) attack detection is based on the entropy variation of the destination IP address. The study takes advantage of the OpenFlow protocol's (OFP) flexibility and an OpenFlow controller (POX) to apply the proposed method. An entropy computation to determine the distributed features of DDoS traffic is developed and it is capable of detecting a user datagram protocol (UDP) flood attack after 0.445 seconds this type of attack occurred.

show abstract

Detection of Distributed Denial of Service Attacks Using Entropy on Sliding Window with Dynamic Threshold

Cited by 2 publications

References 12 publications

A Comprehensive Review of DNS-based Distributed Reflection Denial of Service (DRDoS) Attacks: State-of-the-Art

A Comprehensive Review of DNS-based Distributed Reflection Denial of Service (DRDoS) Attacks: State-of-the-Art

Entropy-based distributed denial of service attack detection in software-defined networking

Contact Info

Product

Resources

About