Thwarting ICMP Low-Rate Attacks Against Firewalls While Minimizing Legitimate Traffic Loss

Abstract

Low-rate distributed denial of service (LDDoS) attacks pose more challenging threats that disrupt network security devices and services. Such type of attacks is difficult to detect and mitigate. In LDDoS attacks, attacker uses low-volume of malicious traffic that looks alike legitimate traffic. Thus, it can enter the network in silence without any notice. However, it may have severe effect on disrupting network services, depleting system resources, and degrading network speed to a point considering them as one of the most damaging attack types. There are many types of LDDoS such as application server and ICMP error messages based LDDoS. This paper is solely concerned with the ICMP error messages based LDDoS. The paper proposes a mechanism to mitigate low-rate ICMP error message attacks targeting security devices, such as firewalls. The mechanism is based on triggering a rejection rule to defend against corresponding detected attack as early as possible, in order to preserve firewall resources. The rejection rule has certain adaptive activity time, during which the rule continues to reject related low-rate attack packets. This activity time is dynamically predicted for the next rule activation period according to current and previous attack severity and statistical parameters. However, the rule activity time needs to be stabilized in a manner in order to prevent any additional overhead to the system as well as to prevent incremental loss of corresponding legitimate packets. Experimental results demonstrate that the proposed mechanism can efficiently defend against incremental evasion cycle of low-rate attacks, and monitor rejection rule activity duration to minimize legitimate traffic loss. INDEX TERMS Low-rate attacks, BlackNurse attack, Stateful firewall, session table, attack probabilistic modeling.

Data-Driven Security for Smart City Systems: Carving a Trail

“…In addition, this will also lead to corrective actions not only for the breached components, but also for all other similar components to protect them from similar incidents. For example, if we collect detailed information about many DDoS and low-rate DDoS (LDDoS) [74] attacks that occurred in different smart city systems, it will provide a larger sample for analytics and could lead to identifying common preconditions that made these attacks possible and also find more accurate information about the sources and mechanisms used in the attacks. As a result, the response occurs faster and delivers more accurate and adaptive countermeasures.…”

A Security Policy Protocol for Detection and Prevention of Internet Control Message Protocol Attacks in Software Defined Networks

“…Traditional networks consist of static protocols for network equipment, such as routers and switches, where it is not possible to implement network protocols. Therefore network administrators find it difficult to define custom routing protocols [8]. The SDN controller eliminates routing issues in the SDN network with the use of logical connections.…”

D2Gen: A Decentralized Device Genome Based Integrity Verification Mechanism for Collaborative Intrusion Detection Systems

“…This integration has undoubtedly improved the efficiency of processes, reduced spatio-temporal investments, and bestowed faster return on investments. While this indus-trial evolution has been extensively reviewed and studied [3], [4], [5], there is a growing concern that the increased connectivity of critical infrastructures such as thermal powerhouses, electricity grids, hospitals, hotels, banking, and defense systems makes them vulnerable to numerous cyber-attacks [6], [7], [8]. Resultantly, a hacker can hack into the end devices and install malware or modify the software components.…”