How To Defeat The DDOS Attack In Cloud Environment?

For the purpose of this assignment snort will be used as intrusion detections systems which is an open source IDS, snort has the ability to monitor traffics in real time and packet locking its also inspecting each packets as they enters into the network, Snort can be used as packet sniffer to analyse the network traffic in order to detect any bizarre looking packets or payloads which might have malicious data in it. Snort can also detect payloads attacks against the network or host system including but not limited to stealth port scan, and buffer overflows.

After that, it uses the concept of Bloom filter. Bloom filter is a data structure used to test whether an element is a member of a given set or not. It has a two-dimensional bin table of k levels by m bins with k independent hash functions. It is used to keep track of the recent arrival rates of packets of different destination IP addresses passing through a router within a sampling period t as shown in fig. 4.2. In proposed system, it stores the IP address in data structure and checks it on the behalf of misuse detection method. Once whole of the information is derived, the complete data is analyzed statistically by using association between the nodes respective to the current node.

Denial-of-Service (DDoS) attack is the one in which the host’s network elements are flooded with high volume of fabricated attacking packets that originate from a large number of machines [12]. A successful attack allows the attacker to gain access to the host’s machine, allowing stealing of sensitive internal data and possibly cause disruption and denial of service (DoS) in some cases.

This work is based on to detect the malicious nodes from the network which are responsible to trigger grayhole attack in the network. The grayhole is the distributed denial of service attack in which

Network Traffic Monitoring and analysis is essential to more effectively troubleshoot and resolve issues when they occur, to not bring network services to a standstill for extended periods. Numerous software tools are available to help administrators with the monitoring and detects cyber threats in network traffic. This paper will discuss software that can monitor Network Traffic, which helps detect cyber threats. The following is software based monitoring that detect cyber threats;

I selected a paper named “Cloud Computing Security Threats and Responses” by “Farzad Sabahi”. In this paper he summarizes reliability, availability, and security issues for cloud computing (RAS issues), and propose feasible and available solutions for some of t hem. And he discusses cloud security issues and finally he tries to find solutions for against cloud security problems

A hacker looks for poorly configured network devices. Common vulnerabilities include information gathering, sniffing, spoofing, and denial of service. As you see in our diagram, we propose to implement several points of protection,

In this paper, we focus the Flow Control for traceback that will minimize the amount of packets required for build up the attack path. Flow control based mechanism merged with Uniform Probabilistic Packet Marking (UPPM), the stream of packets can be controlled that suggests the amount of packets checked by UPPM will get reduce there by decreasing the convergence time. Then again, this strategy should bring about full traceback on an attacker.

The following technical paper “Security Analysis of a Protocol for Pollution Attack Detection” is based on the concept of network coding. Since we have a limited bandwidth it becomes imperative for us to optimize our network in such a way that we can make maximum use of the network resources. Network coding allows us to do that. It achieves this by combining different packets that it receives at a node into one single packet for transmission, instead of simply taking and forwarding the packets. However, network coding is vulnerable to pollution attacks where a single malicious node can disrupt the operation of the complete network. Several protocols to detect pollution attacks have been proposed previously. In the following paper the author has described a new pollution attack detection protocol that extends the existing SpaceMac protocol. This paper describes how we have modelled the protocol in order to carry out a security analysis and presents the results of that analysis.

To perform adaptive cyber-security analytics using a computer implemented method that includes receiving a report on a network activity, It works as follows, a scoring method is used wherein a score responsive to the network activity is calculated. The score indicates a likelihood of security breach. The score is validated and the scoring model is automatically updated responsive to results of the validating. If the score falls within a threshold value of a security violation rule, the network activity is reported as suspicious. This basically relates generally to cyber-security monitoring, and more particularly to monitoring incoming security events to determine if any activity is violating

The flow of information can be a very daunting and complex aspect to understand if you dive into it at a deep level. When people start reading and looking at how packets are made and how many bits make up each part of the packet header, it can induce a very overwhelming feeling. In contrary to that, this paper will take a look at the basic structure on how data flows through the internet and through an internal network. Once we have a basic understanding on how information flows, we can then look at vulnerabilities found in applications and/or programs that can put a network or system at risk.

The possibility of signs of cyber security incidents may arise every day and recorded or logged in security software, but it will be difficult to trace each one of threats as high importance and low importance. Based on requirements organization need to identify the most applicable software for detecting and logging the cyber-attack, It is not only the case of logging and monitoring cyber-attack analysis is very important part need to be considered before choosing any software.

Abstract- In this era of technology when everything is available at just one click; Security is a big issue. Hackers and intruders are getting smarter. There are various methods to protect the network infrastructure as well as communication over the internet, for example firewalls, encryption, and virtual private networks. Intrusion detection is a comparatively new approach to such techniques. By using intrusion detection, we can collect and use information from acknowledged attacks and figure out if somebody is trying to attack the network/host. In this paper, we have classified different types of IDS. Also we have proposed a hybrid model for intrusion detection and prevention system for cloud infrastructure, which has improved the quality of detecting the unidentified attack via anomaly-based detection along with a module which will try to diminish the number of false alarms which are generated by the system. Our proposed system finds random attacks in network and prevents these attacks automatically using the mechanism.

The proposed scheme has an advantage over traditional packet marking schemes in terms of scalability and storage requirements in victim or intermediate routers. The method stores only short-term information of traffic entropy in order to detect the DDoS attack. The research also presented experimental analysis to claim that the method is able to implement accurate trace back in a large-scale DDoS attack scenario within a few seconds.

Detection engines capable of inspecting packet payloads for application-layer network information are urgently required. The most important technology for fast payload inspection is an efficient multipattern matching algorithm, which performs exact string matching between packets and a large set of predefined patterns. This paper proposes a novel Enhanced Hierarchical Multipattern Matching Algorithm (EHMA) for packet inspection. Based on the occurrence frequency of grams, a small set of the most frequent grams is discovered and used in the EHMA. EHMA is a two-tier and cluster-wise matching algorithm, which significantly reduces the amount of external memory accesses and the capacity of memory. Using a skippable scan strategy, EHMA speeds up the scanning process. Furthermore, independent of parallel and special functions, EHMA is very simple and therefore practical for both software and hardware implementations. Simulation results reveal that EHMA significantly improves the matching performance. The speed of EHMA is about 0.89-1,161 times faster than that of current matching algorithms. Even under real-life intense attack, EHMA still performs well.