The Defense Mechanism Against Ddos Attacks

The big item in the news lately from a cyber security standpoint has been Distributed Denial of Service (DDoS) attacks, their frequency and size being the two big sticking points for the media. The one thing that the media tends not to do is explain what a DDoS is, what attack vector was used, realistically all the information that leads to a clear picture of what really happened during the attack. With that this paper will explain the process from beginning to end of a DDoS attack in a way that is easy to understand and hopefully debunks a lot of the misconceptions about DDoS that have been posted in class discussion.

KDDCup99 dataset was introduced at the Third International Knowledge Discovery and Data Mining Tools Competition which was held by DARPA in 1999 .KDDCup99 is a refined data set from DARPA 1998 dataset as it contains only network data[3]. KDDCup99 is commonly used developers and implementers of new IDS to evaluate their systems. IDS systems take the KDDCup99 dataset as an input to train ,test the system and check performance of the IDS in classifying and detecting attack records. KDDCup99 dataset is used by most researchers because it contains 22 different attack types which could be classified into four main attack categories of the network discussed in the previous section. The full DARPA dataset consists of relatively 4,900,000 lines of connection vectors where each single connection vectors consists of 41 features and is marked as either normal or an attack, with exactly one particular attack type [38]. Among the 41 features of the connection, only sixteen significant attributes are considered which are: A1,A5,A6,A8, A9, A10, A11, A13, A16, A17, A18, A19, A23, A24, A32, A33[38] The KDD 99

After that, it uses the concept of Bloom filter. Bloom filter is a data structure used to test whether an element is a member of a given set or not. It has a two-dimensional bin table of k levels by m bins with k independent hash functions. It is used to keep track of the recent arrival rates of packets of different destination IP addresses passing through a router within a sampling period t as shown in fig. 4.2. In proposed system, it stores the IP address in data structure and checks it on the behalf of misuse detection method. Once whole of the information is derived, the complete data is analyzed statistically by using association between the nodes respective to the current node.

Denial-of-Service attack (DoS) when a hacker continuously attacks a particular network or dedicated Access Point (AP) with fake requests, failure messages and premature successful connection messages and other commands. These causes authorized users from preventing connecting to the network and results in network failure or crash. These attacks depends on misuse of protocols like Extensible Authentication Protocol (EAP).

DNS is critical in the footprinting of a target network. It can sometimes save the attacker a lot of time, or at least corroborate other information that has been gathered. DNS is also a target for several types of attack.

Imagine that you get home from a hard day at work or school, have a bite to eat, and then sit at your computer. After you've checked your e-mail, you're ready to play an online game. Excitement begins to build, but then you notice your browser was denied access to your network, preventing you from connecting to the Internet. In desperation, you turn your computer's power off and restart it. After the reboot, your computer still cannot reach any networked service. Since only your computer was involved, you think it may be a Denial of Service attack. However, days later you learn that the attack you experienced was a Distributed Denial of Service, an attack involving numerous computers that flooded the game servers and prevented anyone from gaining

Denial of service cyberattacks are attacks on websites that make them inaccessible to normal people. While a lot of cyberattacks are used to steal information, denial of service attacks don’t try to. Instead, they try to make website servers unavailable and in some cases, they are “used as a smokescreen for other malicious activities,” like trying to take down firewalls. A successful denial of service attack impacts a very large number of people, so hackers and other people like to use this to send messages to the public. Denial of Service attacks can last for months; this makes them very dangerous for online businesses. They make companies lose money and customers and inconvenience everyday users. These reasons are

These proposals and systems suggestions can minimize the vulnerabilities associated with any compromises or intrusions within the network. Deploying an intrusion detection system is an essential security strategy for monitoring a network information system for abnormal or authorized activity. An intrusion detection system (IDS) is set of tools which monitor a network topology by providing a system administrator with the overall picture of how the system is being utilized. Executing an IDS will make a difference in creating a defense in depth architecture to be more compelling in recognizing any form of malicious activities. The capacity of the IDS is to monitor and survey the network traffic without affecting network activity. IDS tools gather information and analyzes it against a pre-characterized manage set, and against a set of known assault 'marks'. The IDS can scan port numbers and to determine if any breaches or attacks are occurring (Kuipers,

Denial of service attacks are an attempt to make a network resource or a machine unavailable to its legit users by continuous efforts of disrupt the services of a host connected to the Internet.

Distributed denial of service attack is a coordinated denial of service attack against a computer or network that occurs from multiple sources and locations to halt or disrupt legitimate use of its resources. Denial of service attack may affects software systems, network, routers, equipment, servers, and personal PCs. In distributed denial of service attack, a master program scans remote machines to find security holes. Once vulnerable hosts are exploited and injected with malicious code, the agents initiate the attack to infect further machines using client/server technology. A number of denial of service attacks include Network Level Service which affects routers, IP switches, and firewall, OS Level which affects equipment vendor OS, and

When a denial-of-service attack is launched, the cyber-criminal can also choose to deny authorized users’ access or limit their access by creating

Alternative type of attack is called a Distributed Denial of Service (DDoS) attack. DDoS attacks are launched form numerous linked devices that are spread across the Internet. They are commonly harder to deflect, because of their sheer volume of devices involved. Unlike DoS attacks, DDoS assaults be apt to target the system infrastructure in an effort to drench it with huge volumes of traffic.

The organization needs to systematically lower risks inherent in network to efficiently minimize the cost in the neutralization of attacks as a strategy. The action focuses on improving the systems as it broadly examines all the facets that may come in after eradication. Besides, improving system administration, countering the threats, improving the DDOS defenses, blocking the material that exposes the attack are keys to the realization of a reduced cost in

The goal of intrusion detection is to monitor network assets, detect anomalous behavior, and identify misuse within a network (Ashoor, Gore, 2011). An intrusion detection system (IDS) is a device or software application that monitors network system activities for malicious activity or policy violations and produces reports to a management station (Kashyap, Agrawal, Pandey, Keshri, 2013), additionally there are three types of IDS:

Denial of service attacks (DoS)- A denial of service attack attempts to put the condition will often times try to compromise many PC’s, and use them to “amplify” the attack volume, and to hide his or her tracks as well. This is called a Distributed Denial of Service Attack (DDoS). Denial of service attacks have now become a well-known criminal activity. In an online form of the “protection racket” (pay us some protection money or we’ll ruin your business), computer criminals have taken to