The Defense Mechanism Against Ddos Attacks

KDDCup99 dataset was introduced at the Third International Knowledge Discovery and Data Mining Tools Competition which was held by DARPA in 1999 .KDDCup99 is a refined data set from DARPA 1998 dataset as it contains only network data[3]. KDDCup99 is commonly used developers and implementers of new IDS to evaluate their systems. IDS systems take the KDDCup99 dataset as an input to train ,test the system and check performance of the IDS in classifying and detecting attack records. KDDCup99 dataset is used by most researchers because it contains 22 different attack types which could be classified into four main attack categories of the network discussed in the previous section. The full DARPA dataset consists of relatively 4,900,000 lines of connection vectors where each single connection vectors consists of 41 features and is marked as either normal or an attack, with exactly one particular attack type [38]. Among the 41 features of the connection, only sixteen significant attributes are considered which are: A1,A5,A6,A8, A9, A10, A11, A13, A16, A17, A18, A19, A23, A24, A32, A33[38] The KDD 99

Abstract: Providing security in a distributed system is important as cloud computing provides variety of convenient services. IDS implementation in cloud requires an efficient, scalable and a constructive approach. Many Network-based intrusion detection systems(NIDS) are used for the reception of packets from the cloud, but those systems possess lower detection rate, high false positive rate and they fail to resist single point attack. I would like to propose one method which I encountered and found out to be efficient compared to other methods. This unique model has multiple intrusion detection systems (IDSs) that are deployed in each layer of the cloud infrastructure for protecting each Virtual Machine against threats. Another catching feature is that of cloud alliance concept which exchanges mutual alerts to resist the single point attack of failure.

After that, it uses the concept of Bloom filter. Bloom filter is a data structure used to test whether an element is a member of a given set or not. It has a two-dimensional bin table of k levels by m bins with k independent hash functions. It is used to keep track of the recent arrival rates of packets of different destination IP addresses passing through a router within a sampling period t as shown in fig. 4.2. In proposed system, it stores the IP address in data structure and checks it on the behalf of misuse detection method. Once whole of the information is derived, the complete data is analyzed statistically by using association between the nodes respective to the current node.

* The Intrusion Detection System (IDS) provides the network with a level of preventive security against any suspicious activity. The IDS achieves this objective through early warnings aimed at systems administrators. However, unlike IPS, it is not designed to block attacks.

Denial-of-Service attack (DoS) when a hacker continuously attacks a particular network or dedicated Access Point (AP) with fake requests, failure messages and premature successful connection messages and other commands. These causes authorized users from preventing connecting to the network and results in network failure or crash. These attacks depends on misuse of protocols like Extensible Authentication Protocol (EAP).

Imagine that you get home from a hard day at work or school, have a bite to eat, and then sit at your computer. After you've checked your e-mail, you're ready to play an online game. Excitement begins to build, but then you notice your browser was denied access to your network, preventing you from connecting to the Internet. In desperation, you turn your computer's power off and restart it. After the reboot, your computer still cannot reach any networked service. Since only your computer was involved, you think it may be a Denial of Service attack. However, days later you learn that the attack you experienced was a Distributed Denial of Service, an attack involving numerous computers that flooded the game servers and prevented anyone from gaining

The Intrusion Detection System (IDS) is a protection scheme which collect and analyze audit data for the entire network.

Denial of service cyberattacks are attacks on websites that make them inaccessible to normal people. While a lot of cyberattacks are used to steal information, denial of service attacks don’t try to. Instead, they try to make website servers unavailable and in some cases, they are “used as a smokescreen for other malicious activities,” like trying to take down firewalls. A successful denial of service attack impacts a very large number of people, so hackers and other people like to use this to send messages to the public. Denial of Service attacks can last for months; this makes them very dangerous for online businesses. They make companies lose money and customers and inconvenience everyday users. These reasons are

When a denial-of-service attack is launched, the cyber-criminal can also choose to deny authorized users’ access or limit their access by creating

Denial of Service (DoS) attack is a very common cyber menace that renders websites and other online means inaccessible to intended users. There are various types of DoS threats and nearly all directly target the core server structure. Others abuse weaknesses in application and communication proprieties. DoS is also used as a cover-up for other wicked actions, and to take down security applications like web firewalls. A prosperous DoS attack is very obvious and impacts the entire online user base.

The organization needs to systematically lower risks inherent in network to efficiently minimize the cost in the neutralization of attacks as a strategy. The action focuses on improving the systems as it broadly examines all the facets that may come in after eradication. Besides, improving system administration, countering the threats, improving the DDOS defenses, blocking the material that exposes the attack are keys to the realization of a reduced cost in

Denial of Service attack (DoS attack) are attacks making the computer unusable and the programs unavailable as systems flood a user’s bandwidth Historically, a computer system is overloaded with false requests and data, causing the system to go into shock and crash. The multiple attacks from different IP addresses, sometimes thousands, making it hard for the computer to pinpoint the source. Used in large and layered networks, using multi-threaded OSI layered attacks and a pre-scanned reconnaissance usually disguised as legitimate traffic, the malware infiltrates databases and destroys resources. Causing the unavailability of websites and/or dramatically slow processing. The first known use of DoS attack was done by Khan Smith in 1997,

The goal of intrusion detection is to monitor network assets, detect anomalous behavior, and identify misuse within a network (Ashoor, Gore, 2011). An intrusion detection system (IDS) is a device or software application that monitors network system activities for malicious activity or policy violations and produces reports to a management station (Kashyap, Agrawal, Pandey, Keshri, 2013), additionally there are three types of IDS:

The big item in the news lately from a cyber security standpoint has been Distributed Denial of Service (DDoS) attacks, their frequency and size being the two big sticking points for the media. The one thing that the media tends not to do is explain what a DDoS is, what attack vector was used, realistically all the information that leads to a clear picture of what really happened during the attack. With that this paper will explain the process from beginning to end of a DDoS attack in a way that is easy to understand and hopefully debunks a lot of the misconceptions about DDoS that have been posted in class discussion.

On January 12th, 2007 at 4:31am, Bob Turley, CIO of the iPremier Company, received a panicked phone call from his IT operations staff. Their external facing website was “locked up” and could not be accessed by anyone, including their customers. iPremier is a web-based business that generates revenue through solely processing online orders. While the web server was down, the company could not accept any new orders or allow their customers to view their products. An inadequately third-party managed and configured router/firewall allowed hackers to execute a DOS (Denial of Service) attack on iPremier. I recommend purchasing a new firewall solution that will be managed and configured by the Company’s IT staff internally. This