Search

Nowadays, the number of Distributed Denial of Service (DDoS) attacks is growing rapidly. The aim of these type of attacks is to make the prominent and critical services unavailable for legitimate users. HTTP flooding is one of the most common DDoS attacks and because of its implementation in application layer, it is difficult to detect and prevent by the current defense mechanisms. This attack not only makes the web servers unavailable, but consumes the computational resources of the network equipment and congests communication links. Recently, the advent of Software Defined Networking (SDN) paradigm has enabled the network providers to detect and mitigate application layer DDoS attacks such as HTTP flooding. In this paper, we propose a defense mechanism named HTTPScout which leverages the benefits of SDN together with Machine Learning (ML) techniques to detect and mitigate HTTP flooding attack. HTTPScout is implemented as a security module in RYU controller and monitors the behavior of HTTP traffic flows. Upon detecting a malicious flow, it blocks the source of the attack at the edge switch and preserves the network resources from the adversarial effects of the attack. Simulation results confirm that HTTPScout brings a significant improvement of 64% in bandwidth consumption and 80% in the number of forwarding rules compared to normal SDN. [ABSTRACT FROM AUTHOR]

Several ongoing research efforts aim to design potential Future Internet Architectures, among which Named-Data Networking (NDN) introduces a shift from the existing host-centric Internet Protocol-based Internet infrastructure towards a content-oriented one. However, researchers have identified some design limitations in NDN, among which some enable to build up a new type of Distributed Denial of Service attack, better known as Interest Flooding Attack (IFA). In IFA, an adversary issues not satisfiable requests in the network to saturate the Pending Interest Table (PIT) of NDN routers and prevent them from properly handling the legitimate traffic. Researchers have been trying to mitigate this problem by proposing several detection and reaction mechanisms, but all the mechanisms proposed so far are not highly effective and, on the contrary, heavily damage the legitimate traffic. In this paper, we propose a novel mechanism for IFA detection and mitigation, aimed at decreasing the memory consumption of the PIT by effectively reducing the malicious traffic that passes through each NDN router. In particular, our protocol exploits an effective management strategy on the PIT, through which the Malicious Interest (MIs) already stored in the PIT are removed and the new incoming MIs are dropped. In addition, the proposed countermeasure provides an additional security wall on the edges of the network to detect and mitigate the attack as early as possible and improve the network health, i.e., routers PIT occupancy during IFA. To evaluate the effectiveness of our work, we implemented the proposed countermeasure on the open-source ndnSIM simulator and compared its effectiveness with the state of the art. The results show that our proposed countermeasure effectively reduces the IFA damages both in terms of preserved legitimate traffic and availability of routers PIT. Considering the legitimate traffic, the amount of Benign Interests preserved by our approach increases from 5% to 40% with respect to the preservation guaranteed by the state-of-the-art solutions. Concerning the routers PIT availability, our approach guarantees that the 97% of the PIT size is left free for handling the legitimate traffic. [ABSTRACT FROM AUTHOR]

A distributed denial of service (DDoS) attack on any of the major components (e.g., controller, switches, and southbound channel) of software defined networking (SDN) architecture is a critical security threat. For example, the breakdown of controller could disrupt the data communication in the whole SDN network. A possible way to perform DoS is to generate a large number of new, but short length traffic flows. These flows will trigger malicious flooding requests to overload the controller and causes overflow in flow tables at SDN switches. In this paper, we propose two lightweight and practically feasible countermeasures against two different types of DDoS attacks called Route Spoofing and Resource Exhaustion in SDN networks. For Route Spoofing attack, we introduce a technique called "selective blocking", which stops an adversary node from maliciously using other users active communication routes. To countermeasure Resource Exhaustion attack, we propose a solution called "periodic monitoring", which detects adversary nodes based on the traffic analysis statistics that are gathered within a time window. We implement and perform result analysis of the attacks and their proposed countermeasures. When using our proposed countermeasures in the target SDN scenarios, the simulation results indicate an adequate reduction in bandwidth consumption and processing delay of new request, and it also depicts substantial gain in packet delivery rate. Additionally, we present the receiver operating characteristic curve, which shows the sensitivity and specificity of our countermeasures along with their detection accuracy. [ABSTRACT FROM AUTHOR]

Cloud computing model provides on demand, elastic and fully managed computer system resources and services to organizations. However, attacks on cloud components can cause inestimable losses to cloud service providers and cloud users. One such category of attacks is the Distributed Denial of Service (DDoS), which can have serious consequences including impaired customer experience, service outage and in severe cases, complete shutdown and total economic unsustainability. Advances in Internet of Things (IoT) and network connectivity have inadvertently facilitated launch of DDoS attacks which have increased in volume, frequency and intensity. Recent DDoS attacks involving new attack vectors and strategies, have precipitated the need for this survey. In this survey, we mainly focus on finding the gaps, as well as bridging those gaps between the future potential DDoS attacks and state-of-the-art scientific and commercial DDoS attack defending solutions. It seeks to highlight the need for a comprehensive detection approach by presenting the recent threat landscape and major cloud attack incidents, estimates of future DDoS, illustrative use cases, commercial DDoS solutions, and the laws governing DDoS attacks in different nations. An up-to-date survey of DDoS detection methods, particularly anomaly based detection, available research tools, platforms and datasets, has been given. This paper further explores the use of machine learning methods for detection of DDoS attacks and investigates features, strengths, weaknesses, tools, datasets, and evaluates results of the methods in the context of the cloud. A summary comparison of statistical, machine learning and hybrid methods has been brought forth based on detailed analysis. This paper is intended to serve as a ready reference for the research community to develop effective and innovative detection mechanisms for forthcoming DDoS attacks in the cloud environment. It will also sensitize cloud users and providers to the urgent need to invest in deployment of DDoS detection mechanisms to secure their assets. • Provides up-to-date listing of major attack incidents on cloud infrastructure and gives observations on upcoming DDoS attacks in advance. • Provides a taxonomy based on the cloud component being attacked for cloud based DDoS attacks. • Presents a detailed taxonomy of anomaly based DDoS detection methods based on recent research works. • Enumerates alternative commercial DDoS solutions. • Depicts sample illustrative DDoS attack scenarios and discusses laws governing DDoS attacks in major nations. [ABSTRACT FROM AUTHOR]

In recent years, the explosive growth of the Internet has led to an increment in the number of Distributed Denial of Service (DDoS) attacks. HTTP Flooding is a critical DDoS attack that targets HTTP servers to prohibit users from receiving HTTP services. Moreover, it saturates the link bandwidth and consumes network resources. Because the attack is launched at the application layer, it is difficult to defend against it using current countermeasures such as firewall or Intrusion Prevention System (IPS). In this paper, we propose SHFD , which leverages the Software-Defined Networking (SDN) paradigm to mitigate HTTP flooding attacks. We implement SHFD as a defender module on the SDN controller to detect and mitigate the attack in the first place. Experimental results gathered from Mininet confirm that SHFD brings a significant improvement of 13% in detection time and 29% in the number of blocked malicious flows compared to the state-of-the-art approaches. [Display omitted] • SHFD is proposed for mitigating slow and high rate HTTP flooding attacks in SDN-based networks. • Shannon's Entropy and Hellinger distance methods are used in SHFD to provide more accurate results. • Both slow/high rate HTTP flooding attack together with their side effects are explained in details. [ABSTRACT FROM AUTHOR]

Recent Distributed Denial of Service (DDoS) attacks on cloud services demonstrate new attack effects, including collateral and economic losses. In this work, we show that DDoS mitigation methods may not provide the expected timely mitigation due to the heavy resource outage created by the attacks. We observe an important Operating System (OS) level “internal collateral damage”, in which the other critical services are also affected. We formulate the DDoS mitigation problem as an OS level resource management problem. We argue that providing extra resources to the victim’s server is only helpful if we can ensure the availability of other services. To achieve these goals, we propose a novel resource containment approach to enforce the victim’s resource limits. Our real-time experimental evaluations show that the proposed approach results in reduction in the attack reporting time and victim service downtime by providing isolated and timely resources to ensure availability of other critical services. [ABSTRACT FROM AUTHOR]