NETWORK BEHAVIOR MONITORING AND ANALYSIS FOR DETECTION AND RESISTANCE OF DENIAL OF SERVICE ATTACKS

Abstract

Denial of Service (DoS) attacks is one category of internet threats
that can cause significant loss of time and revenue[1]. With many ready to
use tools available for creating Trojans, Viruses and Worms, it even
doesn’t require any programming expertise to launch a DoS kind of
attack. Accounting on certain vulnerabilities that exist in TCP/IP protocol,
a DoS attack can be launched in a variety of ways. This includes largely
flooding and Logical attacks. While flooding is about sending large
quantities of legitimate commands to overwhelm the receiver, Logic
attacks take advantage of and manipulate particular values of Header
fields. This paper studies DoS attacks, by launching them first in a
networked scenario and then demonstrating their effect. Then it develops a
Host Based Intrusion Detection System (HIDS) to handle this kind of
attacks on a single host. The HIDS works by taking following steps. It
first tries to prevent the attack by Ingress filtering that is done on the basis
of rules already defined. If in some cases some false positives let the
illegitimate traffic pass through the filter, a detection scheme is there in
place. Once an attack is detected, measures are taken to mitigate the effect
of the current attack, and necessary updating is done to prevent such kind
of attack in future. The results obtained clearly demonstrate the effects of
attack and also demonstrate the way it is mitigated.