Cyber attacks are continuing to hamper working of Internet services despite increased use of network secu-rity systems such as firewalls and Intrusion protection systems (IPS). Recent Distributed Denial of Service (DD...Cyber attacks are continuing to hamper working of Internet services despite increased use of network secu-rity systems such as firewalls and Intrusion protection systems (IPS). Recent Distributed Denial of Service (DDoS) attacks on Dec 8th, 2010 by Wikileak supporters on Visa and Master Card websites made headlines on prime news channels all over the world. Another famous DDoS attacks on Independence Day weekend, on July 4th, 2009 were launched to debilitate the US and South Korean governments’ websites. These attacks raised questions about the capabilities of the security systems that were used in the network to counteract such attacks. Firewall and IPS security systems are commonly used today as a front line defense mechanism to defend against DDoS attacks. In many deployments, performances of these security devices are seldom evaluated for their effectiveness. Different security devices perform differently in stopping DDoS attacks. In this paper, we intend to drive the point that it is important to evaluate the capability of Firewall or IPS secu-rity devices before they are deployed to protect a network or a server against DDoS attacks. In this paper, we evaluate the effectiveness of a security device called Netscreen 5GT (or NS-5GT) from Juniper Networks under Layer-4 flood attacks at different attack loads. This security device NS-5GT comes with a feature called TCP-SYN proxy protection to protect against TCP-SYN based DDoS attacks, and UDP protection feature to protect against UDP flood attacks. By looking at these security features from the equipments data sheet, one might assume the device to protect the network against such DDoS attacks. In this paper, we con-ducted real experiments to measure the performance of this security device NS-5GT under the TCP SYN and UDP flood attacks and test the performance of these protection features. It was found that the Juniper’s NS-5GT mitigated the effect of DDoS traffic to some extent especially when the attack of lower intensity. However, the device was unable to provide any protection against Layer4 flood attacks when the load ex-ceeded 40Mbps. In order to guarantee a measured level of security, it is important for the network managers to measure the actual capabilities of a security device, using real attack traffic, before they are deployed to protect a critical information infrastructure.展开更多
The implementation of Countermeasure Techniques(CTs)in the context of Network-On-Chip(NoC)based Multiprocessor System-On-Chip(MPSoC)routers against the Flooding Denial-of-Service Attack(F-DoSA)falls under Multi-Criter...The implementation of Countermeasure Techniques(CTs)in the context of Network-On-Chip(NoC)based Multiprocessor System-On-Chip(MPSoC)routers against the Flooding Denial-of-Service Attack(F-DoSA)falls under Multi-Criteria Decision-Making(MCDM)due to the three main concerns,called:traffic variations,multiple evaluation criteria-based traffic features,and prioritization NoC routers as an alternative.In this study,we propose a comprehensive evaluation of various NoC traffic features to identify the most efficient routers under the F-DoSA scenarios.Consequently,an MCDM approach is essential to address these emerging challenges.While the recent MCDM approach has some issues,such as uncertainty,this study utilizes Fuzzy-Weighted Zero-Inconsistency(FWZIC)to estimate the criteria weight values and Fuzzy Decision by Opinion Score Method(FDOSM)for ranking the routers with fuzzy Single-valued Neutrosophic under names(SvN-FWZIC and SvN-FDOSM)to overcome the ambiguity.The results obtained by using the SvN-FWZIC method indicate that the Max packet count has the highest importance among the evaluated criteria,with a weighted score of 0.1946.In contrast,the Hop count is identified as the least significant criterion,with a weighted score of 0.1090.The remaining criteria fall within a range of intermediate importance,with enqueue time scoring 0.1845,packet count decremented and traversal index scoring 0.1262,packet count incremented scoring 0.1124,and packet count index scoring 0.1472.In terms of ranking,SvN-FDOSM has two approaches:individual and group.Both the individual and group ranking processes show that(Router 4)is the most effective router,while(Router 3)is the lowest router under F-DoSA.The sensitivity analysis provides a high stability in ranking among all 10 scenarios.This approach offers essential feedback in making proper decisions in the design of countermeasure techniques in the domain of NoC-based MPSoC.展开更多
Link flooding attack(LFA)is a type of covert distributed denial of service(DDoS)attack.The attack mechanism of LFAs is to flood critical links within the network to cut off the target area from the Internet.Recently,t...Link flooding attack(LFA)is a type of covert distributed denial of service(DDoS)attack.The attack mechanism of LFAs is to flood critical links within the network to cut off the target area from the Internet.Recently,the proliferation of Internet of Things(IoT)has increased the quantity of vulnerable devices connected to the network and has intensified the threat of LFAs.In LFAs,attackers typically utilize low-speed flows that do not reach the victims,making the attack difficult to detect.Traditional LFA defense methods mainly reroute the attack traffic around the congested link,which encounters high complexity and high computational overhead due to the aggregation of massive attack traffic.To address these challenges,we present an LFA defense framework which can mitigate the attack flows at the border switches when they are small in scale.This framework is lightweight and can be deployed at border switches of the network in a distributed manner,which ensures the scalability of our defense system.The performance of our framework is assessed in an experimental environment.The simulation results indicate that our method is effective in detecting and mitigating LFAs with low time complexity.展开更多
Mobile ad hoc networks are particularly vulnerable to denial of service （DOS） attacks launched through compromised nodes or intruders. In this paper, we present a new DOS attack and its defense in ad hoc networks. T...Mobile ad hoc networks are particularly vulnerable to denial of service （DOS） attacks launched through compromised nodes or intruders. In this paper, we present a new DOS attack and its defense in ad hoc networks. The new DOS attack, called AA hoc Flooding Attack（AHFA）, is that intruder broadcasts mass Route Request packets to exhaust the communication bandwidth and node resource so that the valid communication can not be kept. After analyzed AM hoc Flooding Attack, we develop Flooding Attack Prevention （FAP）, a genetic defense against the AM hoc Flooding Attack. When the intruder broadcasts exceeding packets of Route Request, the immediate neighbors of the intruder record the rate of Route Request. Once the threshold is exceeded, nodes deny any future request packets from the intruder. The results of our implementation show FAP can prevent the AM hoe Flooding attack efficiently.展开更多
Link flooding attack(LFA)is a fresh distributed denial of service attack(DDoS).Attackers can cut off the critical links,making the services in the target area unavailable.LFA manipulates legal lowspeed flow to flood c...Link flooding attack(LFA)is a fresh distributed denial of service attack(DDoS).Attackers can cut off the critical links,making the services in the target area unavailable.LFA manipulates legal lowspeed flow to flood critical links,so traditional technologies are difficult to resist such attack.Meanwhile,LFA is also one of the most important threats to Internet of things(IoT)devices.The introduction of software defined network(SDN)effectively solves the security problem of the IoT.Aiming at the LFA in the software defined Internet of things(SDN-IoT),this paper proposes a new LFA mitigation scheme ReLFA.Renyi entropy is to locate the congested link in the data plane in our scheme,and determines the target links according to the alarm threshold.When LFA is detected on the target links,the control plane uses the method based on deep reinforcement learning(DRL)to carry out traffic engineering.Simulation results show that ReLFA can effectively alleviate the impact of LFA in SDN IoT.In addition,the rerouting time of ReLFA is superior to other latest schemes.展开更多
Due to their characteristics of dynamic topology, wireless channels and limited resources, mobile ad hoc networks are particularly vulnerable to a denial of service （DoS） attacks launched by intruders. The effects o...Due to their characteristics of dynamic topology, wireless channels and limited resources, mobile ad hoc networks are particularly vulnerable to a denial of service （DoS） attacks launched by intruders. The effects of flooding attacks in network simulation 2 （NS2） and measured performance parameters are investigated, including packet loss ratio, average delay, throughput and average number of hops under different numbers of attack nodes, flooding frequency, network bandwidth and network size. Simulation results show that with the increase of the flooding frequency and the number of attack nodes, network performance sharply drops. But when the frequency of flooding attacks or the number of attack nodes is greater than a certain value, performance degradation tends to a stable value.展开更多
To improve the attack detection capability of content centric network(CCN),we propose a detection method of interest flooding attack(IFA)making use of the feature of self-similarity of traffic and the information entr...To improve the attack detection capability of content centric network(CCN),we propose a detection method of interest flooding attack(IFA)making use of the feature of self-similarity of traffic and the information entropy of content name of interest packet.On the one hand,taking advantage of the characteristics of self-similarity is very sensitive to traffic changes,calculating the Hurst index of the traffic,to identify initial IFA attacks.On the other hand,according to the randomness of user requests,calculating the information entropy of content name of the interest packets,to detect the severity of the IFA attack,is.Finally,based on the above two aspects,we use the bilateral detection method based on non-parametric CUSUM algorithm to judge the possible attack behavior in CCN.The experimental results show that flooding attack detection method proposed for CCN can not only detect the attack behavior at the early stage of attack in CCN,but also is more accurate and effective than other methods.展开更多
移动自组网(Mobile Ad Hoc Networks,MANETs)所面临的Flooding攻击是一种严重DOS攻击行为。然而,现有的针对Flooding攻击的防范技术因不能较好地适应MANETs特性(如有限资源、动态拓扑等)而难以在MANETs网络性能和网络安全之间保持平衡...移动自组网(Mobile Ad Hoc Networks,MANETs)所面临的Flooding攻击是一种严重DOS攻击行为。然而,现有的针对Flooding攻击的防范技术因不能较好地适应MANETs特性(如有限资源、动态拓扑等)而难以在MANETs网络性能和网络安全之间保持平衡。通过分析移动自组网的时空动态性、网络性能评估与Flooding安全威胁之间的内在关系,提出了一种基于性能评估的Flooding攻击防御技术。通过构建可量化的MANETs安全威胁、防御收益与代价的评估指标体系,实现了基于网络安全和性能平衡的防御及其性能优化方法。仿真实验结果表明,所提出的防御技术可有效地弥补现有移动自组网安全技术存在的一些缺陷,因而能够满足移动自组网特性且适合于实际应用。展开更多
文摘Cyber attacks are continuing to hamper working of Internet services despite increased use of network secu-rity systems such as firewalls and Intrusion protection systems (IPS). Recent Distributed Denial of Service (DDoS) attacks on Dec 8th, 2010 by Wikileak supporters on Visa and Master Card websites made headlines on prime news channels all over the world. Another famous DDoS attacks on Independence Day weekend, on July 4th, 2009 were launched to debilitate the US and South Korean governments’ websites. These attacks raised questions about the capabilities of the security systems that were used in the network to counteract such attacks. Firewall and IPS security systems are commonly used today as a front line defense mechanism to defend against DDoS attacks. In many deployments, performances of these security devices are seldom evaluated for their effectiveness. Different security devices perform differently in stopping DDoS attacks. In this paper, we intend to drive the point that it is important to evaluate the capability of Firewall or IPS secu-rity devices before they are deployed to protect a network or a server against DDoS attacks. In this paper, we evaluate the effectiveness of a security device called Netscreen 5GT (or NS-5GT) from Juniper Networks under Layer-4 flood attacks at different attack loads. This security device NS-5GT comes with a feature called TCP-SYN proxy protection to protect against TCP-SYN based DDoS attacks, and UDP protection feature to protect against UDP flood attacks. By looking at these security features from the equipments data sheet, one might assume the device to protect the network against such DDoS attacks. In this paper, we con-ducted real experiments to measure the performance of this security device NS-5GT under the TCP SYN and UDP flood attacks and test the performance of these protection features. It was found that the Juniper’s NS-5GT mitigated the effect of DDoS traffic to some extent especially when the attack of lower intensity. However, the device was unable to provide any protection against Layer4 flood attacks when the load ex-ceeded 40Mbps. In order to guarantee a measured level of security, it is important for the network managers to measure the actual capabilities of a security device, using real attack traffic, before they are deployed to protect a critical information infrastructure.
文摘The implementation of Countermeasure Techniques(CTs)in the context of Network-On-Chip(NoC)based Multiprocessor System-On-Chip(MPSoC)routers against the Flooding Denial-of-Service Attack(F-DoSA)falls under Multi-Criteria Decision-Making(MCDM)due to the three main concerns,called:traffic variations,multiple evaluation criteria-based traffic features,and prioritization NoC routers as an alternative.In this study,we propose a comprehensive evaluation of various NoC traffic features to identify the most efficient routers under the F-DoSA scenarios.Consequently,an MCDM approach is essential to address these emerging challenges.While the recent MCDM approach has some issues,such as uncertainty,this study utilizes Fuzzy-Weighted Zero-Inconsistency(FWZIC)to estimate the criteria weight values and Fuzzy Decision by Opinion Score Method(FDOSM)for ranking the routers with fuzzy Single-valued Neutrosophic under names(SvN-FWZIC and SvN-FDOSM)to overcome the ambiguity.The results obtained by using the SvN-FWZIC method indicate that the Max packet count has the highest importance among the evaluated criteria,with a weighted score of 0.1946.In contrast,the Hop count is identified as the least significant criterion,with a weighted score of 0.1090.The remaining criteria fall within a range of intermediate importance,with enqueue time scoring 0.1845,packet count decremented and traversal index scoring 0.1262,packet count incremented scoring 0.1124,and packet count index scoring 0.1472.In terms of ranking,SvN-FDOSM has two approaches:individual and group.Both the individual and group ranking processes show that(Router 4)is the most effective router,while(Router 3)is the lowest router under F-DoSA.The sensitivity analysis provides a high stability in ranking among all 10 scenarios.This approach offers essential feedback in making proper decisions in the design of countermeasure techniques in the domain of NoC-based MPSoC.
基金supported in part by the National Key R&D Program of China under Grant 2018YFA0701601in part by the National Natural Science Foundation of China(Grant No.62201605,62341110,U22A2002)in part by Tsinghua University-China Mobile Communications Group Co.,Ltd.Joint Institute。
文摘Link flooding attack(LFA)is a type of covert distributed denial of service(DDoS)attack.The attack mechanism of LFAs is to flood critical links within the network to cut off the target area from the Internet.Recently,the proliferation of Internet of Things(IoT)has increased the quantity of vulnerable devices connected to the network and has intensified the threat of LFAs.In LFAs,attackers typically utilize low-speed flows that do not reach the victims,making the attack difficult to detect.Traditional LFA defense methods mainly reroute the attack traffic around the congested link,which encounters high complexity and high computational overhead due to the aggregation of massive attack traffic.To address these challenges,we present an LFA defense framework which can mitigate the attack flows at the border switches when they are small in scale.This framework is lightweight and can be deployed at border switches of the network in a distributed manner,which ensures the scalability of our defense system.The performance of our framework is assessed in an experimental environment.The simulation results indicate that our method is effective in detecting and mitigating LFAs with low time complexity.
基金This project was supported by the National"863"High Technology Development Programof China (2003AA148010) Key Technologies R&D Programof China (2002DA103A03 -07)
文摘Mobile ad hoc networks are particularly vulnerable to denial of service （DOS） attacks launched through compromised nodes or intruders. In this paper, we present a new DOS attack and its defense in ad hoc networks. The new DOS attack, called AA hoc Flooding Attack（AHFA）, is that intruder broadcasts mass Route Request packets to exhaust the communication bandwidth and node resource so that the valid communication can not be kept. After analyzed AM hoc Flooding Attack, we develop Flooding Attack Prevention （FAP）, a genetic defense against the AM hoc Flooding Attack. When the intruder broadcasts exceeding packets of Route Request, the immediate neighbors of the intruder record the rate of Route Request. Once the threshold is exceeded, nodes deny any future request packets from the intruder. The results of our implementation show FAP can prevent the AM hoe Flooding attack efficiently.
基金supported by the Fundamental Research Funds under Grant 2021JBZD204ZTE industry-university research cooperation fund project “Research on network identity trusted communication technology architecture”State Key Laboratory of Mobile Network and Mobile Multimedia Technology
文摘Link flooding attack(LFA)is a fresh distributed denial of service attack(DDoS).Attackers can cut off the critical links,making the services in the target area unavailable.LFA manipulates legal lowspeed flow to flood critical links,so traditional technologies are difficult to resist such attack.Meanwhile,LFA is also one of the most important threats to Internet of things(IoT)devices.The introduction of software defined network(SDN)effectively solves the security problem of the IoT.Aiming at the LFA in the software defined Internet of things(SDN-IoT),this paper proposes a new LFA mitigation scheme ReLFA.Renyi entropy is to locate the congested link in the data plane in our scheme,and determines the target links according to the alarm threshold.When LFA is detected on the target links,the control plane uses the method based on deep reinforcement learning(DRL)to carry out traffic engineering.Simulation results show that ReLFA can effectively alleviate the impact of LFA in SDN IoT.In addition,the rerouting time of ReLFA is superior to other latest schemes.
基金supported by the National Natural Science Foundation of China (60932003)the National High Technology Research and Development Program of China (863 Program)(2007AA01Z452+2 种基金 2009AA01Z118)Shanghai Municipal Natural Science Foundation (09ZR1414900)The National Undergraduate Innovative Test Program(091024812)
文摘Due to their characteristics of dynamic topology, wireless channels and limited resources, mobile ad hoc networks are particularly vulnerable to a denial of service （DoS） attacks launched by intruders. The effects of flooding attacks in network simulation 2 （NS2） and measured performance parameters are investigated, including packet loss ratio, average delay, throughput and average number of hops under different numbers of attack nodes, flooding frequency, network bandwidth and network size. Simulation results show that with the increase of the flooding frequency and the number of attack nodes, network performance sharply drops. But when the frequency of flooding attacks or the number of attack nodes is greater than a certain value, performance degradation tends to a stable value.
基金This work was supported by the National Natural Science Foundation of China No.61672101the Beijing Key Laboratory of Internet Culture and Digital Dissemination Research(ICDDXN004)Key Lab of Information Network Security,Ministry of Public Security,No.C18601.
文摘To improve the attack detection capability of content centric network(CCN),we propose a detection method of interest flooding attack(IFA)making use of the feature of self-similarity of traffic and the information entropy of content name of interest packet.On the one hand,taking advantage of the characteristics of self-similarity is very sensitive to traffic changes,calculating the Hurst index of the traffic,to identify initial IFA attacks.On the other hand,according to the randomness of user requests,calculating the information entropy of content name of the interest packets,to detect the severity of the IFA attack,is.Finally,based on the above two aspects,we use the bilateral detection method based on non-parametric CUSUM algorithm to judge the possible attack behavior in CCN.The experimental results show that flooding attack detection method proposed for CCN can not only detect the attack behavior at the early stage of attack in CCN,but also is more accurate and effective than other methods.
文摘移动自组网(Mobile Ad Hoc Networks,MANETs)所面临的Flooding攻击是一种严重DOS攻击行为。然而,现有的针对Flooding攻击的防范技术因不能较好地适应MANETs特性(如有限资源、动态拓扑等)而难以在MANETs网络性能和网络安全之间保持平衡。通过分析移动自组网的时空动态性、网络性能评估与Flooding安全威胁之间的内在关系,提出了一种基于性能评估的Flooding攻击防御技术。通过构建可量化的MANETs安全威胁、防御收益与代价的评估指标体系,实现了基于网络安全和性能平衡的防御及其性能优化方法。仿真实验结果表明,所提出的防御技术可有效地弥补现有移动自组网安全技术存在的一些缺陷,因而能够满足移动自组网特性且适合于实际应用。
