doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> INCIDENTS, TYPES AND MOTIVES <s> Attackers can render distributed denial-of-service attacks more difficult to defend against by bouncing their flooding traffic off of reflectors; that is, by spoofing requests from the victim to a large set of Internet servers that will in turn send their combined replies to the victim. The resulting dilution of locality in the flooding stream complicates the victim's abilities both to isolate the attack traffic in order to block it, and to use traceback techniques for locating the source of streams of packets with spoofed source addresses, such as ITRACE [Be00a], probabilistic packet marking [SWKA00], [SP01], and SPIE [S+01]. We discuss a number of possible defenses against reflector attacks, finding that most prove impractical, and then assess the degree to which different forms of reflector traffic will have characteristic signatures that the victim can use to identify and filter out the attack traffic. Our analysis indicates that three types of reflectors pose particularly significant threats: DNS and Gnutella servers, and TCP-based servers (particularly Web servers) running on TCP implementations that suffer from predictable initial sequence numbers. We argue in conclusion in support of "reverse ITRACE" [Ba00] and for the utility of packet traceback techniques that work even for low volume flows, such as SPIE. <s> BIB001 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> INCIDENTS, TYPES AND MOTIVES <s> Defenses against flooding distributed denial-of-service (DDoS) commonly respond to the attack by dropping the excess traffic, thus reducing the overload at the victim. The major challenge is the differentiation of the legitimate from the attack traffic, so that the dropping policies can be selectively applied. We propose D-WARD, a source-end DDoS defense system that achieves autonomous attack detection and surgically accurate response, thanks to its novel traffic profiling techniques, the adaptive response and the source-end deployment. Moderate traffic volumes seen near the sources, even during the attacks, enable extensive statistics gathering and profiling, facilitating high response selectiveness. D-WARD inflicts an extremely low collateral damage to the legitimate traffic, while quickly detecting and severely rate-limiting outgoing attacks. D-WARD has been extensively evaluated in a controlled testbed environment and in real network operation. Results of selected tests are presented in the paper. <s> BIB002 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> INCIDENTS, TYPES AND MOTIVES <s> Suddenly your Web server becomes unavailable. When you investigate, you realize that a flood of packets is surging into your network. You have just become one of the hundreds of thousands of victims of a denial-of-service attack, a pervasive and growing threat to the Internet. What do you do?Internet Denial of Service sheds light on a complex and fascinating form of computer attack that impacts the confidentiality, integrity, and availability of millions of computers worldwide. It tells the network administrator, corporate CTO, incident responder, and student how DDoS attacks are prepared and executed, how to think about DDoS, and how to arrange computer and network defenses. It also provides a suite of actions that can be taken before, during, and after an attack.Inside, you'll find comprehensive information on the following topics How denial-of-service attacks are waged How to improve your network's resilience to denial-of-service attacks What to do when you are involved in a denial-of-service attack The laws that apply to these attacks and their implications How often denial-of-service attacks occur, how strong they are, and the kinds of damage they can cause Real examples of denial-of-service attacks as experienced by the attacker, victim, and unwitting accomplicesThe authors' extensive experience in handling denial-of-service attacks and researching defense approaches is laid out clearly in practical, detailed terms. <s> BIB003 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> INCIDENTS, TYPES AND MOTIVES <s> Denial of Service attacks are one of the major type of problems in the computer network security. Because they include many other type of attacks they are one of the most frequently used attack methods.. In general, DoS attacks are used to block access to the computer networks or personal computers. SYN flooding attack is the most widespread of the DoS attacks. In these attacks normal SYN packets can not be distinguished from the SYN attack packets. In this paper, we propose a fuzzy logic based system for detecting SYN flooding attacks. Performance of the proposed system has been compared with Cumulative Sum (CUSUM) algorithm. The simulation results show that the proposed system has better performance for low and high intensity attacks than the CUSUM algorithm. <s> BIB004 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> INCIDENTS, TYPES AND MOTIVES <s> A Distributed denial of service (DDoS) attack uses multiple machines operating in concern to attack a network or site. It is the most important security problem for IT managers. These attacks are very simple organized for intruders and hence so disruptive. The detection and defense of this attack has specific importance among network specialists. In this paper a new and smart taxonomy of DDoS attack and defense mechanism will be introduced. The attacks taxonomy is introduced using both known and potential attack mechanisms. It comprises all types of attacks and provides a comprehensive point of view for DDoS attacks. We introduce a useful tool that can be employed to a sophisticated selection defense method for DDoS attacks. Furthermore a smart taxonomy method of DDOS attacks will be proposed to help selection an appropriate defense mechanism. This method uses some features of DDOS attacks and classifies it to several clusters by Kmean algorithm and labels each cluster with a defense mechanism. If an IDS detects a DDOS attack, proposed system extract attack features and classify it by KNN (K-Nearest-Neighbor) to determine the cluster in which it belongs to. The defense mechanisms taxonomy is using the currently known approaches. Also the comprehensive defense classification will help to find the appropriate strategy to overcome the DDoS attack. <s> BIB005
Although DoS attacks existed during the 1980s and early 1990s, at the beginning they were not viewed as high-profile security incidents by the general public. This perception started to change as the Internet was becoming a mainstream medium. In this section, we present a timeline of the most notable DoS incidents, followed by a brief description of each new type of attack used at each incident. In September 1996, a "SYN Flood" DoS attack took the New York City Internet service provider Panix off-line for a week, while subsequent attacks disabled the web servers of the Internet Chess Club and The New York Times. Two months later, the first commercial product specifically designed for DoS attacks was released  . It detected attacks by watching for incoming SYN packets, and responded by resetting the connections if the victim computer received traffic at rate higher than a certain threshold. However, it failed to halt an attack on Webcom's main server which knocked thousands of commercial websites off-line. The attacker had randomised the IP addresses and the attack rate was 200 packets/sec, which was very high at the time. In "SYN Flood" attacks, the attacking system sends SYN messages to the victim server system that appear to be legitimate but in fact reference a client system that is unable to respond to the SYN/ACK messages. This means that the final ACK message will never be sent to the victim server system and due to the many half-open connections, the victim server system becomes eventually unable to accept any new incoming connections BIB004 . In January 1997, a teenager attacked the IRC network Undernet and several ISPs in Norway, Romania, the United Kingdom and the United States, with a combination of "ping" and "SYN Flood" attacks. At each stop, he logged onto the server, obtained root access, then deleted files and cancelled accounts. The "ping attack" is one of the simplest DoS attacks, where the victim is flooded with more TCP/ICMP packets than it can handle. In "IRC-based DDoS attacks", an IRC communication channel is used to connect the client to the agents. The attackers can use legitimate IRC ports for sending commands to the agents, which makes their tracking more difficult, because IRC servers tend to receive large volumes of traffic. The attacker no longer needs to maintain a list of agents, since she can simply log on to the IRC server and see a list of all available agents. The agent software installed in the IRC network usually communicates with the IRC channel and notifies the attacker when the agent is up and running. IRC networks also provide for easy file sharing, which is one of the passive methods of agent code distribution and an easy way for attackers to secure secondary victims to participate in their attacks BIB002 . In January 1998, DALnet and other IRC networks became targets of "smurfing", where the attacker is using ICMP echo request packets directed to IP broadcast addresses from remote locations to generate DoS attacks. There are three parties in these attacks: the attacker, the intermediary, and the victim. The intermediary receives an ICMP echo request packet directed to the IP broadcast address of their network. If the intermediary does not filter ICMP traffic directed to IP broadcast addresses, many of the machines on the network will receive this ICMP echo request packet and send an ICMP echo reply packet back. When all the machines on a network respond to this ICMP echo request, the result can be severe network congestion and outages. When the attackers create these packets, they do not use the IP address of their own machine as the source address. Instead, they create forged packets that contain the source address of the attacker's intended victim. The result is that when all the machines at the intermediary's site respond to the ICMP echo requests, they send replies to the victim's machine, which is overwhelmed by the amount of traffic BIB005 . Similar is the "fraggle" attack, which uses UDP packets instead of ICMP echo packets. During the same period, the Pentagon, NASA, several American military network systems and hundreds of universities were targeted in a series of DoS attacks launched by a single individual, a teenager from Israel. The hacker used mainly "Teardrop" and "Bonk" techniques, which exploited known vulnerabilities of the Microsoft Windows operating systems, and succeeded against those computers that were not up to date with the latest security patches. "Teardrop" attacks exploit the fact that the Internet Protocol requires fragmentation of the packets that are too large for the next router to handle. Each fragmented packet identifies an offset to the beginning of the first packet that enables the entire packet to be reassembled by the receiving system. In the teardrop attack, the attacker puts a confusing value in the second or later fragment, and if the receiving operating system cannot cope with such fragmentation then it may crash. Ironically, a month after the release of the relative patch by Microsoft, a new variety of Teardrop emerged, "Bonk", which worked specifically on a vulnerability created by this patch. BT, BTInternet and Gameplay were attacked in July 2000 by a frustrated anonymous customer, as revenge for bad service. This was the first of many DoS attacks used as a form of protest. In January 2001, a new type of attack appeared, which reached the rate of 90 Mbps against Register.com BIB003 . A few months later Paxson et al. published the first and definitive paper on the analysis of that new type BIB001 , which took the name Distributed Reflector (DRDoS). The concept of the "Distributed Reflector DoS attack" is very similar to that of the "Smurf" attack. The attacker orders his army of compromised computers to send connection requests to several perfectly legitimate computers, but using the victim's IP as the source in their packets. When the legitimate computers reply to these requests, the receiver of all is the victim. The most famous network security incident of 2001 was a computer worm of Chinese origin, known as "Code Red", which swept through 250,000 computers in nine hours, with the infected computers being programmed to simultaneously launch a DoS attack against the website of the White House. The White House was forced to change its numerical IP Web address and prompted the Pentagon to take its public Websites temporarily off-line. The damage inflicted by "Code Red" was estimated at about $2.6 billion. Also in 2001, a British teenager was accused of launching a DDoS attack on the Port of Houston's IT systems, which rendered the Port's web service inaccessible for several hours. The attack was allegedly aimed at a chatroom user, and the Port's computers were only used as intermediaries. The teenager claimed that his computer could have been taken over by a hacker using a Trojan Horse program and he was found not guilty. The affected server contained crucial data on navigation, tides, water depths and weather. This was the first known occasion where part of a country's national infrastructure was disabled by an electronic attack. In June 2002, the Website of the government of Pakistan was the victim of a politically motivated attack launched by Indian hackers that used "YAHA", a worm with Denial of Service payload. Similarly to "Code Red", "YAHA" caused an infected computer to make repeated connection attempts to the Pakistani government's website and attempted to terminate antivirus and firewall software. In October 2002, the DNS root servers 1 were under attack for about an hour, with several becoming unavailable for regular Internet traffic. The remaining root servers withstood the attack and ensured that the Internet's overall performance was not degraded significantly. Although it was hardly noticeable to the average end-user, this was the most serious hacker attack ever attempted on a key piece of the Internet infrastructure. A year later most of the root servers had applied a new routing technique known as Anycast, with which several operators are replicating these servers around the world. As a result, in February 2007, when hackers targeted again the DNS system of the Internet, including the Internet Corporation for Assigned Names and Numbers (ICANN) and UltraDNS, there was not a single point of failure caused by the attack. In January 2003, yet another worm with DoS payload appeared to cause major disruptions worldwide. The worm hit South Korea particularly hard because although it had the world's highest penetration of broadband Internet services at the time, less than 40% of South Korean firms had installed any firewall. The losses in the South Korean stock market were estimated at about US$860,000. A few months later, the same worm caused a 5-hour outage to the safety monitoring system of the nuclear power plant at Ohio. The "SQL Slammer" worm was self-propagating malicious code that exploited a known vulnerability in Microsoft SQL Server 2000. Once the worm compromised a machine, it would try to propagate itself to other randomly chosen IP addresses  . Loukas G. and Oke G. In August 2004, a corporate executive in Massachusetts was charged with hiring hackers to launch DoS attacks and cause a total of $2 billion in losses to three competitors. The attacks had begun in October 2003 and were mainly SYN and HTTP Floods. In an "HTTP Flood", the attacker uses a large number of compromised computers that simultaneous and request web content, such as images, from a victim website. A variation is the "HTTP Spidering" attack, which starts from a given HTTP link and then follows all links on the website in a recursive way [10] , inspired by the way search engines gather their data.