A New Approach for Detecting SMTPFA Based on Entropy Measurement

Abstract

In this paper, we propose a new approach of detecting a kind of Simple Mail Transfer Protocol Flooding Attack (SMTPFA for short) based on entropy measurement. We will calculate the entropy values from the received packets flow. Further checking its entropy value compared with the values of abnormal entropy, we then use it to detect this server whether is suffered some attacks from hacker. The scheme can easily detect SMTPFA, and monitor the real-time status of SMTP server.

An Approach for Detecting Flooding Attack Based on Integrated Entropy Measurement in E-Mail Server

“…The entropy value is inversely proportional to the probability value. With this feature, the value of results we calculate has dependability [16].…”

“…1. In the SMTP architecture [16], it consists of a Sender, a sender-SMTP, a receiver-SMTP and a Receiver. When a Sender (user or file server) will connect to another receiver, it will send a request message of Establishes Connection to the sender-SMTP.…”

“…First, SMTP had been defined in the RFC 821 [1,2,16]. It is an independent subsystem in special communication system.…”

“…According to the above steps, if the command-respond pair has been completed during one normal time-period, it means that a round of SMTP session has been completed. The established SMTP message flows are divided into seven stages [16] as below: Establishes Connection, HELO, MAIL FROM, RCPT TO, DATA, DATA TRANSFER, and QUIT. The SMTP message flows are shown in Fig.…”

“…In the Information Theory, Entropy is an approach used to measure the uncertainty or randomness in random variable [13][14][15][16]. Entropy measurement approach is proposed by Shannon [13] and Weaver [15].…”