A study on efficient detection of network-based IP spoofing DDoS and malware-infected Systems

Abstract

Large-scale network environments require effective detection and response methods against DDoS attacks. Depending on the advancement of IT infrastructure such as the server or network equipment, DDoS attack traffic arising from a few malware-infected systems capable of crippling the organization’s internal network has become a significant threat. This study calculates the frequency of network-based packet attributes and analyzes the anomalies of the attributes in order to detect IP-spoofed DDoS attacks. Also, a method is proposed for the effective detection of malware infection systems triggering IP-spoofed DDoS attacks on an edge network. Detection accuracy and performance of the collected real-time traffic on a core network is analyzed thru the use of the proposed algorithm, and a prototype was developed to evaluate the performance of the algorithm. As a result, DDoS attacks on the internal network were detected in real-time and whether or not IP addresses were spoofed was confirmed. Detecting hosts infected by malware in real-time allowed the execution of intrusion responses before stoppage of the internal network caused by large-scale attack traffic.

Comparing Malware Attack Detection using Machine Learning Techniques in IoT Network Traffic

“…Besides, the unique connection ID (uid) is dropped because it is not useful to train the classifier. The source (source_ip) and destination IP (dest_ip) addresses are excluded from the machine learning features because IP can be spoofed by the attackers [30]. Therefore, IP is infeasible to be used as an attack detection and classification feature.…”

Overview of the Methods for Predicting Network Anomalies

“…Суть метода заключается в анализе влияния атаки на энтропию IP-адресов. DDoS-атака представляет собой большое количество запросов к конкретному сервису от одного узла-источника, то есть в общем трафике можно увидеть большое количество пакетов с одинаковыми IP-адресами -источника атаки и атакуемого сервера [6]. Атака за счет концентрации трафика на портах источника и портах назначения характеризуется уменьшением энтропии IP-адресов источника и IP-адресов назначения.…”

Identificação Antecipada de Botnets por Aprendizagem de Máquina

“…Existem diferentes abordagens para a definição das características que podem ser coletadas do tráfego das redes. Por exemplo, Seo and Lee (2016) utilizam 14 atributos para representar o fluxo normal e malicioso em seu trabalho de detecção de ataques DDoS, enquanto Lu et al (2017) utilizam 22 atributos para detecção de seções de C&C. Como o objetivo deste trabalhoé identificar a diferença comportamental dos dispositivos, e necessário utilizar características que sejam representativas. A quantidade de pacotes enviados, o tamanho dos pacotes, a frequência de envio e recebimento dos pacotes são características importantes para diferenciar usuários reais dos bots.…”