Detection of DDoS attacks in Windows Communication Foundation Services

Abstract

Abstract--Internet provides many critical services so it has become very important to monitor the network traffic so that the resources of the network can be prevented from being depleted from malicious hackers. In this paper, we have presented a mechanism to detect a nd defense a web-server against a Distributed Denial of Service (DDoS) attack. We have presented simulation of specific kind of DDoS attack i.e. identity spoofing and SYN flood attack on an application similar to shopping portal and its results to demonstrate the effectiveness of t he mechanism. Then, the attack is monitored in resource monitor of the server side monitor showing CPU utilization.Also,some defense mechanisms to defend the server against such attacks has been presented. Keywords:Network security, DDoS, IP spoofing, SYN flood attack. INTRODUCTIONInternet has become very famous nowadays which satisfies people with its various services which are related to various different fields. It provides a very versatile facility as with just few clicks one can complete many tasks easily and conveniently. Though it is the greatest tool for communicating in mass, but there is also a negative side of taking the help of Internet. Along with the popularity and rapid development of the Internet, network security issues become more and more serious [1]. Network security threats we face include: eaves dropping, denial-of-service attack, spoofing, illegally authorized access, and the spread of the virus etc.[1]A denial of service (DoS) attack is a malicious attempt, which temporarily interrupts or suspends the services of a host connected to the Internet and makes the server or a network resource unavailable to users. In Distributed Denial of Service Attack (DDoS) the attack is "distributed" because the attacker is using multiple computers, including yours, to launch the denial-of-service attack.Service-oriented applications can be build by using a framework known as Windows Communication Foundation (WCF) .Data as asynchronous messages can be send from one endpoint of service to another while using WCF. A service endpoint may be a part of a service which is continuously available and it is hosted by IIS, or it may be a service hosted in an application. An endpoint can be a client of a service that requests for some data from a service endpoint.Spoofing is a type of scam where an intruder hiding its own identity pretends to be another user and tries to gain unauthorized access to that user's system or information. The main reason behind spoofing is to gain access to one's computer system, bank account or to steal personal information, such as passwords by tricking the user to reveal sensitive information.This paper is organized as follows. Section 2, discusses the related work done on spoofing and DDoS attacks so far. Section 3, describes DDoS attacks and its effects and thorough explanation of TCP SYN flood attack in which our paper is based. The methodology of how the attack has been done on shopping portal application with results has been shown in secti...