Match-Prevention Technique Against Denial-of-Service Attack on Address Resolution and Duplicate Address Detection Processes in IPv6 Link-Local Network

Al-Ani, Ahmed; Anbar, Mohammed; Ibrahim, Dyala R.

doi:10.1109/access.2020.2970787

Cited by 30 publications

(20 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The attacks were repeated 30 times for each attack scenario, and results were measured for each process. The equation ( 1) below is implemented to measure the ability of the SECS/GEM processes in preventing the attacks carried on SECS/GEM communications [27]:…”

Section: Experiments and Resultsmentioning

confidence: 99%

Cyberattacks and Vociferous Implications on SECS/GEM Communications in Industry 4.0 Ecosystem

Laghari¹,

Manickam²,

Karuppayah³

et al. 2021

IJACSA

Self Cite

View full text Add to dashboard Cite

Information and communications technology (ICT)is prevalent in almost every field of industrial production and manufacturing processes at present. A typical industry network consists of sensors, actuators, devices, and services to connect, track, and manage production processes to increase performance and boost productivity. The SEMI Equipment Communications Standard/Generic Equipment Model (SECS/GEM) is SEMI's Machine-to-Machine (M2M) protocol for equipment-to-host data communications. It is the most popular and profoundly used M2M communication protocol operating in the manufacturing industry. With Industry 4.0 as a guiding factor, connectivity to business networks is required for accessing real-time data whenever and wherever needed. This openness of connectivity raises security concerns as SECS/GEM protocol offers no security, which endangers exposing the manufacturing industries' business secrets and production processes. This paper discusses the key processes involved in SECS/GEM communications and how potential attackers can manipulate these processes to obtain illegal or unauthorized access. The experiments' results indicate that the SECS/GEM processes are entirely vulnerable to numerous attacks, including DoS attack, Replay attack, and False-Data-Injection-Attack. Thus, the future direction involves developing a prevention mechanism that aims at securing the SECS/GEM processes in the industrial network. This study's findings are useful as preliminary guidance for the infrastructure owners to plan for appropriate security measures to protect the industrial network.

show abstract

Section: Experiments and Resultsmentioning

confidence: 99%

Cyberattacks and Vociferous Implications on SECS/GEM Communications in Industry 4.0 Ecosystem

Laghari¹,

Manickam²,

Karuppayah³

et al. 2021

IJACSA

Self Cite

View full text Add to dashboard Cite

show abstract

“…The two sub-categories for location-based DDoS attack defense mechanisms are victim network and intermediate network. The victim network category is for mechanisms that run on the victim network, whereas the second subcategory is for mechanisms deployed in the intermediate network [12], [15].…”

Section: ) Ddos Attack Defense Mechanisms Based On Locationmentioning

confidence: 99%

Mathematical Approach as Qualitative Metrics of Distributed Denial of Service Attack Detection Mechanisms

et al. 2021

Self Cite

View full text Add to dashboard Cite

The distributed denial of service (DDoS) attack is one of the most destructive organized cyber-attacks against online services or computers on the network. Despite the existence of many mechanisms to detect DDoS attacks, the problem is still prevalent. This research dissected and analyzed twenty-two existing DDoS attack detection mechanisms, representing all types of DDoS attack defense approaches, to determine the reason for the persistent successful DDoS attacks. This research posits two hypotheses concerning this gap: First, a lack of mathematical function usage by the existing detection mechanisms. The few functions used are limited to logical, statistical, or probability functions, resulting in reduced detection effectiveness. Second, researchers unintentionally or inadvertently miscalculate the mechanisms' detection accuracy rate by partially using quantitative metrics. This research has three objectives; to propose a set of qualitative metrics based on mathematical functions, to measure the relationship between the quantitative and qualitative metrics in the DDoS attack detection mechanisms, and to prove the relationship between the genuineness of the existing mechanisms' detection accuracy, and full consideration of quantitative metrics and diversity of qualitative and metrics. The result revealed a correlation rate of 84.22 %, which reflects the correctness of the detection accuracy. Third, identifying the manipulation percentage of reported detection accuracy by employing the correlation rate complement. The result indicated that 15.78 % of the reviewed mechanisms had manipulated or inadvertently miscalculated the accuracy.

show abstract

“…• Neighbor Advertisement (NA) -type 136: NA messages contain information about any changes in nodes' information, such as Media Access Control (MAC) address and the IP address, or it can be used to ask for a response to NS messages. • Redirect Messages (RM) -type 137: RM messages forward traffic from one router to another [11]- [13]. NDP is a stateless protocol that does not force the use of authentication mechanisms, which exposes NDP messages to several threats and vulnerabilities [14].…”

Section: Introductionmentioning

confidence: 99%

Flow-Based Approach to Detect Abnormal Behavior in Neighbor Discovery Protocol (NDP)

et al. 2021

Self Cite

View full text Add to dashboard Cite

Internet Protocol version six (IPv6) is equipped with new protocols, such as the Neighbor Discovery Protocol (NDP). NDP is a stateless protocol without authentication that makes it vulnerable to many types of attacks, such as Router Advertisement (RA) and Neighbour Solicitation (NS) DoS flooding attacks. In these types of attacks, attackers send an enormous volume of abnormal NDP traffic, which causes congestion that degrades network performance. The expected behavior among these attacks is the existence of NDP traffic abnormalities. Thus, this research aims to propose a flow-based approach to detect abnormal NDP traffic behavior, which is considered an indicator of the presence of NDP-based attacks, such as RA and NS DoS flooding attacks. Also, the proposed approach relies on flow-based network traffic representation and adoption of the Entropy algorithm to detect the randomness in the network traffic. The proposed approach is evaluated in terms of detection accuracy, precision, recall, and F1-Score using a simulated dataset. The experimental result shows that the proposed approach obtained 98.1%, 55%, 100%, and 70.96% for average accuracy, precision, recall, and F1-Score, respectively, in detecting abnormal NDP traffic behavior caused by the RA DoS flooding attack. Meanwhile, the proposed approach obtained 99%, 91.3%, 100%, and 95.45% for average accuracy, precision, recall, and F1-Score, respectively, in detecting the abnormal NDP traffic behavior caused by the NS DoS flooding attack. Also, the proposed approach shows better results compared to other existing approaches.

show abstract

Match-Prevention Technique Against Denial-of-Service Attack on Address Resolution and Duplicate Address Detection Processes in IPv6 Link-Local Network

Cited by 30 publications

References 29 publications

Cyberattacks and Vociferous Implications on SECS/GEM Communications in Industry 4.0 Ecosystem

Cyberattacks and Vociferous Implications on SECS/GEM Communications in Industry 4.0 Ecosystem

Mathematical Approach as Qualitative Metrics of Distributed Denial of Service Attack Detection Mechanisms

Flow-Based Approach to Detect Abnormal Behavior in Neighbor Discovery Protocol (NDP)

Contact Info

Product

Resources

About