Defense mechanisms against Distributed Denial of Service attacks:Comparative Review
محتوى المقال
الملخص
Distributed Denial of Service (DDoS) remains a big concern in Cybersecurity. DDoS attacks are implemented to prevent legitimate users from getting access to services. The attackers make use of multiple hosts that have been compromised (i.e., Botnets) to organize a large-scale attack on targets. Developing an effective defensive mechanism against existing and potential DDoS attacks remains a strong desire in the cybersecurity research community. However, development of effective mechanisms or solutions require adequate evaluation of existing defense mechanism and a critical analysis of how these methods have been implemented in preventing, detecting, and responding to DDoS attacks.
This paper adopted a systematic review method to critically analyze the existing mechanisms. The review of existing literature helped classify the defense mechanism into four categories: source-based, core-router, victim-based, and distributed systems. A qualitative analysis was used to exhaustively evaluate these defense mechanisms and determine their respective effectiveness. The effectiveness of the defense mechanisms was evaluated on six key parameters: coverage, implementation, deployment, detection accuracy, response mechanism, and robustness. The comparative analysis reviewed the shortcomings and benefits of each mechanism.
The evaluation determined that victim-based defense mechanisms have a high detection accuracy but is associated with massive collateral as the detection happens when it is too late to protect the system. On the other hand, whereas stopping an attack from the source-end is ideal, detection accuracy at this point is too low as it is hard to differentiate legitimate and malicious traffic. The effectiveness of the core-based defense systems is not ideal because the routers do not have enough CPU cycles and memory to profile the traffic. Distributed defense mechanisms are effective as components can be spread out across the three locations in a way that takes advantage of each location.
The paper also established that the rate-limiting response mechanism is more effective than packet filtering method because it does not restrict legitimate traffic. The analysis revealed that there is no single defense mechanism that offers complete protection against DDoS attacks but concludes that the best defense mechanism is the use of distributed defense because it ensures that defense components are placed on all locations.
الكلمات المفتاحية
Cybersecurity، Cybercrimes، DDoS، DDoS Detection، Source Based، Core Router، Victim-based، Review DDoS
التنزيلات
المراجع
S. Raghavan and E. Dawson, An Investigation into the Detection and Mitigation of Denial of Service (DoS) Attacks, India: Springer, 2011.
K. M. Prasad, A. R. Mohan and K. V. Rao, "Dos and DDoS attacks: Defense, detection and traceback mechanisms-A survey," in Glob. J. Comput. Sci. Technol., vol. 14, no. 7, 2014.
S. T. Zargar, J. Joshi and D. Tipper, "A Survey of Defense Mechanisms Against Distributed Denial of Service (DDoS) Flooding Attacks," in IEEE Commun. Surv. Tutor., vol. 15, no. 4, pp. 2046-2069, Mar. 28, 2013, doi: 10.1109/SURV.2013.031413.00127.
M. T. Manavi, " Defense mechanisms against Distributed Denial of Service attacks: A survey," in Comput. Electr. Eng., vol. 72, pp. 26-37, Nov. 2018, doi: 10.1016/j.compeleceng.2018.09.001.
L. Kavisankar, C. Chellappan, and R. Vaishnavi, “Network Layer DDoS Mitigation Model Using Hidden Semi-Markov Model,” in Int. J. e-Educ. e-Bus. e-Manag. e-Learn. vol. 4, no. 1, pp. 42-46, Feb. 2014, doi: 10.7763/IJEEEE.2014.V4.299.
B. L. Dalmazo, et al. "A systematic review on distributed denial of service attack defence mechanisms in network," Int. J. Network Mgmt., vol. 2021, no. e2163, doi: 10.1002/nem.2163.
S. D. Kotey, E. T. Tchao and D. G. James, "On Distributed Denial of Service Current Defense Schemes," in Technol., vol. 7, no. 1, p. 19, Jan. 30, 2019, doi: 10.3390/technologies7010019.
Y. Wang and R. Sun, "An IP-Traceback-based Packet Filtering Scheme for Eliminating DDoS Attacks," in J. Netw., vol. 9, no. 4, pp. 874-881, Apr. 2014.
I. Sreeram and V. P. Vuppala, “HTTP flood attack detection in application layer using machine learning metrics and bio inspired bat algorithm,” in Appl. Comput. Inform., vol. 15, no. 1, pp. 59-66, Jan. 2019, doi: 10.1016/j.aci.2017.10.003.
C. Douligeris and A. Miktrokotsa, “DDoS attacks and defense mechanisms: classification and state-of-the-art,” Comput. Netw., vol. 44, no. 5, pp. 643-666, Apr. 5, 2004, doi: 10.1016/j.comnet.2003.10.003.
T. M. Thang and V. K. Nguyen, “Synflood Spoof Source DDOS Attack Defence Based on Packet ID Anomaly Detection – PIDAD,” Softw. Netw., vol. 2016, no. 1, pp.213-228, Jan. 2018, doi: 10.13052/jsn2445-9739.2016.012.
B. B. Gupta, R. C. Joshi and M. Mishra, "Distributed Denial of Service Prevention Techniques," Int. J. Comput. Electr. Eng., vol. 2, no. 2, Apr. 2010, doi: 10.7763/IJCEE.2010.V2.148.
H. Wang, C. Jin and K. G. Shin, "Defense Against Spoofed IP Traffic Using Hop-Count Filtering," in IEEE/ACM Trans. Netw., vol. 15, no. 1, pp. 40-53, Feb. 2007, doi: 10.1109/TNET.2006.890133.
Y. Kim, W. C. Lau, M. C. Chuah and H. J. Chao, "PacketScore: A Statistics-Based Packet Filtering Scheme against Distributed Denial-of-Service Attacks," IEEE Trans. Dependable Secure Comput., vol. 3, no. 2, pp. 141-155, Apr.-June 2006, doi: 10.1109/TDSC.2006.25.
M. T. Manavi, "Defense Mechanisms Against Distributed Denial of Service attack: A survey," Comput. Electr. Eng., vol. 72, Nov. 2018, pp. 26-38, doi: 10.1016/j.compeleceng.2018.09.001.
R. Yaegashi, D. Hisano and Y. Nakayama, "Light-Weight DDoS Mitigation at Network Edge with Limited Resources," in 2021 IEEE 18th Consum. Commun. Netw. Conf. (CCNC), 2021, pp. 1-6, doi: 10.1109/CCNC49032.2021.9369635.
S. Chen and Q. Song, "Perimeter-based defense against high bandwidth DDoS attacks," in IEEE Trans. Parallel Distrib. Syst., vol. 16, no. 6, pp. 526-537, June 2005, doi: 10.1109/TPDS.2005.74.
N. S. Rao, K. Sekharaiah and A. Rao, "A Survey of Distributed Denial-of-Service (DDoS) Defense Techniques in ISP Domains," in Springer Proceedings in Mathematics & Statistics, Cham, 2019.
O. Osanaiye, K. R. Choo and M. Dlodlo, "Change-point cloud DDoS detection using packet inter-arrival time," in 2016 8th Comput. Sci. Electr. Eng. (CEEC), 2016, pp. 204-209, doi: 10.1109/CEEC.2016.7835914.
Y. Chen, K. Hwang and W. Ku, "Collaborative Detection of DDoS Attacks over Multiple Network Domains," in IEEE Trans. Parallel Distrib. Syst., vol. 18, no. 12, pp. 1649-1662, Dec. 2007, doi: 10.1109/TPDS.2007.1111.
R. Chen, J. M. Park and R. Marchany, "TRACK: A novel approach for defending against distributed denial-of-service attacks," Dept. Electr. Comput. Eng., Virginia Tech, Virginia, VA, USA, Tech. Rep. TR-ECE-05-02, 2006.
J. Mirkovic, P. Reiher and M. Robinson, "Alliance Formation for DDoS Defense," in NSPW03: New Secur. Paradig. Workshop, Ascona, Aug. 2003, doi: 10.1145/986655.986658.
M. Sachdeva, G. Singh and K. Kumar, "A Comparative Analysis of Various Deployment Based DDoS Defense Schemes," in Quality, Reliability, Security and Robustness in Heterogeneous Networks, Springer, 2013.
F. Angelo, P. Pace, P. Andrea and M. Lorena, "Modelling and Simulation of a Defense Strategy to Face Indirect DDoS Flooding Attacks," Springer International Publishing , Switzerland , 2014.
G. Dayanandam, T. Rao, B. Bujji and N. D. S., "DDoS Attacks—Analysis and Prevention.," in Innovations in Computer Science and Engineering, Singapore, Springer, 2019.
"Worldwide Infrastructure Security Report," Ipv6.sa, 2019. [Online]. Available: http://ipv6.sa/wp-content/uploads/2014/05/World_Infrastructure_Security_Report_2011.pdf [Accessed 05 October 2019].
S. Yamaguchi, "Botnet Defense System: Concept, Design, and Basic Strategy," in Inf., vol. 11, no. 11, pp. 516-531, Nov. 4, 2020, doi:10.3390/info11110516.
تفاصيل المقال
هذا العمل مرخص بموجب Creative Commons Attribution-NonCommercial 4.0 International License.