Detection and Mitigation of Denial of Service Attacks Using SNMP and Moving Target Defense

Abstract

Internet is a wide scale of networked systems which operates together for offering numerous service categories. The World Wide Webs act as a major driving force as it attracts more than one million new users in a day. The massive attractive features and pay-as-you-go model of cloud computing draws the attention among 70%of the organizations to migrate their services to cloud. Denial of Service (DoS) is the widely prevalent security attack which disrupts the online services. The same DoS arriving from multiple sources are termed as Distributed Denial of Service (DDoS) attacks. Early detection of DoS is essential as it completely disrupts the availability constraint of online services. TCPSYN category of DoS disrupts the connection establishment mechanism of TCP protocol and creates half-open connections. The aim of TCP-SYN is to exhaust the resources of the targeted web server. In spite of the recovery measures, TCP-SYN is becoming harder every day in terms of both attack volume and severity. Hence complete mitigation against such attacks is the expected solution which needs to be proved in today s digital world.To achieve the targets early detection and cost-efficiency, a multi-level detection scheme is proposed which combines the Simple Network Management Protocol (SNMP) and incoming request analysis techniques. The primary objective of SNMP is to attain maximum efficiency in differentiating TCP-SYN with legitimate traffic in a less time interval.There are two phases being involved in the detection of TCP-SYN attack using the Management Information Base (MIB) variables of SNMP. The MIBs are identified based on the theoretical validation, feature selection methods has been validated through the prediction and accuracy metrics of linear regression. Gradient descent is used in linear regression for optimization and error reduction related to the attack prediction