First we set up the apache server and hosted a simple website and requested it from a good few users. We captured this traffic and analyzed it using wireshark [16], which is a network protocol analyzer that captures network packets and tries to display that packet data as detailed as possible. The obtained traffic is shown in Fig. 2 which is normal traffic.
To check the efficiency of the proposed framework, we proceed with two scenarios of DDOS attacks attempts. In the first scenario, we initiated the attack toward the web server with Slowloris tool [17] opens multiple connections to the web server and keeps them open indefinitely while sending intermittent HTTP requests through these connections. The server that is being attacked therefore continues to wait for those fractional attack requests to be finished. The server is protected with traditional security mechanisms like firewall, which identifies the attack based on predefined rules. The first attack scenario was conducted To demonstrate that the attacker had success attacking the web server. The attack's effect was visible in that the web server went down, making it unable to fulfill the real requests from the legitimate client who accessed the website, like in Fig. 3 which proves the weakness of the firewall.
In the second scenario, we redo the attack after implementing our proposed framework to protect the web server. We made the LIH emulate the web server and open many more ports to deceive the attacker to make him think that the target is easy and not protected, Fig. 4 shows the attacker view using nmap scan on the low interaction honeypot.
The python script in LIH sniffs on port 80 to capture DDOS attack traffic, we started the attack using the same tool, and made other users request the web site during the attack process. We noticed that the security system is working properly because the majority of legal users get the requested web page. And the web server continues to work although it is getting a DDOS attack which frustrates the attack attempts. The filtration process is successful with a low margin of error. Figure 5 shows the traffic on the fortified web server during the second scenario.
The final stage of our work includes analyzing the packets of DDOS traffic using wireshark in the high interaction honeypot. The analysis gives us this data for every packet: serial number, time, length, source and destination IP address, source and destination port number. Which is shown in Fig. 6. That helps us observe the packets closely and block specific IP addresses.
The most important advantage of the proposed framework is that true positive rate (TPR) and the false positive rate (FPR) reached logical proportions, and they can be calculated using the following equations: [12]
TPR = TP / (TP + FN). (1)
And
FPR = FP / (FP + TN). (2)
Where:
FP: False Positive
FN: False Negative
TN: True Negative
TP: True Positive
and Table 1 provides definitions for these terms:
TABLE I
Alerts during attacks terms
Attacks
|
Alerts
|
Yes
|
NO
|
YES
|
TP
|
FN
|
NO
|
FP
|
TN
|