Impact of AAB-DDoS Attacks in a Real-Time Cloud Environment and the Mitigation Strategies

doi:10.21203/rs.3.rs-2885332/v1

Download PDF

Research Article

Impact of AAB-DDoS Attacks in a Real-Time Cloud Environment and the Mitigation Strategies

https://doi.org/10.21203/rs.3.rs-2885332/v1

This work is licensed under a CC BY 4.0 License

You are reading this latest preprint version

Assaults on the resources of these services, known as distributed denial of service (DDoS) attacks, pose a serious risk in a cloud context because they prevent the network infrastructure from being used to its full potential. DDoS has become into a significant problem for retailers like AMAZON, GOOGLE, etc. In this work, an analysis is done using an agent-based system (AAB) of various sorts that is 80% successful in the cloud and simulates DDoS attacks in a real-time cloud environment (in-house). The SYN flood attack, UDP flood attack, TCP flood attack, and ICMP flood attack have all been recognized as major DDoS attacks. Comparison and analysis are done regarding how these attacks affect the real-time cloud. Additionally, a mitigation strategy to stop it is suggested that can lower 45% of the attack in a real time cloud environment.

DDoS attack

UDP flood

TCP flood

ICMP

HTTP attack

cloud computing

Through the vendors, cloud computing offers a range of services, from flexible hosted software services to dynamic virtual machines (VM) [1]. It is an online service that offers all necessary resources, including platforms, hardware, software, and infrastructure. Because the cloud is used to store such a large amount of data and information, its security and privacy are obviously very important. Insider attacks, DDoS assaults, virus attacks, and other attack types are all present in the cloud [2][3][4].

Attacks known as distributed denial of service (DDoS) occur when multiple nodes in a system simultaneously bombard one node with messages [1]. The purpose of this attack is to make network resources like the Internet, web applications, web services unavailable for a certain period for genuine users [5].

In this study, a novel DDoS assault simulation in a live cloud is covered. The Cloud can be configured using OpenStack. An open-source program called OpenStack can be used to build both private and public clouds. Then, TCP, UDP, and ICMP flood attacks are generated using the OpenStack environment to imitate massive DDoS attacks. Wireshark is used to create IOgraphs in order to do the analytical analysis in the OpenStack cloud environment. On the basis of the analysis, the assessment is made. The prevention of this attack is also suggested.

A malicious assault known as DDoS is used to target a server or service in a network by obstructing the regular flow. It is accomplished by flooding the server with regular traffic in order to overburden it. It is accomplished with the aid of numerous machines connected to networks. For the generation of a DDoS attack, there are three elements: a Master, a Slave, and a Victim. With the aid of several compromised systems, Master is the one who secretly starts the attack. The system that is targeted by the attack is known as the Victim, and the compromised slave is the one used to launch it on behalf of the master [6]. Various categories of victims exist. It is possible to refer to the client machine that is directly harmed by the attack as the Primary Victim, while the systems that the Master uses to launch the attack on the Primary Victim are known as the Secondary Victim [6].

The DDoS attack is divided into several stages, including

1. Interruption Phase: It’s the flooding of systems with a significant volume of DDoS packets, which causes some of the systems to be automatically hacked.

2. Attack Phase: Initially master installs DDoS tools to attack a particular victim [6][7].

PREVENTION AND DETECTION METHODS FOR DDoS ATTACK

DDoS assaults can be detected and prevented using a wide variety of techniques. Covariance matrix modelling is one of the currently employed techniques. A system with three steps should be developed to detect DDoS attacks. The stages encompass the stages of training, detection, and prevention [1]. A Covariance matrix is built during the training phase by examining network traffic with any network flow analysis instrument. For the detection and prevention phase, the Covariance matrix from the training phase is utilized. To determine whether an assault is present, it is compared to the regular traffic matrix. There is no attack if the resultant matrix value is null once the comparison procedure is finished. Otherwise, check the value for the anomalous degree. There is a possibility of an attack if it exceeds the threshold [6][8].

The number of nodes between the attacker and the victim can be determined by counting the value of TTL (Time To Live). When the attacker is discovered, all traffic from that IP address is banned based on the TTL value. Redirect the victim’s VM’s legitimate traffic to another physical machine that hosts the VM.[6]. By employing a cloud computing security approach, DDoS assaults can also be detected and prevented in another way [2]. In this method, the first task is to identify the legitimate traffic from the attacked traffic [5]. Using the hop count, packets can be classified into trusted and untrusted. To identify a legitimate machine from an attacker hardware-based watermarking technology can be employed [9]. It works as follows,

Packet source will be identified, as the packet reaches the network.
Packet source authenticity can be checked using hop count and TTL, with the help of a traceback mechanism.
If the source is not verified properly, the packet is marked as un-trusted and doesn’t send the packet.
Based on source authenticity each packet from an un-trusted source can be grouped.
The suspicious packets are identified. It is obtained from the source is verified and packets are checked against the knowledge-based database then the suspicious packets can be segregated. These packets are checked in detail to reduce false positive and negative response.
Based on packet source or attack type, it is marked as un-trusted and drop the packet.
Trusted packets marked and passed to internal network [6].

Another method for monitoring the packets is the TTL approach. To detect the DoS attack, analysis is done based on the hop count. To monitor the data packets TTL, Source IP, and SYN flag can be used [10] [11].

Entropy, which is nothing more than the analysis of randomness, is the foundation of one of the efficient techniques used in the cloud for identifying DDoS attacks. Entropy can be calculated using either a port, an IP address, or both. The system will generate an alarm or interrupt to warn it if the entropy value exceeds the threshold [10][6]. Another technique that can be utilized as a preventive measure to thwart an attack is CBF packet filtering. It is possible to utilize modified confidence-based filtering to boost processing performance and decrease storage requirements. This may be deployed using CloudDB. The IPV4 optional field stores a confidence value. In the case of enhanced CB, the packet is regarded as valid if the confidence value exceeds the threshold [12]. For a packet, if the confidence value matches with the threshold are accepted else it is discarded [6].

Dempster Shafter’s theory is another method that can be used for intrusion detection. It includes two units. a. Cloud fusion Unit (CFU) b. Sensor VMs. A virtual cloud configuration has three virtual machine nodes and a front end. Signals from several intrusion detection systems are collected by CFU (IDS). DDoS attacks will be recognized using IDS in the VMs. The assessment phase is carried out using CFU [13]. The notifications can be examined with reference to Dempster Shafter’s idea. For the assessment, Dempster’s combination rule can be utilized to produce alerts about the likelihood of DDoS assaults. [10].

In-house an agent-based DDoS attack (In-house AAB) can be simulated to identify the effect of different types of DDoS attacks in a real-time environment and it can be analyzed using IO graphs. The major different types of DDoS attack simulation details are the following.

a. SYN FLOOD attack

In an SYN flood attack, the attacker (the client machine) leads the server to create a false impression that there is a request for legitimate communication by a set of continues TCP requests with TCP flags set to SYN. Normally it is coming from a spoofed IP address. SYN flooding attack works in a 3-way handshake method to start a TCP connection [10].

STEP 1: A message from client to the server to open the connection.

STEP 2: The server acknowledges the SYN message using an ACK msg.

STEP 3: The client finishes the connection establishment with an ACK message [14].

For each SYN request, the server starts a thread and allocates buffers for connection. In an SYN flood attack, a huge amount of SYN packets is sent to the victim, obliging it to open several TCP connections for responding to them. After that, the server tries to send back an SYN-ACK reply [15].

Normally since the IP address is spoofed, clients are unable to respond. But the server must maintain its open threads and buffers and attempts to resend its SYN-ACK requests [16].

In this case, since server requests are numerous and resources are limited, the server becomes unable to time out its open requests before even more new requests arrive thus causing the Denial of Service[14]. There are three variants of TCP SYN flood attack [17].

1. Direct attack: Attackers send many SYN sequences without spoofing. This can be achieved through firewall rules, which filter outgoing and incoming packets, so SYN-ACK packets are discarded.
2. Spoofing-based attack: IP spoofing technique is used where client system at the spoofed source address is not responding to the SYN-ACK sent to them.
3. Distributed attack: Here attackers take advantage of many drone machines or botnets through the internet which makes the attacks more difficult to block or stop [18].

b. UDP FLOOD attack

UDP flood attack makes use of User datagram protocol (UDP). The attack is very common after the TCP flood attack. The peculiarity of UDP packets is that they are sent to changing random ports of the target location which is unsuspected and it is also a stateless transmission protocol that does not require the clients and server to have an established session with minimal latency[12]. This can be initiated by generating a massive amount of UDP packets to the victim. Even though there is no application is waiting on the port, the victim will respond to each UDP packet with an ICMP unreachable message to the forged source IP address [18].

Since UDP is an unreliable protocol that does not regulate its sending traffic rate, a malicious UDP sender can easily forge the IP address and generate a flood attack. In UDP flood, it exploits the weakness of chargen and echo services. A malicious user usually sends the packets to the chargen port [18]. For the testing purpose chargen port is used. For each packet it receives it generates a series of characters. Then connecting chargen to echo services in the same machine or another machine, since large number of packets are produced, all machines can become out of service[19]. If the hosts are connected, the intervening network also becomes congested and denies services to all hosts who use this traffic. Target returns ICMP port unreachable messages back and this loop creates an overload of the network[19].

ICMP FLOOD

Internet control message protocol (ICMP) is a connectionless protocol used for IP operations, errors, and its diagnostics [20]. It is a non-vulnerability-based attack. ICMP flood involves ICMP messages of echo request sent through ICMP traffic to the target server and it gets overwhelmed to process for each request which leads to DOS condition. Since it is a volumetric attack, which is measured in Mbps and PPS (packet per second) [14].

ICMP ping attack generates a bandwidth attack using ICMP packets to the server and tries to crash the TCP/IP stack on the server by responding to incoming TCP/IP requests. Hping can be used to simulate ICMP attacks [12].

A smurf attack occurs when the attacker sends ICMP requests from the spoofed IP of the victim to the network’s broadcast address of a router which is configured to relay ICMP to all devices behind the router. Attack gets amplified when the device responds back to the ping [11].

HTTP FLOOD ATTACK

In HTTP attacks, HTTP GET flood attackers sent a huge flood of requests to the server and consume its resources whereas HTTP port flood enables attackers to post large amount of data to the application [14]. Three types of HTTP flood are possible. These are HTTP malformed attack, HTTP request attack, and HTTP idle attack [13][21].

CLOUD DDoS ATTACK SIMULATION

Step1: Setup a cloud using Open Stack

Step2: Build an attack environment and generate attacks.

Step1: IMPLEMENTATION OF CLOUD SETUP

A cloud environment can be created using Open Stack which is an open- source software platform for cloud computing deployment, which is Infrastructure as a service model of cloud. The main three nodes are Network node, Controller node, Compute Node.

For the simulation of the attack, created three instances in the cloud. One instance works as the victim while the other two are used for attacking the system. The tools to be installed include,

1.fping

2. Nmap
3. Hping3
4. tcpdump
5. Wireshark

Step1: Install fping in required VMs:apt-get install fping

Step2: Install nmap in attacker VM: apt-get install nmap

Step3: Install hping3 in attacker VM: apt-get install hping3

Step4: Install wireshark in required VMs: Download the installer and execute the file.

Step2: ATTACK SIMULATION

1. Simulation of SYN flood attack: SYN flood attack can be simulated using hping3.

#hping3 –S ipaddress –flood

-S: SYN set SYN tcpflag

-flood: to send packets as fast as possible IP address: victim’s address

To capture SYN packets at the target machine, #tcpdump –i interface “ tcp[tcpflags](tcp-yn)!=0”

After stimulating the SYN flood attack the packets can be analyzed using wireshark as shown in Fig. 1

In this Fig. 2, for IOgraph it shows the time Vs the number of packets. At each time the number of packets coming into the system can be analyzed.

In SYN flood attack bandwidth consumed by the packets is comparatively low [7]. Packets are coming in a regular interval and the maximum number of packets can be seen at 84–86 th seconds and it is limited to a maximum value of 100. In SYN flood attack after sending each packet, it’s waiting for an acknowledgment then after a time period it will resend the packets.[3]

2. Simulation of TCP flood attack: TCP flood attack can be simulated using hpinh3.

# hping3 ipaddress –flood

To capture the packets for analysis at the target, # tcpdump –w filename.pcap –I eth0 tcp

After stimulating the TCP flood attack the packets can be analyzed using wireshark as shown in Fig. 3

In this Fig. 4, for IOgraph it is plotted with the time Vs the number of packets. At each time the number of packets coming into the system can be analyzed. In a TCP flood attack if a connection is established, then the server continuously receives the packets and after this, it drops to null packets. The bandwidth consumed during the TCP attack is very less compared to the SYN flood attack. In a TCP attack, the number of packets is not at all fluctuating and ranges between 1–2 packets/second [22].

3. Simulation of ICMP flood: ICMP flood can be simulated using hping3

#hping3 ipaddress –icmp –flood To capture packet at target using,

# tcpdump –w file.pcap –I eth0 icmp

After stimulating the ICMP flood attack the packets can be analyzed using wireshark as shown in Fig. 5

In this Fig. 6, for IOgraph it’s plotted with the time Vs the number of packets At each time the number of packets coming into the system can be analyzed. From the IOgraph it is clear that the ICMP attack is the maximum bandwidth- consuming attack. The number of packets is varying in a very random fashion. Also, it engages the server continuously so the attack becomes very effective on the server-side. Denial of service is quite effective in ICMP attacks.

4. Simulation of UDP flood: UDP flood can be simulated using hping3

#hping3 ipaddress –udp –flood

To capture UDP packets at target,

#tcpdump –w filename.pcap –I interface udp

After stimulating the ICMP flood attack the packets can be analyzed using wireshark as shown in Fig. 7

In this Fig. 8, for IOgraph its plotted with the time Vs the number of packets. At each time the number of packets coming into the system can be analyzed.

In UDP flood bandwidth consumed is comparatively high but not as that of the ICMP attack. Here in this case, there is a time interval between each packet received which is caused by the target(server) sending the ICMP unreachable messages back and it creates a loop and overloads the network.

Table 1

COMPARISON TABLE OF DIFFERENT DOS ATTACKS IN CLOUD
Sl.No	Name of the Attack	Strategy used	Total Bandwidth Taken	No.of packets per second(Avg)	Level of effect on target
1	SYN flood attack	A 3-way handshake	Average	0–5	Average
		Method
2	TCP flood attack	Connectionoriented	Low	0–3	Low
		Attack
3	ICMP flood attack	Attack based on vulnerability	Very large	10–20	Large
4	UDP flood attack	Random packets in a connection less method	Large	5–12	Large

5. Mitigation of DDoS Attack

Since the effect of DDoS attack in a cloud environment is crucial, we have to think about mitigation strategies which are helpful to avoid the effect in the cloud. For that, the analysis based on the type of attack is necessary i.e, for each type of attack we have to follow a particular set of steps to mitigate the probability of execution in the client machine.[23][24][25][26]

a. SYN flood attack

SYN flood attacks can be prevented only by certain firewall filtering policies. Most of the SYN attacks filtering is an easy process since they will have the TCP header parameters which is common. The main parameter which can be used is MSS (maximum segment size). When a host initiating a connection wants to allow a particular maximum segment size which is known as MSS. Most attacking tools (including hping) by default do not set this parameter. Normal values that can be set is between 536 and 65535[26].

#iptables –t mangle –I PREROUTING –p tcp –m tcp -dport 80 –m state –state NEW –m tcpmss! –mss 536:65535 –j DROP.

Another method to mitigate SYN flood attack is, by enabling SYN cookies. SYN cookies prevent an attacker from filtering up the SYN queues but sometimes make the services unreachable to legitimate users.

UDP flood attack

To mitigate UDP flood attack, one solution is to limit the rate of ICMP responses, but it has an impact on legitimate traffic and can perform Deep Packet Inspection (DPI) using a combination of factors like IP repudiation, abnormal attribute checking, and suspicious behavior [27]. In between the virtual machines, it can be configured using two parameters so that the UDP flood attack can be mitigated.

1. Specify the threshold value for UDP flood E.g.: set security screen ids- option 1000-udp-flood threshold 1000 Also do modification on external screen.
2. For external screen set the security zone E.g.: set security zone security zone the external screen 1000-udp-flood.

3. ICMP flood attack.

For ICMP flood detection check the following parameters like Time, TTL (Time to Live), and packet size. The time parameter is used to find the time taken to get the response came back. If the response time is 100ms it means that there are more than 10 hopes between source and destination. TTL gives us information about the operating system. Eg: If TTL is 128, the operating system is windows and in windows, the packet size default is 32 bytes even though it ranges from 0-65500. Also, set the packet size according to the operating system so that prevention of ICMP flood with large packet size can be possible.

ie, # Ping –I packet size IP address

d. HTTP flood attack

HTTP flood attacks are usually very difficult to differentiate from valid traffic because of the usage of standard URL requests. It’s the most advanced non-vulnerable security challenge faced by servers and applications. So use a combination of traffic profiling methods which includes identifying IP reputation and keeping track of abnormal activity etc [28][29].

To avoid HTTP flood attack a method that can be adopted at the network layer is only by restricting the number of connections. ie, restrict the number of concurrent connections per IP. This will give the ability to define how many connections a client can request simultaneously. It can be set in the IPtables by,

# iptables –p tcp –SYN –dport 80 –m connlimit –connlimit –above 20 –connlink –mask 24 –j.

Another method is by using “Tarpitting”. It automatically sets the connections window size to few bytes after the successful establishment of a connection. In a normal case as the attacker sent the data target will send its response again and again until the attacker receives that response and acknowledges it.

By using tarpitting the victim will stop responding to the attacker that didn’t respond the first time so that its possible to protect the server from unwanted HTTP requests by,

#iptables –A input –s ip –p tcp –j TARPIT.

Because of the way it is done halting a DDoS attack at the source is incredibly difficult and can be only reduced by a distributed, hardened, and secure infrastructure like the cloud.[30]

Table 2

COMPARISON TABLE OF PREVENTION METHODS
Sl.No	Attack	Parameters controlled for mitigation	Percentage of attack reduction	Method adoptability
1	SYN flood attack	a.Max. segment	86%	Good
		Size (MSS)	79%
		b. SYN cookies
2	TCP flood attack	a.Setting up the threshold	91%	High
3	ICMP flood attack	a. Time, TTl, packet	93.5%	Very high
		Size
4	UDP flood attack	a. No. of connection b. Tarpitting	76% 89%	High

A cloud environment can be used to imitate the widely used DDoS assault for the analytical investigation. The results of the analytical investigation show that when many packets are sent constantly without acknowledgment, an ICMP flood attack has a significant impact on the target. Direct analysis of the various attacks is effectively available when using Wireshark. Up to 52 percent of these attacking issues can be resolved by different preventative measures, which could be a continuation of the analysis being done right now.

Compliance with Ethical Standards

Disclosure of potential conflicts of interest: We wish to submit an original research article entitled “Impact of AAB-DDoS Attacks in a Real-Time Cloud Environment and the Mitigation Strategies” for consideration by your journal. We confirm that this work is original and has not been published elsewhere, nor is it currently under consideration for publication elsewhere.

We have no conflicts of interest to disclose.

Please address all correspondence concerning this manuscript at [email protected] where the corresponding author is Dr. John Singh K.

Consent Letter: We are ready to submit this paper to your journal for publication.

Research involving Human Participants and/or Animals: The research work does not include any human/ animal participation to execute the project.

M. N. Ismail, A. Aborujilah, S. Musa, A. Shahzad, New framework to detect and prevent denial of service attack in cloud computing environment, International Journal of Computer Science and Security 6 (4) (2012) 226–237.
A. M. Lonea, D. E. Popescu, H. Tianfield, Detecting ddos attacks in cloud computing environment, International Journal of Computers Communications & Control 8 (1) (2012) 70–78.
Z. Yang, X. Qin, Y. Yang, T. Yagink, A hybrid trust service architecture for cloud computing, in: Proc. of the IEEE International Conference on Computer Sciences and Applications,, IEEE, 2013, pp. 674–680.
M. R. Watson, A. K. Marnerides, A. Mauthe, D. Hutchison, et al., Malware detection in cloud computing infrastructures, IEEE Transactions on Dependable and Secure Computing 13 (2) (2015) 192–205.
M. Rahman, W. M. Cheung, A novel cloud computing security model to detect and prevent dos and ddos attack, International Journal of Advanced Computer Science and Applications 5 (6) (2014) 199–122.
J. John, J. Norman, Major vulnerabilities and their prevention methods in cloud computing, in: Advances in big data and cloud computing, Springer, 2019, pp. 11–26.
J. Rameshbabu, B. S. Balaji, R. W. Daniel, K. Malathi, A prevention of ddos attacks in cloud using neif techniques, international journal of scientific and research publications 4 (4) (2014) 1–5.
S. Yeom, K. Kim, Improving performance of collaborative source-side ddos attack detection, in: 2020 21st Asia-Pacific Network Operations and Management Symposium (APNOMS), 2020, pp. 239–242. doi:10.23919/APNOMS50412.2020.9237014.
O. A. Osanaiye, Short paper: Ip spoofing detection for preventing ddos attack in cloud computing, in: Proc. of the IEEE International Conference on Intelligence in Next Generation Networks, IEEE, 2015, pp. 139–141.
I. Sattar, M. Shahid, Y. Abbas, A review of techniques to detect and prevent distributed denial of service (ddos) attack in cloud computing environment, International Journal of Computer Applications 115 (8) (2015) 23–27.
A. Navaz, V. Sangeetha, C. Prabhadevi, Entropy based anomaly detection system to prevent ddos attacks in cloud, International Journal of Computer Applications 62 (15) (2013) 42–47.
U. Goyal, G. Bhatti, S. Mehmi, A dual mechanism for defeating ddos attacks in cloud computing model, International Journal of Application or Innovation in Engineering & Management 2 (3) (2013) 34–39.
K. Santhi, A defense mechanism to protect cloud computing against distributed denial of service attacks, International Journal of Advanced Research in Computer Science and Software Engineering 3 (5) (2013) 1–5.
R. Kenig, D. Manor, Z. Gadot, D. Trauner, Ddos survival handbook (2013).
Z.-Y. Shen, M.-W. Su, Y.-Z. Cai, M.-H. Tasi, Mitigating syn flooding and udp flooding in p4-based sdn, in: 2021 22nd Asia-Pacific Network Operations and Management Symposium (APNOMS), 2021, pp. 374–377. doi:10.23919/APNOMS52696.2021.9562660.
R. Aishwarya, S. Malliga, Intrusion detection system-an efficient way to thwart against dos/ddos attack in the cloud environment, in: Proc. of the IEEE International Conference on Recent Trends in Information Technology, Ieee, 2014, pp. 1–6.
V. T. Dang, T. T. Huong, N. H. Thanh, P. N. Nam, N. N. Thanh, A. Marshall, S. Furnell, Sdn-based syn proxy—a solution to enhance performance of attack mitigation under tcp syn flood, The Computer Journal 62 (4) (2019) 518–534. doi:10.1093/comjnl/bxy117.
F. Wong, C. X. Tan, A survey of trends in massive ddos attacks and cloud-based mitigations, International Journal of Network Security & Its Applications 6 (3) (2014) 57–71.
N. H. Bhandari, Survey on ddos attacks and its detection & defence approaches, International Journal of Science and Modern Engineering 2 (7) (2013) 2319–6386.
B. B. G. Priyanka Negi, Anupama Mishra, Enhanced cbf packet filtering method to detect ddos attack in cloud computing environment, International Journal of Computer Science 10 (2).
D. Nashat, S. Khairy, Detecting http flooding attacks based on uniform model, in: 2021 International Conference on Networking and Network Applications (NaNA), 2021, pp. 94–98. doi:10.1109/NaNA53684.2021.00024.
L. Yang, T. Zhang, J. Song, J. S. Wang, P. Chen, Defense of ddos attack for cloud computing, in: Proc. of the IEEE International Conference on Computer Science and Automation Engineering, Vol. 2, IEEE, 2012, pp. 626–629.
A. More, S. Tapaswi, Dynamic malware detection and recording using virtual machine introspection, in: Proc. of the IEEE DSCI-Best Practices Meet, IEEE, 2013, pp. 1–6.
S. Biedermann, S. Katzenbeisser, Detecting computer worms in the cloud, in: International Workshop on Open Problems in Network Security, Springer, 2011, pp. 43–54.
K. Harrison, B. Bordbar, S. T. Ali, C. I. Dalton, A. Norman, A framework for detecting malware in cloud by identifying symptoms, in: Proc. of the IEEE DSCI-Best Practices Meet, IEEE, 2012, pp. 164–172.
H. M. Kanaker, M. M. Saudi, M. F. Marhusin, Detecting worm attacks in cloud computing environment: Proof of concept, in: Proc. of the IEEE International Conference on Control and System Graduate Research, IEEE, 2014, pp. 253–256.
P. Praveen Kumar, B. Naik, A survey on cloud based intrusion detection system, International Journal of Software and Web Sciences 4 (2) (2013) 98–102.
A. A. Shahin, Polymorphic worms collection in cloud computing, International Journal of Computer Science and Mobile Computing 3 (8) (2014) 645–652.
A. Kanwal, R. Masood, U. E. Ghazia, M. A. Shibli, A. G. Abbasi, Assessment criteria for trust models in cloud computing, in: Proc. of the IEEE International Conference on Green Computing and Communications and IEEE Internet of Things and IEEE Cyber, Physical and Social Computing, 2013, pp. 254–261.
I. M. Mary, P. Kavitha, M. Priyadharshini, V. S. Ramana, Secure cloud computing environment against ddos and edos attacks, International Journal of Computer Science and Information Technologies 5 (2) (2014) 1803–1808.

Download PDF

Reviewers agreed at journal
08 Aug, 2023
Reviewers invited by journal
04 Aug, 2023
Editor invited by journal
05 May, 2023
First submitted to journal
03 May, 2023

You are reading this latest preprint version

Impact of AAB-DDoS Attacks in a Real-Time Cloud Environment and the Mitigation Strategies

Status:

Version 1

Abstract

Figures

Introduction

Related work

In-house AAB-DDoS Attack

Algorithm for AAB-DDoS Simulation

2. Simulation of TCP flood attack: TCP flood attack can be simulated using hpinh3.

5. Mitigation of DDoS Attack

Conclusion

Declarations

References

Status:

Version 1