International Journal of Advanced Research in Engineering RESEARCH and Technology IN (IJARET), ISSN 0976 INTERNATIONAL JOURNAL OF ADVANCED ENGINEERING

G 6480(Print), ISSN 0976 6499(Online) Volume 5, Issue 2, February (2014), pp. 79-86, IAEME

AND TECHNOLOGY (IJARET)

ISSN 0976 - 6480 (Print) ISSN 0976 - 6499 (Online) Volume 5, Issue 2, February (2014), pp. 79-86 IAEME: www.iaeme.com/ijaret.asp Journal Impact Factor (2014): 4.1710 (Calculated by GISI) www.jifactor.com

IJARET
IAEME

EARLY DETECTION OF SYN FLOODING ATTACK BY ADAPTIVE THRESHOLDING (EDSAT): A NOVEL METHOD FOR DETECTING SYN FLOODING BASED DOS ATTACK IN MOBILE AD HOC NETWORK
Dr. Sandip Nemade#1,
#1

Prof. Manish Kumar Gurjar*2, Prof. Nishanth N#4

Zareena Jamaluddin#3,

HOD, E&C Department, TIT College, Bhopal. RGTU University, Bhopal, India Assistant Professor, E&C Department, TIT College, Bhopal. RGTU University, Bhopal, India #3 Student M.Tech, E&C Department, TIT College, Bhopal. RGTU University, Bhopal, India #4 Assistant Professor, Department of ECE, TKM College of Engineering, Kollam, Kerala
#2

ABSTRACT Today Denial of Service (DoS) is the most common method of attack performed by intruders in a network. In areas were resources are constrained, these attacks can have catastrophic effects. Such is the case with Mobile Ad Hoc Networks (MANET). MANETs are characterized by their limited amount of computing power and memory. SYN flooding is a kind of denial of service (DoS) attack found in MANETs at the transport layer level. In this attack, the attacker tries to overflow the target buffer by sending a large number of SYN packets with spoofed addresses. An adaptive threshold algorithm is commonly used to detect SYN flooding attack in which an alarm is raised whenever the number of SYN packets increases abnormally. Optimization of the algorithm for better results is the major area of research in adaptive thresholding. This paper aims to develop an optimized adaptive threshold algorithm by optimizing the tuning parameters available. Keywords: Mobile Ad Hoc Network, Denial of Service (DoS) attack, spoofing, SYN flooding, Adaptive threshold. I. INTRODUCTION

The vision of Ubiquitous computing has stimulated much interest in mobile ad hoc networking (MANET) technology. It can turn the dream of getting connected anywhere at anytime into reality. In comparison with fixed wireless network, there is no master slave relationship that exists in the MANET. All network activities, such as discovering the topology and delivering data packets, have to be executed by the nodes themselves, either individually or collectively. MANETs
79

International Journal of Advanced Research in Engineering and Technology (IJARET), ISSN 0976 6480(Print), ISSN 0976 6499(Online) Volume 5, Issue 2, February (2014), pp. 79-86, IAEME

are widely deployed in military battlefield, emergency services like search and rescue mission, cooperative mobile communication etc. Now a days they are also widely used in hotels, superstore, offices and airport because they allow easy collaboration and efficient communication on the fly without need for costly infrastructure. In summary, the unique characteristics of MANETs present a new set of nontrivial challenges to security design. These challenges include open network architecture, shared wireless medium, stringent resource constraints, and highly dynamic network topology. Nodes roaming freely in a hostile environment with relatively poor physical protection pose vulnerability for MANET [1]. II. ATTACKS IN MANET

The security attacks in MANET can be classified in different ways A. Passive attacks In a passive attack an unauthorized node monitors and aims to find out information about the network. The attackers do not otherwise need to communicate with the network. Hence they do not disrupt communications or cause any direct damage to the network. However, they can be used to get information for future harmful attacks. Examples of passive attacks are eavesdropping and traffic analysis. B. Active attacks These attacks cause unauthorised state changes in the network such as denial of service, modification of packets, and the like. These attacks are generally launched by users or nodes with authorisation to operate within the network. We can classify active attacks into four groups: dropping, modification, fabrication, and timing attacks. C. Transport layer attacks The security issues related to transport layer are authentication, securing end-to-end communications through data encryption, handling delays, packet loss and so on. The transport layer protocols in MANET provides end-to-end connection, reliable packet delivery, flow control, congestion control and clearing of end-to-end connection. Various attacks possible in transport layer are SYN Flooding based Dos attack, Distributed DoS attack, Session Hijacking and TCP ACK storm [2]. 1) SYN flooding based DoS attack It exploits the weakness in TCP specifications. In TCP, a node communicates with a remote node (i.e., a server) by way of a virtual connection established through a process called a 3-way handshake which is illustrated in figure 1(a). When a server receives a SYN packet from a client, the connection is considered to be half-open state for a period of up to the TCP connection timeout, which is typically set to 75 seconds. The server has built in its system memory a backlog queue to maintain all half-open connections.

Fig. 1(a): 3-Way Handshake

80

International Journal of Advanced Research in Engineering and Technology (IJARET), ISSN 0976 6480(Print), ISSN 0976 6499(Online) Volume 5, Issue 2, February (2014), pp. 79-86, IAEME

Fig. 1(b): SYN Flooding Attack In SYN flooding based DoS attack, an attacker will send a large number of spoofed SYN packets to the victim server. Since the SYN request is spoofed, the victim server will never receive the final ACK packet from the client to complete the 3-way handshake as shown in figure 1(b). Since the backlog queue of victim server is of finite size, flooding of spoofed SYN requests can easily exhaust the victim servers backlog queue, causing all of new incoming legitimate SYN request to be dropped. In addition to SYN flooding attack, UDP flooding, Smurf attack and ICMP flooding (Ping flooding) also pose a major threat in MANET. D. Organisation of paper In Section III, we provide some related works on detection of SYN flooding based DoS attack in MANET. In section IV, we explain our proposed work early detection of SYN flooding based DoS attack. Experimental result is provided in section V. Section VI summarizes the paper. III. RELATED WORKS ON SYNFLOODING BASED DOS ATTACK AND ITS DETECTION

During SYN flooding based DoS attack, the normal behaviour of the network is affected seriously. Thus, during the attack, traffic volume increases abnormally, network status like packet delay, dropping rate, etc also increases due to congestion in the network. Rajesh et al. [3] proposes a method to detect the attack based on network status such as packet delay, dropping rate etc. Shin et al. [4] proposes a method which monitors the number of SYN packets and the change in the ratio of SYN packets to other type TCP packets. Through their expiriments, Ohista et al. [5] claims that the distribution of SYN packet rate of normal traffic can be modelled by the normal distribution. But the SYN packet rate distribution of DoS attack traffic deviates far from a normal distribution. To perform efficient DoS/DDoS attacker traceback in highly constrained MANET environment, several traceback schemes are developed. Zone Sampling Based attacker Traceback (ZSBT) [6] proposed by Xin Jin et al. is an extended version of probabilistic packet marking (PPM) [7] approach particularly deployed in the MANET environment. In this method, when a node forwards a packet, the node writes its zone ID into the packet with a probability. After receiving these packets, the victim can reconstruct the path between the attacker and itself. Kim and Helmy have proposed a small worldbased attacker traceback (SWAT) [8] approach to trace DoS attacker in MANET. They use traffic pattern matching (TPM) and traffic volume matching (TVM) as matching-in-depth techniques to traceback DoS attackers. Later, an improved traceback protocol developed by the same team called ATTENTION [9] which uses MAC layer abnormality for tracing the attacker.

81

International Journal of Advanced Research in Engineering and Technology (IJARET), ISSN 0976 6480(Print), ISSN 0976 6499(Online) Volume 5, Issue 2, February (2014), pp. 79-86, IAEME

IV.

EARLY DETECTION OF SYN FLOODING BY ADAPTIVE THRESHOLDING (EDSAT)

DoS attack detection applications are commonly based on anomaly detection models, where the behaviour of a measurable network characteristic is compared to its normal behaviour, and an alarm is raised when a significant deviation from normal behaviour is detected. We are using an optimised version of the adaptive threshold algorithm. If the number of packets increases the threshold level, then an alarm is raised. We used SYN Arrival Rate (SAR) as the measuring parameter for the early detection of SYN flooding attack. In order to account for seasonal (daily and weekly) variations and trends, the value of the threshold is set adaptively based on an estimate of the mean number of SAR, which is computed from recent traffic measurements. If xn is the SAR in the nth time interval, and n-1 is the mean SAR estimated from measurements prior to n, then the alarm condition is given by: xn (+1) n-1 Then alarm is signalled at time n. Here, 0 is a parameter; this indicates the percentage above the mean value that we consider to be an indication of an anomalous behaviour. The mean SAR n, can be computed over some past time window or by using an exponentially weighted moving average (EWMA) of previous measurements. Mean SAR, n = n-1 + (1-) xn, where is the EWMA factor. Direct application of the above algorithm would yield a high number of false alarms (false positives). A simple modification that can improve its performance is to signal an alarm after a minimum number of consecutive violations of the threshold, say k. The changeable parameter of the above algorithm are the threshold factor for calculating the successive threshold, the number of successive threshold violations k before signalling an alarm, the EWMA factor , and the length of the time interval over which SYN packets are diagnosed. Since the exponential weighted moving average plays an important role in setting the adaptive threshold, tuning of the EWMA factor is very much important. Experimentally, we got = 0.22 and = 0.89 which reduces the number of false alarms. V. EXPERIMENTAL RESULTS

For detecting SYN flooding based DoS attack, we will classify the incoming packets as TCP, UDP and ICMP packets based on the protocol field in IP header (For ICMP packets protocol field is 1, for TCP packets protocol field is 6 and for UDP packets protocol field is 11 (hex)). Since we are interested in detecting SYN flooding based DoS attack, we will deal with TCP packets only. So, incoming TCP packets are classified into TCP control segments and TCP data segments using offset field and total length field in IP header. TCP control segments are again classified into TCP SYN, FIN and RST packets based on TCP flag bits in TCP header. Then, we will calculate the SYN Arrival Rate (SAR) which is defined as the ratio of incoming SYN segment to total number of incoming TCP segments. We verified the above attack detection algorithm by conducting experiments in the lab. The experiment is conducted for studying the SYN Arrival Rate (SAR) for the normal traffic in our lab. For finding SAR for the normal traffic, we conducted the experiment for 20 days capturing around 5000 packets per day. That is, 10 samples are taken per day capturing 500 packets per sample. Typical arrangement for conducting the experiments is shown in Fig. 2.

82

International Journal of Advanced Research in Engineering and Technology (IJARET), ISSN 0976 6480(Print), ISSN 0976 6499(Online) Volume 5, Issue 2, February (2014), pp. 79-86, IAEME

Fig 2: Arrangement for conducting the experiment Even though tcpdump can be used for the analysis of TCP traffic in the network, we developed a packet capture program written in C language for our convenience. After studying the SYN Arrival Rate (SAR) for normal traffic, we injected attack traffic on day 21 using a tool called Hping3. We conducted SYN flooding attack as well as ICMP flooding attack using Hping3 tool. We took 200 samples of the attack traffic capturing 500 packets per sample for the convenience of comparison. SAR is compared for normal traffic and traffic in presence of flooding attack which is as shown in Fig. 3.

Fig. 3: Comparison for SAR before and after flooding attack A typical screen shot of the experiment conducted in our lab is as shown in Fig. 4. The SAR for normal traffic was around 0.07.

83

International Journal of Advanced Research in Engineering and Technology (IJARET), ISSN 0976 6480(Print), ISSN 0976 6499(Online) Volume 5, Issue 2, February (2014), pp. 79-86, IAEME

Fig. 4: Screenshot of experiment before attack SYN flooding attack is done using Hping3 at the rate 10 SYN packets per second. It is observed that, in the presence of attack, SAR is around 0.67 which is as shown below. Now, mean SAR is computed using exponential weighted moving average (EWMA). By using Adaptive Threshold Algorithm optimised for considering seasonal variations, any anomaly in mean SAR is identified.

Fig. 5: Screenshot of experiment after attack

84

International Journal of Advanced Research in Engineering and Technology (IJARET), ISSN 0976 6480(Print), ISSN 0976 6499(Online) Volume 5, Issue 2, February (2014), pp. 79-86, IAEME

Observations Mean SAR for normal traffic: 0.07 Mean SAR for normal traffic: 0.67 We compared our optimised Adaptive Threshold algorithm with CUSUM algorithm and adaptive threshold algorithm. It is found that false alarm probability is very much less for our EDSAT method.

Fig. 6: Comparison of false alarm probability for EDSAT, CUSUM and adaptive threshold algorithm VI. CONCLUSION

In this paper, we proposed EDSAT, a novel method for early detection of SYN flooding based DoS attack using adaptive thresholding. SYN flooding based DoS is a major problem in MANET due to its limited resource constraints. Detection of flooding attack is to be made as early as possible in order to perform preventive measures to avoid more damage in the network. EDSAT enables us to consider the seasonal variations in SAR in the network. By tuning the parameters like and , early detection of SYN flooding attack can be made with lower false alarm. In our experiments, we got = 0.22 and = 0.89. REFERENCES [1] P. Venkataram, N. Nishanth, Mobile Agent based TCP attacker Identification in MANET using traffic history (MAITH) 2011 IEEE 13th International Conference on Communication Technology (ICCT), 25-28 Sept. 2011, Jinan, China H. Wang, D.Zhang, and K.G.Shin, Detecting SYN flooding attacks, Proceedings of IEEE INFOCOM 2002, pp.1530-1539, June 2002. Talpade Rajesh, Kim G, Khurana S. NOMAD: Traffic-based network monitoring framework for anomaly detection. Computers and Communications, Proceedings. IEEE International Symposium, 1999: 442-451. Seung- won Shin, Ki- young Kim, Jong- soo Jang. D- SAT: Detecting SYN flooding attack by two-stage statistical approach. Applications and the Internet, The 2005 Symposium, 2005: 430-436.

[2] [3]

[4]

85

International Journal of Advanced Research in Engineering and Technology (IJARET), ISSN 0976 6480(Print), ISSN 0976 6499(Online) Volume 5, Issue 2, February (2014), pp. 79-86, IAEME

[5]

Y. Ohista , S. Ata, and M. Murata, Detecting Distributed Denial-of- Service Attacks by Analyzing TCP SYN Packets Statistically, Proceeding of the IEEE Communications Society Globecom, pp. 2043-2049, 2004. [6] X. Jin, Y. Zhang, Y. Pan, and Y. Zhou, ZSBT: A novel algorithm for tracing DoS attackers in MANETs, EURASIP Journal on Wireless Communications and Networking, vol. 2006 [7] S. Savage, D. Wetherall, A. Karlin, and T. Anderson, Network support for ip traceback, IEEE/ACM Trans. Netw., vol. 9. [8] Yongjin, V. Sankhla, and A. Helmy, Effcient traceback of dos attacks using small worlds in manet, in Vehicular Technology Conference, 2004.VTC2004- Fall. 2004 IEEE 60th, vol. 6, 2004. [9] Yongjin Kim, Ahmed Helmy, ATTENTION: ATTackEr Traceback using MAC Layer AbNormality DetecTION. [10] Prof. S.B. Javheri and Shwetambari Ramesh Patil, Attacks Classification in Network, International Journal of Information Technology and Management Information Systems (IJITMIS), Volume 4, Issue 3, 2013, pp. 1 - 11, ISSN Print: 0976 6405, ISSN Online: 0976 6413. [11] Sharada Valiveti, Hetuk Upadhyay and Dr. K Kotecha, Analyzing The Performance of Bandwidth Starvation Attack in Lan, International Journal of Advanced Research in Engineering & Technology (IJARET), Volume 5, Issue 1, 2013, pp. 145 - 153, ISSN Print: 0976-6480, ISSN Online: 0976-6499. [12] Nada M. Badr and Noureldien A. Noureldien, Review of Mobile Ad Hoc Networks Security Attacks and Countermeasures, International Journal of Computer Engineering & Technology (IJCET), Volume 4, Issue 6, 2013, pp. 145 - 155, ISSN Print: 0976 6367, ISSN Online: 0976 6375.

86