Enhancement of the detection of the TCP SYN flooding (DDoS) attack
Joint Authors
Ali, Hamid M.
Ibrahim, Ibrahim Qasim
Ahmad, Sarah W. A.
Source
Issue
Vol. 19, Issue 6 (30 Jun. 2013), pp.786-794, 9 p.
Publisher
University of Baghdad College of Engineering
Publication Date
2013-06-30
Country of Publication
Iraq
No. of Pages
9
Main Subjects
Information Technology and Computer Science
Topics
Abstract AR
معظم ال (DDoS attacks) تستخدم ال (TCP protocol) و ال (TCP SYN flooding attack) هو الأكثر شيوعا من بينهم تستخدم طريقة ال (SYN Cookie) للحماية من ال (TCP SYN flood).
ال (SYN Cookie) طريقة دفاع فعالة و لكن نقطة ضعفها أن حساباتها تستغرق وقت طويل و لا تمييز ال (Packets) المزورة عن الشرعية, لذا, تصفية ال (Packets) المزورة, و نقطة ضعفها أنها لا تعتبر حل كامل و نهائي لحماية ال (Server) من ال (TCP SYN flooding attack).
تم اقتراح طريقة مكونة من تكامل و دمج ال (SYN Cookie) و ال (HCF) لحماية ال (server) من ال (TCP SYN flooding).
حيث أظهرت النتائج تحسن في الدفاع ضد ال (SYN flooding), و ذلك بزيادة عدد ال (Packets) الشرعية إضافة إلى تأخير وقت تفعيل ال (SYN Cookie).
Abstract EN
The major of DDoS attacks use TCP protocol and the TCP SYN flooding attack is the most common one among them.
The SYN Cookie mechanism is used to defend against the TCP SYN flooding attack.
It is an effective defense, but it has a disadvantage of high calculations and it doesn’t differentiate spoofed packets from legitimate packets.
Therefore, filtering the spoofed packet can effectively enhance the SYN Cookie activity.
Hop Count Filtering (HCF) is another mechanism used at the server side to filter spoofed packets.
This mechanism has a drawback of being not a perfect and final solution in defending against the TCP SYN flooding attack.
An enhanced mechanism of Integrating and combining the SYN Cookie with Hop Count Filtering (HCF) mechanism is proposed to protect the server from TCP SYN flooding.
The results show that the defense against SYN flood DDoS attack is enhanced, since the availability of legitimate packets is increased and the time of SYN Cookie activity is delayed.
American Psychological Association (APA)
Ali, Hamid M.& Ibrahim, Ibrahim Qasim& Ahmad, Sarah W. A.. 2013. Enhancement of the detection of the TCP SYN flooding (DDoS) attack. Journal of Engineering،Vol. 19, no. 6, pp.786-794.
https://search.emarefa.net/detail/BIM-336054
Modern Language Association (MLA)
Ali, Hamid M.…[et al.]. Enhancement of the detection of the TCP SYN flooding (DDoS) attack. Journal of Engineering Vol. 19, no. 6 (Jun. 2013), pp.786-794.
https://search.emarefa.net/detail/BIM-336054
American Medical Association (AMA)
Ali, Hamid M.& Ibrahim, Ibrahim Qasim& Ahmad, Sarah W. A.. Enhancement of the detection of the TCP SYN flooding (DDoS) attack. Journal of Engineering. 2013. Vol. 19, no. 6, pp.786-794.
https://search.emarefa.net/detail/BIM-336054
Data Type
Journal Articles
Language
English
Notes
Includes bibliographical references : p. 794
Record ID
BIM-336054