Dynamic Detection and Protection Mechanism against Distributed Denial of Service Attacks using Fuzzy Logic

DDoS (Distributed Denial of Service) is the attack to pollute the network. The attacker creates a large amount of packet to the particular system. The packets are sending by using the compromised computers. It is an effort to make a device or network resource engaged to its intended users. This paper describes training the DDoS attack detection system to recognize possible attacks on a system. The objective of this paper is to develop practical and scalable mechanisms to identify the DoS or DDoS attack sources. This paper includes implementation of traceback system in Single ISP domain, Multi ISP domain, and stateless Internet architecture and enhancing security features. The proposed system is offered to trace-back method based on entropy variations and fuzzy logic method. The system works on different between the normal data flow and attacking data flow. It has a number of advantages such as avoid packet pollution, no need to change the current routing software. Through empirical evaluation it is confirmed that the detection can be completed within improved real time limits and that by using fuzzy estimators instead of crisp statistical descriptors it can be avoided the shortcomings posed by hypothesis on the model distribution of the traffic. Keyword: DDoS Attacks, ICMP (Internet Control Message Protocol), CP (Cumulative path), Probabilistic Packet Marking (PPM) and Deterministic Packet Marking (DPM) INTRODUCTION Distributed Denial of Service attacks in the internet to pollute the network environment. The attackers generate a huge amount of requests to victims through compromised computers (zombies), with the aim of denying normal service. DDoS attacks are targeted to identify the victim resources, such as bandwidth, memory, and buffer. The attacker needs to attack the victim attacker to establish a large number of request send to the victim. So the attacker needs a multiple system to produce a request. The attacker discovers a large number of vulnerable systems in the same network. These discoverable systems are called as Zombies. The attacker installs the new program to the discovered system for attacking the victim in the network. The vulnerable system is identified by out dated antivirus using system or secure less system [3]. IP traceback is a name given to any method for reliably determining the origin of a packet on the Internet. Due to the trusting nature of the IP protocol, the source IP address of a packet is not authenticated. As a result, the source address in an IP packet can be falsified (IP address spoofing) allowing for Denial of Service attacks or one-way attacks (where the response from the victim host is so well known that return packets need not be received to continue the attack). The problem of finding the source of a packet is called the IP traceback problem. IP Traceback is a critical ability for identifying sources of attacks and instituting protection measures for the Internet. Most existing approaches to this problem have been tailored toward Denial of Service attack detection. Such solutions require high numbers of packets to converge on the attack path(s). The network does not have effective method to locate the attacker such as hash Based IP Trace back, algebraic approach to IP trace back and Enhanced ICMP trace back as Cumulative Path. The attacker used this advantage and attacks the network. The IP traceback scheme is presently used to identify the attackers. IP traceback schemes are considered successful if they can identify the zombies from which the DDoS attack packets entered the internet and that trace back scheme is easily identified the attacker. In the existing system two types of packet marking are used viz, Probabilistic Packet Marking (PPM) and Deterministic Packet Marking (DPM). Both of these packets marking require router by the marking to the individual packets. The PPM packet marking can only operate in a small network. So, the detector or protector does not trace out the attacker. The network is very small it does not identify the attacker location, when that person present away from the network and the method is called DPM. The packet marking is require to all routers are updated by the packet marking technique. This DPM only 25 spare bits is available to the single IP packet with the scalability of the DPM is very huge problem [22]. IP traceback mechanism should be independent of the packet pollution and different types of attack patterns. DPM mechanism poses the extraordinary challenge on storage for packet. Once the attack started is found the different between the attack flow and the normal flow. In this IP traceback mechanism the entropy variation or different flows of the network and there is no packet marking are used. It avoids the problem of the packet marking method. The packets are passing through the router into flows, which are defined by the router where the packet came from the destination address of the packet. During the non attack period the router observes the normal flows. When the DDoS attacks occur the victim send request to the upstream routers, then the router identifies the attack flow path and the process was repeated again because to find the number of attackers in the network. PACKET MARKING SYSTEM In packet marking method traceback data is inserted into the IP packet by the routers on the path to the destination node. International Journal of Applied Engineering Research ISSN 0973-4562 Volume 11, Number 7 (2016) pp 5332-5337 © Research India Publications. http://www.ripublication. com 5333 The packets are marked as they traverse routers through the internet either probabilistically or deterministically. Packet marking information is stored in the identification field of the IP header. The routers mark the packet with either the router‟s IP address or the edges of the path that the packet traversed to reach the Destination / Victim. The victim uses the information in the marked packets to trace an attack back to its source. For the first alternative, marking packets with the router's IP address, analysis shows that in order to gain the correct attack path with 95% accuracy as many as 294, 000 packets are required. The second approach, edge marking, requires that the two nodes that make up an edge mark the path with their IP addresses along with the distance between them. This approach would require more state information in each packet than simple node marking but would converge much faster. Types of packet marking are Probabilistic Packet Marking (PPM) and Deterministic Packet Marking DPM. Deterministic Packet Marking approach focuses on determining the source of the attack packet and is not concerned with the actual path traversed by the attack packet, while the Probabilistic Packet Marking approach focuses on reconstructing the entire attack path through which the malicious packets have traversed. The DPM mark the spare space with initial router information. The receiver can identify the source location of the packets when it has sufficient information of the marks. The big problem in DPM is changing the current routing software. The problem of the DPM is due to the requirement of large number of packet reconstruction. Every routers mark the own IP address of the packets header. The node sampling algorithm is used to record the router address of the packet. There large number of marked packets can do the reconstruction of the attack path. The edge sampling algorithm is used to mark the start router address to the end router address of the attack path and the distance is fixed in between the two ends [24]. It provider based deterministic packet marking models-to characterize DDoS attack streams-used to make filtering near the victim more effective. The proposed FUZZY BASED DETECTION mechanism has a rate control scheme that protects destination domains by limiting the amount of traffic during an attack, while leaving a large percentage of legitimate traffic unaffected. The above features enable service providers to offer enhanced security protection against DDoS attacks as a value-added service to their customers, hence offer positive incentives for them to deploy the proposed models. The Scheme proposes and evaluates two providers-based packet marking models: Source-End Provider Marking and Source and Destination-End Provider Marking. Both models are based on deterministic packet marking, and aim to give the victim‟s provider stable and secure information about the path incoming traffic streams. The Scheme also proposes a rate control system that protects destination domains by limiting the amount of traffic during an attack, while leaving a large percentage of legitimate traffic unaffected. These facilitate providers to offer increased protection to their customers as a value-added service, improving the available throughput for legitimate users during such attacks. Path Identifier (PI) a packet marking approach in which a path fingerprint is embedded in each packet, enabling a victim to identify packets traversing the same paths through the Internet on a per packet basis, regardless of source IP address spoofing. In this approach an identifier is embedded in each packet based on the router path that a packet traverses. The victim needs only to classify a single packet as malicious to be able to filter out all subsequent packets with the same marking. What makes this possible is that our packet marking is a perpacket deterministic mechanism: each packet traveling along the same path carries the same identifier. This allows the victim to take a proactive role in defending against a DDoS attack by using the Pi mark to filter out packets matching the attackers‟ identifiers on a per packet basis. Most marking schemes are probabilistic in nature, in which the victim needs to collect a large number of packets to reconstruct the path. In this approach, a path identifier fits within a single packet so that the victim can immediately fil