transmission media and cables were used: different kinds of twisted pairs between the switches and the clients, like 10BaseT, 100BaseT and 1000BaseT cables, while the Point to Point Protocol (PPP) was defined to link between the routers, and to specify the data rate and the length for some of these links. Figure : OPNET simulation package main screen The defined applications were real-time multimedia applications, where the multimedia streaming session must be initialled by the SIP protocol, these applications are located on the servers. Here in the current experiments, the defined applications were VoIP applications. Once a client wishes to start a VoIP call, requests are sent to the local SIP Proxy Servers. For some clients that were defined to behave as attackers, the defined applications for them were set to operate in an abnormal mode, such as sending too many requests during the simulation time, which can even prevent other normal clients starting at least one call during the simulation running time. Every callee should define at least one application as a supported service. A profile is used to describe how to use the predefined VoIP applications and how they behave within the simulation running time, like the time, the number of repetitions within the simulation… etc., so each profile should be attached with at least one application. Every VoIP client (UAC) wishing to initiate a call should have at least one profile. OPNET offers statistical data gathering in order to choose the type of statistics to be collected during the simulation run, depending on the need of the research of the network. For the current project, the statistics needed are mainly those related to the multimedia transmission, like SIP UAC, SIP UAS, Voice Applications or others. In every main statistic, there are sub-statistics, like the number of calls requested, or the number of calls connected or rejected, which show the effect of any DoS attack. Other statistics could be needed for some analysis related to the problem, like CPU usage and utilization, memory usage, network bandwidth represented by Ethernet load, link utilization.
SIP_X i = Δ i / α i An observation value for SPDY experimental simulation was the result of multiplication of the number of TCP streams sent by a user to a SPDY proxy server, by the average number of the resources requested per each TCP stream per time unit ( i ) . Assuming that: α i : is the total number of TCP streams sent by a user per time unit ( i ) β i : is the average of the number of the resources requested per each TCP stream per time unit ( i ) Then the input observation value for SPDY ( SPDY_X i ) is computed by: SPDY_X i = α i . β i The difference in the observation input is to show that the techniques that are used in the research are flexible in different cases. Because the scenario of SIP traffic flow is a communication, and an input value for the SIP experimental simulation is a ratio, which is a mathematical division operation as shown in equation (3.1), then (SIP_X i ) will result in tiny input values. While the scenario of SPDY traffic flow is a one-way communication, and an input value for the SPDY experimental simulation is a multiplication operation as shown in equation (3.2), then (SPDY_X i ) will result in very large input values. Cumulative Summation (CUSUM) Cumulative Summation (CUSUM) [19], [26], [41], and [56], is a sequential statistical analysis technique, which is used to monitor and to detect changes within any sequence of quantitative observations in some experiment, i.e. monitoring for any sudden increase or decrease in the number of incoming messages. CUSUM is a recursive equation, which means a new CUSUM value is dependent on the previous CUSUM values. After a new input value to the sequence of the observations is obtained, it will be used to find a new CUSUM value. CUSUM is computed according to the following equation:
: The Overall observations’ mean : A weighting factor, where 0 < ≤ 1 : The Standard deviation. L : The width of the control limits. Montgomery in [19] strongly recommended the use of the exact control limits in equations (3.12) and (3.14) for small values of i. This will greatly improve the performance of the control chart in detecting an off-target process immediately after the EWMA starts up [19]. EWMA is sometimes called a Geometric Moving Average (GMA), because the weights decline geometrically when connected by a smooth curve. The weight ( ) is a smoothing factor that controls the how quickly the old values are forgotten, so it is measure of the variability in order to capture important patterns and discard noise in the sample data. The width of the control limits ( L ) are utilised to set the threshold to detect an out of control process or most recent observation. EWMA has been used in other disciplines of science and research where the variables ( ) and ( L ) have been used in different ways and with different values. Since the EWMA chart implementation is sensitive to small shifts in the process, so choosing the previously mentioned factors can be a dilemma by itself. Some other researchers have investigated the issue of setting these factors with some recommendation, like in [19], [80], [117], and [116]. The recommendation is to assign the smoothing factor to 7/8 ( λ = 7/8 ≈ 0.9 ), and the width of the control limits to 3 ( L = 3 ) when used as an attack threshold alarm in equation (3.12), which is notated as upper theta ( Θ ), therefore an alert attention, which is notated as lower theta ( θ ), is set to 2 ( L = 2 ). Statistical Process Control and Denial of Service A Real-Time Attack Detection and Prevention System for DDoS was designed in [131]. The designed research was based on per-IP Traffic Behavioural Analysis. A new
The Session Initiation Protocol (SIP) is a two-way communication method, and it is a connection oriented data communication, which means any sent request must be acknowledged with a response. However, as the internet is a packet switching communication network, it is always possible and expected to miss a few responses for their correspondent sent requests; so within any time period, there will be always a ratio between the total number of NON-acknowledged responses and their sent requests. The previous concept is very useful to aid in detecting any sudden Denial of Service (DoS) flood towards any SIP targeted victim, when the victim gets busy in processing the received traffic, which means less acknowledged responses for every received request, and by result, this will increase the ratio of the NON-acknowledged sent responses and the received requests. Two different sets of traffic were tested in the current research; the first set was generated by the simulation methods which were used in the research, the second set of traffic was obtained from another research that adopted the same idea of SIP two-way communications [45]. The first generated set was tested into two different scenarios according to how steep is the increase of the incoming requests, and the differences between the incoming requests and the acknowledged responses. The first scenario shows the case of a sudden high steep increase in the incoming traffic with much less acknowledgments which means a subjectively large difference, and the second scenario shows the case of a low sudden steep increase in the incoming traffic with less differences in the acknowledgments. The second scenario represents a low and slow flooding DoS attack which targets a SIP victim. In each scenario, two cases were tested. The first case was by previously finding the mean ( µ ) and the standard deviation ( σ ) of the whole sequence of the observed ratios, then finding the CUSUM or EWMA values, and this case represents a system which monitors the traffic and having previous knowledge about the traffic. The second case in CUSUM or EWMA calculations is by updating the mean and the standard deviation right after getting a new observation ratio, and then finding the new CUSUM or EWMA values. Both ways of calculations have shown significant results; the first case has an advantage of reducing the overhead spent in the computations, while the advantage of the second case was to present how a system with no previous experience or knowledge of the ongoing traffic can adapt the CUSUM and EWMA to detect any sudden change in that traffic.
D. Martynov, J. Roman, S. Vaidya, and Huirong Fu, “ Design and implementation of an intrusion detection system for wireless sensor networks. ”, Electro/Information Technology, 2007 IEEE International Conference on, pp. 507, 512, 17 - 20 May 2007. D. Turk, “ Request for Comments 3882: Configuring BGP to Block Attacks. ”, IETF Informational, September 2004. Dafydd Stuttard, Marcus Pinto, “ The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws. ”, John Wiley & Sons; 2nd Edition, 5 Oct 2011. Do-Yoon Ha, Hwan-Kuk Kim, Kyoung-Hee Ko, Chang-Yong Lee, Jeong-Wook Kim, Hyun-Cheol Jeong. “ Design and Implementation of SIP-aware DDoS Attack Detection System. ”, the 2nd International Conference on Interaction Sciences: Information Technology, Proceedings of, Pages 1167 - 1171, 2009. E. Anitha, S. Malliga, “ A packet marking approach to protect cloud environment against DDoS attacks ”, Information Communication and Embedded Systems (ICICES), 2013 International Conference on , pp. 367, 370, 21 - 22 Feb. 2013 E. Walpole Ronald, H. Myers Raymond, and L. Myers Sharon. “Probability and Statistics for Engineers and Scientists.” Prentice Hall College Div; 6 Sub edition (December 31, 1997). ISBN-10: 0138402086. Eric Y. Chen. “ Detecting DoS Attacks on SIP Systems. ”, 1st IEEE Workshop on VoIP Management and Security, 2006. ETSI's official TTCN-3 homepage; web: G. A. Barnard. “ Control charts and stochastic processes. ”, Journal of the Royal Statistical Society. Series B (Methodological), vol. 21, p 239 - 271, 1959. G. E. P., Box, G. M. Jenkins, and G. C. Reinsel, “Time Series Analysis, Forecasting, and Control”, (1994). 3rd ed. Prentice-Hall, Englewood Cliffs, NJ. G. Mineki, S. Uemura, T. Hasegawa, “ SPDY accelerator for improving Web access speed.”, Advanced Communication Technology (ICACT), 2013 15th International Conference on , pp. 540, 544, 27 - 30 Jan. 2013.
J. Rosenberg, H. Schulzrinne, G. Camarillo, A. Johnston, J. Peterson, R. Spark, M.Handley, and E. Schooler, “ RFC 3261: Session Initiation Protocol ”, IETF Standards Track, Network Working Group, 2002. Jaeyeon Jung, Balachander Krishnamurthy, and Michael Rabinovich, “ crowds and Denial Of Service attacks: characterization and implications for CDNs and web sites. In Proceedings of the 11th international conference on World Wide Web (WWW '02). ACM, New York, NY, USA, 293 - 304. 2002. James F. Kurose, and Keith W. Ross, “ COMPUTER NETWORKING: A Approach.”, 6th ed. Pearson Education, 2013. M. Lucas, and Michael S. Saccucci, “ CUSUM Charts with Variable Sampling Intervals”: Discussion Technometrics by: American Statistical Association and American Society for Quality, Vol. 32, No. 4 (Nov., 1990), pp. 387 - 388. Jelena Mirkovic, Sven Dietrich, Dittrich, Peter Reiher, “ Internet Denial of Service: Attack and Defense Mechanisms ”, 1 edition, Prentice Hall; Radia Perlman Series in Computer Networking and Security, 2005. Kai Chen; Huiyu Liu; Xiaosu Chen, EBDT: A method for detecting LDoS attack ” Information and Automation (ICIA), 2012 International Conference on, pp. 911, 916, 6 - 8 June 2012. Kirk Hall, “ Standards and Industry Regulations Applicable to Certification Authorities ”, The CA Security Council (CASC), 2013. L. Ning, Su Sen, Jing Maohua, and Han Jian, “ A router based packet filtering scheme for defending against DoS attacks ”, Communications, China, vol. 11, no. 10, pp. 136, 146, Oct. 2014. L. Parrondo, “ Industrial cyber security solutions for the connected enterprise ”, Cyber Security for Industrial Control Systems, IET Seminar on , pp. 1, 27, 5 - 6 Feb. 2014. Li Wenhai; Guo Wei; Luo Xiaolei, and Li Xiang; . “ On Sliding Window Based Change Point Detection for Hybrid SIP DoS Attack. ”, IEEE Asia-Pacific Services Computing Conference (APSCC), 2010.
M. Allman, V. Paxson, and E. Blanton, “ Request for Comments 5681: TCP Congestion Control ”, IETF Standards Track, September 2009. M. Allman, V. Paxson, and W. Stevens, “ Request for Comments 2581: TCP Congestion Control ” , IETF Standards Track, April 1999. M. Beaumont - Gay, “A Comparison of SYN Flood Detection Algorithms”, Internet Monitoring and Protection, 2007. ICIMP 2007. Second International Conference on, pp. 9, 9, 1 - 5 July 2007. M. E. Camargo, W. P. Filho, A. I. dos Santos Dullius, J. Maciel, and M. Pinto, “ Statistical quality control: A case study research. ”, Management of Innovation and Technology, 2008. ICMIT 2008. 4th IEEE International Conference on, pp. 746, 750, 21 - 24, Sept. 2008. M. G. Solomon and M. Chapple, “Information Security Illuminated”, AND BARTLETT PUBLISHERS, 2005. M. Handley and E. Rescorla, “RFC4732: Internet Denial-of-Service Considerations”, Internet Architecture Board (IAB). November 2006. M. Roesch, “ – lightweight intrusion detection for networks. ”, 13th USENIX LISA Conference, 1999. M. Smith, “ Further Mitigating Router ND Cache Exhaustion DoS Attacks Using Solicited-Node Group Membership. ”, IETF Informational Internet-Draft , April 2014. M. Srivatsa, A. Iyengar, Jian Yin, and Ling Liu, “ A Client-Transparent Approach to Defend Against Denial of Service Attacks. ”, Reliable Distributed Systems, 2006. SRDS '06. 25th IEEE Symposium on , pp. 61, 70, 2 - 4 Oct. 2006. Mike Belshe, “ SPDY and What to Consider for HTTP / 2.0 ”, IETF proceedings slides, 2013. Mike Belshe, “SPDY, TCP, and the Single Connection Throttle ”, IETF proceedings slides, 2011. Mohammed A. and Azizah Abdul Manaf, “ Optimal specifications for a protective framework against HTTP-based DoS and DDoS attacks ”, Biometrics
P. T. Conrad, G. J. Heinz, A. L. Caro Jr. , P. D. Amer, J. Fiore, “SCTP in battlefield networks”, Military Communications Conference, 2001. MILCOM 2001. Communications for Network-Centric Operations: Creating the Information Force. IEEE, pp. 289 , 295 vol. 1 , 2001 P. Watson, “ Slipping in the Window: TCP Reset attacks ”, a presentation at CanSecWest 2004. P. Yee, “ Request for Comments 6818: Updates to the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile ”, IETF Standards Track, January 2013. R. Bush, and D. Meyer “RFC 3439: Some Internet Architectural Guidelines and Philosophy”. December 2002. R. Gieben, and W. Mekking, “ Request for Comments 7129: Authenticated Denial of Existence in the DNS. ”, IETF Informational, February 2014. R. Maheshwari, C. R. Krishna, M. S. Brahma, “ Defending network system against IP spoofing distributed DoS attacks using DPHCF - RTT packet filtering technique ”, Issues and Challenges in Intelligent Computing Techniques (ICICT), 2014 International Conference on , pp. 206, 209, 7 - 8 Feb. 2014. R. R. Ferreira Lopes, R. Stoud Platou, S. Hendseth, N. M. Torrisi, K. Nyborg Gregertsen, and G. Mathisen, “ Deploying third party services at smart grids end users using broadband links. ”, Innovative Smart Grid Technologies Europe (ISGT EUROPE), 2013 4th IEEE/PES, pp. 1, 5, 6 - 9 Oct. 2013. Rajeev Bector, “ Challenges with SPDY deployment ”, IETF proceedings slides, 2012. Ronald E. Walpole, Raymond H. Myers, and Sharon L. Myers. “ Probability and Statistics for Engineers and Scientists. ” Prentice Hall College Div; 6 Sub edition December, 1997. ISBN - 10: 0138402086. S. Friedl, A. Langle,y A. Popov, and E. Stephan, “ Request for Comments 7301: Transport Layer Security (TLS) Application-Layer Protocol Negotiation Extension. ”, IETF Standards Track, July 2014.
S. V. Crowder, “A Simple Method for Studying Run-Length Distributions of Exponentially Weighted Moving Average Charts,” Techno metrics, 1987, Vol. 29 (4), pp. 401 – 407. S. V. Crowder, “Computation of ARL for Combined Individual Measurement and Moving Range Charts,” Journal of Quality Technology, 1987, Vol. 19 (1), pp. 98 S. W. Roberts, “Control Chart Tests Based on Geometric Moving Averages,” Techno metrics 1959, Vol. 42 (1), pp. 97 – 102. Floyd, V. Jacobson, “Random early detection gateways for congestion avoidance”, Networking, IEEE/ACM Transactions on , vol. 1, no. 4, pp. 397, 413, Aug 1993 SPDY, The Chromium Projects: web , accessed on October 2014. Sui Song, Li Ling, and C. N. Manikopoulo, “ Statistical Aggregation Schemes for Network Anomaly Detection ”, Networking, Sensing and Control, 2006. ICNSC '06. Proceedings of the 2006 IEEE International Conference on , pp. 786 -791, 2006. Sumei Zhang; Hua Li; Yu Xue; Xianrong Wang, “ Using TTCN - 3 to Test SPDY Protocol Interaction. ”, PropertyComputer Software and Applications Conference Workshops (COMPSACW), 2014 IEEE 38th International , pp. 541, 546, 21 - 25 July 2014. Sven Ehlert, Chengjian Wang, Thomas Magedanz, and Dorgham Sisalem. “ Specification-based Denial-of-Service Detection for SIP Voice-over-IP Networks. ”, Third International Conference on Internet Monitoring and Protection, 2008. Sven Ehlert, Dimitris Geneiatakis, and Thomas Magedanz, “ Survey of network security systems to counter SIP-based denial-of-service attacks ”, Computers & Security, Elsevier Journal on, Volume 29, Issue 2, Pages 225, 243. March 2010. Sven Ehlert, Ge Zhang a, Dimitris Geneiatakis, Georgios Kambourakis, Tasos Dagiuklas, Jirˇi Markl, Dorgham Sisalem, “ Two layer Denial of Service prevention on SIP VoIP infrastructures. ”, Computer Communications 31, 2008.
Sven Ehlert, Ge Zhang, T. Magedanz. “ Increasing SIP firewall performance by rule set size limitation. ”, PIMRC 2008, IEEE 19th International Symposium on Personal, Indoor and Mobile Radio Communications, 2008. Sven Ehlert, Yacine Rebahi, and Thomas Magedanz, “ Intrusion Detection System for Denial-of-Service flooding attacks in SIP communication networks ”, International Journal of Security and Networks, 2009. Syed A. Ahson, and Mohammad Ilyas, “ SIP Handbook: Services, Technologies, and Security of Session Initiation Protocol ”, CRC Press, Oct. 2012. T. Guillet, A. Serhrouchni and, M. Badra, “ Mutual Authentication for SIP: A Semantic Meaning for the SIP Opaque Values. ”, New Technologies, Mobility and Security, 2008. NTMS '08. , pp. 1, 6, 5 - 7 Nov. 2008 T. Krovetz, “ Request for Comments 4418: UMAC: Message Authentication Code Universal Hashing ”, IETF Informational document, March 2006. T. Yatagai, T. Isohara, and Iwao Sasase, “ Detection of HTTP-GET flood Attack Based on Analysis of Page Access Behavior ”, Communications, Computers and Signal Processing, 2007. PacRim 2007. IEEE Pacific Rim Conference on , pp. 232, 235, 22 - 24 Aug. 2007 TERENA, “ SIP Handbook A practical guide to setting up a safe VoIP and videoconferencing server: the NREN-Enhanced Communications Server or N-ECS” TERENA Task Force on Enhanced Communication Services – TF-ECS, September 2008. The Apache Software Foundation, . The Opportunistic Network Environment (ONE) simulator, web: V. K. Gurani, P. G. Shynu, and C. L. Chowdhary, “ Monitoring application for DoS attacks using group testing. ”, Electronics and Communication Systems (ICECS), 2014 International Conference on , pp. 1, 4, 13 - 14 Feb. 2014 V. Paxson, and M. Allman, “Request for Comments 2988: Computing TCP's Retransmission Timer ”, IETF Standards Track, November 2000. V. Paxson, M. Allman, J. Chu, M. Sargent, “ Request for Comments: 6298 Computing TCP's Retransmission ”, IETF Standards Track, June 2011.
V.Jacobson, ‘‘Congestion Avoidance and Control,’’ SIGCOMM ’88 Conf., ACM, pp. 314 – 329, 1988. W. Eddy. “ RFC4987:TCP SYN Flooding Attacks and Common Mitigations.“, IETF standards Track , August 2007. W. So, Ashok Narayanan, and David Oran, “ Named data networking on a router: Fast and DoS-resistant forwarding with hash tables ”, Architectures for Networking and Communications Systems (ANCS), 2013 ACM / IEEE Symposium on , pp. 215, 225, 21 - 22 Oct. 2013 W3Schools Online Web Tutorials. Web: Web: last accessed on October 2014 William W. Streilein, David J. Fried, Robert K. Cunningham, “Detecting Denial-of-Service Attacks with SNMP / RMON ”, Computing Science and Statistics Volume 35 Security and Infrastructure Protection Proceedings of the 35th Symposium on the Interface Salt Lake City, Utah, 12 - 15 March, 2003. World Wide Web Consortium (W3C). Web: Xiaoyong Wu; V. A. Mahadik, D. S. Reeves, “ A summary of detection of attacks on DiffServ networks. ”, Information Survivability Conference and Exposition, 2003. Proceedings on , vol. 2, pp. 277, 282 vol. 2, 22 - 24. April 2003 Xuan Chen, and John Heidemann, “Flash crowd mitigation via adaptive admission control based on application-level observations ”, Internet Technology (TOIT), ACM Transactions on, Volume 5 Issue 3, Pages 532 - 569, August 2005. Y. Elkhatib, G. Tyson, M. Welzl, “ Can SPDY really make the web faster ? ”, Networking Conference, 2014 IFIP , pp. 1, 9, 2 - 4 June 2014 Y. Ohsita, S. Ata, M. Murata, “Detecting distributed denial-of-service attacks by analysing TCP SYN packets statistically. ”, Global Telecommunications Conference, 2004. GLOBECOM '04. IEEE , vol. 4, pp. 2043, 2049 Vol. 4, 29 Nov. Dec. 2004. Y. Suga, “ SSL / TLS Status Survey in - Transitioning against the Renegotiation Vulnerability and Short RSA Key Length Problem, ” , Information