ABOUT JoVE

Overview Leadership Blog JoVE Help Center

AUTHORS

Publishing Process Editorial Board Scope & Policies Peer Review FAQ Submit

LIBRARIANS

Testimonials Subscriptions Access Resources Library Advisory Board FAQ

RESEARCH

JoVE Journal Methods Collections JoVE Encyclopedia of Experiments Archive

EDUCATION

JoVE Core JoVE Business JoVE Science Education JoVE Lab Manual Faculty Resource Center Faculty Site

Terms & Conditions of Use

DDoS Flood and Destination Service Changing Sensor | JoVE Visualize

Home
Research Domains
Engineering

DDoS Flood and Destination Service Changing Sensor

Fu-Hau Hsu¹, Chia-Hao Lee¹, Chun-Yi Wang¹

¹Department of Computer Science and Information Engineering, National Central University, No.300, Zhongda Rd., Zhongli District, Taoyuan City 320, Taiwan.

Sensors (Basel, Switzerland)|April 3, 2021

View abstract on PubMed

Summary

This study introduces a novel kernel-based mechanism for detecting distributed denial of service (DDoS) attacks. The system smartly establishes new Transmission Control Protocol/Internet Protocol (TCP/IP) connections to defend against flooding attacks like SYN and ICMP floods.

Area of Science:

Computer Science
Network Security
Cybersecurity

Background:

Distributed Denial of Service (DDoS) attacks pose a significant threat to network availability.
Existing defense mechanisms often require complex integration or extensive client-side modifications.

Purpose of the Study:

To develop an efficient, kernel-based mechanism for detecting and mitigating DDoS attacks.
To enable immediate notifications and adaptive defense strategies without additional module efforts.

Main Methods:

Designed a kernel-based mechanism to intelligently establish new Transmission Control Protocol/Internet Protocol (TCP/IP) connections.
Implemented a lightweight, user-mode flooding attack detection system.
Replaced system call table entries with a customized sys_connect function for seamless integration.

Main Results:

Successfully detected flooding DDoS attacks, including SYN flood and ICMP flood.
The novel mechanism demonstrated effective defense capabilities when integrated with a specific low-cost network architecture.

Conclusions:

The proposed kernel-based mechanism offers an effective solution for detecting and defending against common DDoS flooding attacks.
The system provides immediate notifications and adaptive responses, enhancing network resilience without requiring widespread operating system reinstallation.

Keywords:

Communications Engineering

Signal Processing

Ddos Flood And Destination Service Changing Sensor

TCP three-way handshake

loadable kernel module

network security