DDoS Attack Detection and Attacker Identification

Abstract

DDoS attack is a form of DoS attack in which attacker uses authorized user IP address to attack on a particular victim.Of the two types of attack it falls in the active category.The main aim of the attacker is to jam the resources in order to deny services to the recipient.The attacker can use several strategies to achieve this goal, one of which is by flooding the network with bogus requests.The attack is distributed because the attacker is using multiple computers to launch the denial of service attack.In this paper we have first identified the types of DoS and DDoS attack.Then we have provided the solution for those attacks on the basis of attacker's identification.Main focus of this paper is to identify the actual attacker, who has performed attack by sitting behind a forged System.For that purpose first we prevent IP forgery by using sender authentication process, then calculate TCP flow rate and from it we identify whether packets are nor-mal packet or malicious packet.We detect attack on receiver proxy server by using entropy and normalize entropy calculation on receiver proxy server.If attack is detected then we drop packets, get their mark value and trace them back to the source.Finally we use the concept of ISP and IANA to identify the actual attacker.NS2 has been used to simulate the proposed methods.