dos attacks

A System for Denial-of-Service Attack DetectionBased on Multivariate Correlation Analysis Under The Guidance

Of Mr Ritesh Kumar

Presented By

Amal Chacko

CONTENTS INTRODUCTION ARCHITECTURE CONCLUTION REFERENCE

What is a Denial Of Service Attack

Denial Of Service Attack (DoS) is an attack on a computer or network that prevents legitimate use of its resources

In a DoS attack attackers flood a victim system with non-legitimate service requests or traffic to overload its resources which prevents it from performing intended task

TYPES Denial of Service (DoS) Distributed Denial of

Service (DDoS)

Symtoms Of A DoS Attackhellip

Impact Of DoShellip Disabled network Disabled organization Financial loss Loss of goodwill Other attacks Sabotage Extortion

DoS Attack Techniquehellip

DOS ATTACK TOOLS1048702 Jolt21048702 Bubonicc1048702 Land and LaTierra1048702 Targa1048702 Blast201048702 Nemesy1048702 Panther21048702 Crazy Pinger1048702 Some Trouble1048702 UDP Flood1048702 FSMax

DOS TOOL JOLT2 Allows remote attackers

tocause a denial of service attackagainst Windows-basedMachines Causes the target

machines toconsume 100 of the CPU timeon processing the illegal packets Not Windows-specific

Ciscorouters and other gateways maybe vulnerable

DOS TOOL NEMESYS

This application generate random packets(protocolportetcIts presense means that your computer is infected withmalicious software and is insecure

BOT (Derived From The Word Robot) IRC bot - also called zombie or drone Internet Relay Chat (IRC) is a form of

realtime communication over the Internet It is mainly designed for group (one-to-many) communication in discussion forums called channels The bot joins a specific IRC channel on an IRC server and waits for further commands

The attacker can remotely control the bot

and use it for fun and also for profit Different bots connected together is

called Botnet

How Do They Infect

Existing System

Misuse Type Detection System Anomaly Type Intrusion Detection System

Proposed System

A System for Denial-of-Service Attack Detection Based on Multivariate Correlation Analysis

Multivariate Correlation Analysis (MCA)

Multivariate analysis (MVA) techniques allow more than two

variables to be analysed at once

MCA approach employs triangle area for extracting the correlative information

between the features within an observed data object

MCA approach supplies with the some benefits to data analysis

SYSTEM ARCHITECTURE

Normal Profile Generation

Assume there is a set of lsquogrsquo legitimate training traffic records

The triangle-area based MCA approach is applied to analyse the

records

Mahalanobis distance is adopted to measure the dissimilarity

between traffic records

Algorithm For Profile Generation

Continued

1

2

3

Detection Mechanism

Here we present a threshold-based anomaly detector

Normal profiles and Thresholds have direct influence on the performance of a

threshold-based detector

Mahalanobis Distance is adopted to measure the dissimilarity between traffic

records

Algorithm For Attack Detection

Continued

Threshold Selection

The threshold given is used to differentiate attack traffic from the legitimate

one

For a normal distribution is usually ranged from 1 to 3

Continued

Attack Detection

To detect DoS attacks the lower triangle of the

TAM of an observed record needs to be generated

The MD between the and the

stored in the respective pre generated normal profile Pro

Referenceshellip

International Journal of Advanced Technology in Engineering and Science

Vol No3Issue 07 July 2015 International Journal of Advanced Research in Computer and

Communication Engineering Vol 3 Issue 10 October 2014 K Houle et al ldquoTrends in Denial of Service Attack

Technologyrdquowwwcertorgarchivepdf 2001 A Hussain J Heidemann and C Papadopoulos

ldquoIdentification of Repeated Denial of Service Attacksrdquo Proc INFOCOM rsquo06 Apr 2006

Conclusion

The MCA based TAM technique facilitates our system to be able to

distinguish both known and unknown DoS attacks from legitimate

network traffic The MCA based TAM technique will provide More detection accuracyAccurate characterization for traffic behaviors and detection of known and

unknown attacks respectively

Slide 1

Contents


Types


Impact Of DoShellip


DoS Attack Tools

DoS Tool Jolt2

DoS Tool Nemesys

Bot (Derived From The Word Robot)

How Do They Infect

Existing System

Proposed System


System architecture



Continued

Detection Mechanism


Continued (2)

Continued (3)

Referenceshellip

Conclusion

Slide 26

CONTENTS INTRODUCTION ARCHITECTURE CONCLUTION REFERENCE





Service (DDoS)









DOS TOOL NEMESYS






called Botnet

How Do They Infect

Existing System


Proposed System








SYSTEM ARCHITECTURE




records




Continued

1

2

3

Detection Mechanism





records


Continued

Threshold Selection


one


Continued

Attack Detection





Referenceshellip






Conclusion





Slide 1

Contents


Types


Impact Of DoShellip


DoS Attack Tools

DoS Tool Jolt2

DoS Tool Nemesys


How Do They Infect

Existing System

Proposed System


System architecture



Continued

Detection Mechanism


Continued (2)

Continued (3)

Referenceshellip

Conclusion

Slide 26





Service (DDoS)









DOS TOOL NEMESYS






called Botnet

How Do They Infect

Existing System


Proposed System








SYSTEM ARCHITECTURE




records




Continued

1

2

3

Detection Mechanism





records


Continued

Threshold Selection


one


Continued

Attack Detection





Referenceshellip






Conclusion





Slide 1

Contents


Types


Impact Of DoShellip


DoS Attack Tools

DoS Tool Jolt2

DoS Tool Nemesys


How Do They Infect

Existing System

Proposed System


System architecture



Continued

Detection Mechanism


Continued (2)

Continued (3)

Referenceshellip

Conclusion

Slide 26









DOS TOOL NEMESYS






called Botnet

How Do They Infect

Existing System


Proposed System








SYSTEM ARCHITECTURE




records




Continued

1

2

3

Detection Mechanism





records


Continued

Threshold Selection


one


Continued

Attack Detection





Referenceshellip






Conclusion





Slide 1

Contents


Types


Impact Of DoShellip


DoS Attack Tools

DoS Tool Jolt2

DoS Tool Nemesys


How Do They Infect

Existing System

Proposed System


System architecture



Continued

Detection Mechanism


Continued (2)

Continued (3)

Referenceshellip

Conclusion

Slide 26





called Botnet

How Do They Infect

Existing System


Proposed System








SYSTEM ARCHITECTURE




records




Continued

1

2

3

Detection Mechanism





records


Continued

Threshold Selection


one


Continued

Attack Detection





Referenceshellip






Conclusion





Slide 1

Contents


Types


Impact Of DoShellip


DoS Attack Tools

DoS Tool Jolt2

DoS Tool Nemesys


How Do They Infect

Existing System

Proposed System


System architecture



Continued

Detection Mechanism


Continued (2)

Continued (3)

Referenceshellip

Conclusion

Slide 26

How Do They Infect

Existing System


Proposed System








SYSTEM ARCHITECTURE




records




Continued

1

2

3

Detection Mechanism





records


Continued

Threshold Selection


one


Continued

Attack Detection





Referenceshellip






Conclusion





Slide 1

Contents


Types


Impact Of DoShellip


DoS Attack Tools

DoS Tool Jolt2

DoS Tool Nemesys


How Do They Infect

Existing System

Proposed System


System architecture



Continued

Detection Mechanism


Continued (2)

Continued (3)

Referenceshellip

Conclusion

Slide 26

Existing System


Proposed System








SYSTEM ARCHITECTURE




records




Continued

1

2

3

Detection Mechanism





records


Continued

Threshold Selection


one


Continued

Attack Detection





Referenceshellip






Conclusion





Slide 1

Contents


Types


Impact Of DoShellip


DoS Attack Tools

DoS Tool Jolt2

DoS Tool Nemesys


How Do They Infect

Existing System

Proposed System


System architecture



Continued

Detection Mechanism


Continued (2)

Continued (3)

Referenceshellip

Conclusion

Slide 26

Proposed System








SYSTEM ARCHITECTURE




records




Continued

1

2

3

Detection Mechanism





records


Continued

Threshold Selection


one


Continued

Attack Detection





Referenceshellip






Conclusion





Slide 1

Contents


Types


Impact Of DoShellip


DoS Attack Tools

DoS Tool Jolt2

DoS Tool Nemesys


How Do They Infect

Existing System

Proposed System


System architecture



Continued

Detection Mechanism


Continued (2)

Continued (3)

Referenceshellip

Conclusion

Slide 26







SYSTEM ARCHITECTURE




records




Continued

1

2

3

Detection Mechanism





records


Continued

Threshold Selection


one


Continued

Attack Detection





Referenceshellip






Conclusion





Slide 1

Contents


Types


Impact Of DoShellip


DoS Attack Tools

DoS Tool Jolt2

DoS Tool Nemesys


How Do They Infect

Existing System

Proposed System


System architecture



Continued

Detection Mechanism


Continued (2)

Continued (3)

Referenceshellip

Conclusion

Slide 26




records




Continued

1

2

3

Detection Mechanism





records


Continued

Threshold Selection


one


Continued

Attack Detection





Referenceshellip






Conclusion





Slide 1

Contents


Types


Impact Of DoShellip


DoS Attack Tools

DoS Tool Jolt2

DoS Tool Nemesys


How Do They Infect

Existing System

Proposed System


System architecture



Continued

Detection Mechanism


Continued (2)

Continued (3)

Referenceshellip

Conclusion

Slide 26


Continued

1

2

3

Detection Mechanism





records


Continued

Threshold Selection


one


Continued

Attack Detection





Referenceshellip






Conclusion





Slide 1

Contents


Types


Impact Of DoShellip


DoS Attack Tools

DoS Tool Jolt2

DoS Tool Nemesys


How Do They Infect

Existing System

Proposed System


System architecture



Continued

Detection Mechanism


Continued (2)

Continued (3)

Referenceshellip

Conclusion

Slide 26

Detection Mechanism





records


Continued

Threshold Selection


one


Continued

Attack Detection





Referenceshellip






Conclusion





Slide 1

Contents


Types


Impact Of DoShellip


DoS Attack Tools

DoS Tool Jolt2

DoS Tool Nemesys


How Do They Infect

Existing System

Proposed System


System architecture



Continued

Detection Mechanism


Continued (2)

Continued (3)

Referenceshellip

Conclusion

Slide 26


Continued

Threshold Selection


one


Continued

Attack Detection





Referenceshellip






Conclusion





Slide 1

Contents


Types


Impact Of DoShellip


DoS Attack Tools

DoS Tool Jolt2

DoS Tool Nemesys


How Do They Infect

Existing System

Proposed System


System architecture



Continued

Detection Mechanism


Continued (2)

Continued (3)

Referenceshellip

Conclusion

Slide 26

Continued

Attack Detection





Referenceshellip






Conclusion





Slide 1

Contents


Types


Impact Of DoShellip


DoS Attack Tools

DoS Tool Jolt2

DoS Tool Nemesys


How Do They Infect

Existing System

Proposed System


System architecture



Continued

Detection Mechanism


Continued (2)

Continued (3)

Referenceshellip

Conclusion

Slide 26

Referenceshellip






Conclusion





Slide 1

Contents


Types


Impact Of DoShellip


DoS Attack Tools

DoS Tool Jolt2

DoS Tool Nemesys


How Do They Infect

Existing System

Proposed System


System architecture



Continued

Detection Mechanism


Continued (2)

Continued (3)

Referenceshellip

Conclusion

Slide 26

Conclusion





Slide 1

Contents


Types


Impact Of DoShellip


DoS Attack Tools

DoS Tool Jolt2

DoS Tool Nemesys


How Do They Infect

Existing System

Proposed System


System architecture



Continued

Detection Mechanism


Continued (2)

Continued (3)

Referenceshellip

Conclusion

Slide 26

Contents


Types


Impact Of DoShellip


DoS Attack Tools

DoS Tool Jolt2

DoS Tool Nemesys


How Do They Infect

Existing System

Proposed System


System architecture



Continued

Detection Mechanism


Continued (2)

Continued (3)

Referenceshellip

Conclusion

Slide 26