Abstract:

Denial of Service (DoS) attacks impose serious threats on the integrity the Internet, resulting in tremendous impact on our daily lives which are heavily dependent on the health of the Internet. This dissertation aims to achieve two objectives: 1) to model new possibilities of the low rate DoS attacks, and 2) to develop effective mitigation mechanisms to counter the threat from low rate DoS attacks. We propose a new stealthy DDoS attack model referred to as the “quiet” attack. The attack traffic consists of TCP traffic only. Widely used botnets in today’s various attacks and newly introduced network feedback control are integral part of the quiet attack model. We show that short-lived TCP flows used as attack flows can be intentionally misused. Better CAPTCHAs are highlighted as current defense against botnets to mitigate the quiet attack.

We propose a novel time domain technique that relies on time difference between subsequent packets of each flow to detect periodicity of the low rate DoS attack flow. An attacker can easily use different IP address spoofing technique or botnets to launch a low rate DoS attack and fool the detection system. To counter such a threat, we have proposed a second detection algorithm that detects the sudden increase in the traffic load of all the expired flows within a short period. In a network without low rate DoS attacks, we show that the traffic load of all the expired flows is less than certain thresholds, which are derived from real Internet traffic analysis. A novel filtering scheme is proposed to drop the low rate DoS attack packets. The simulation results confirm attack mitigation by using our technique. Future research directions will be briefly discussed.

Committee Members:

Dr. Nirwan Ansari, Professor, ECE Dept., NJIT (Advisor)
Dr. Edwin Hou, Associate Professor, ECE Dept., NJIT
Dr. Roberto Rojas-Cessa, Associate Professor, ECE Dept., NJIT
Dr. Yanchao Zhang, Assistant Professor, ECE Dept., NJIT
Dr. Cristian Borcea, Assistant Professor, CS Dept., NJIT

Click here for seminar archive

Note: All MS thesis and PhD dissertation (proposal) defense are counted towards ECE791.