An Easy-To-Use Mechanism To Prevent Ddos
And ARP Spoofing Networking Attacks
Ravindra Thalari - 20031D6416
MTech-CNIS
Guide : Dr. V Umarani, M tech, Ph. D - Professor
Contents
❏ Introduction
❏ What is ddos?
❏ How it will affect the systems?
❏ What are existing approaches?
❏ What is our solution?
❏ Input data?,processing?,output data?,algorithm?
❏ Implementation
❏ Conclusion
Existing approach
❏ Signature based technique will match predefined attack signature with new
request signature and if signature matched then it will detect attack and if new
signature arrived then this signature technique will not work.
❏ In DDOS attack attackers will send continuous huge amount of request to server
and server will keep busy on handling those requests and ignore genuine request
and by processing such huge request server may get crash.
❏ Time-Based Entropy Detection technique will depend on a timeframe to read the
[Link] request and detect the ddos attack, the performance of the system will be low
Proposed Approach
❏ This project proposed an easy-to-use mechanism that can be used to detect the
Denial of Service (DoS) and spoofing attacks using a window based approach.
❏ It is developed in Python, used queues and multi threading libraries for faster
results
❏ To implement this project I used WINPCAP files from kaggle storage. The dataset
contains network packet data and same files are used to analyze packets.
❏ I used tkinter library to create User Interface. And Numpy and scapy library to find
cumulative sum of [Link] requests sends from source to destination
Architecture
Algorithm:
1. Convert the dataset into packets and put them in a queue.
2. Start the analysis process.
3. Create an empty window.
4. Take each packet from the queue one by one.
5. Filter the packets according to the TCP protocol.
6. Detect TCP flood on the packet using below steps
7. Count the number of times the source sends a request to the destination.
8. Store the count in a dictionary with the key as "src->dst" and the value as the number of
requests.
9. Take each unique stream ("src->dst").
10. Store all source addresses in the window as a key and the value as the number of times it
sends requests to other devices.
11. The window size is 20, and it will analyze 20 source addresses at a time to detect flood
count. That means it will analyze requests from different computers and calculate the
cumulative sum of all the total requests from those 20 source addresses.
12. If the cumulative sum value is greater than a threshold value (that depends on the request
capacity of the system), then there will be a possibility of a DDOS attack on the destination
address.
❏ To receive the below screen, double click the "[Link]" file. To upload the PCAP file and
view the screen below, click the "Upload PCAP Dataset" button.
❏ Selecting and adding the "[Link]" file on the top screen, then clicking "Open"
to bring up the screen below.
❏ The pcap file is loaded on the screen above. To analyze the pcap file using the CUSUM
approach, click the "Run Improved Cumulative Sum (CUSUM) Algorithm" button.
❏ Each packet is examined on the screen, and the source and destination ports
are shown. The CUSUM values for each packet are shown in the screen below.
❏ On the screen below, we can see that each packet has a CUSUM array, and we can see that
when the CUSUM array has less values than when it has more values, there is no attack.
On the screen above, the CUSUM value is [4 5 6 7 8] when there is no attack, and [7 8 9 10
11] when there is an assault. So we can determine if the request is a legitimate one or an
attack by looking at this CUSUM array.
❏ As seen in the screenshot below, there are a total of 4496 assaults in the PCAP file.
Now, to launch the Time Based method, click the "Run Time-Based Entropy
Detection" button.
❏ As this method only monitors once every 10 seconds, the time-based programme
identified 2715 assaults, resulting in a lower detection rate.
❏ In the black console below, we can observe Time Based CUSUM statistics.
❏ In the previous screen, which is time-based, we can see more variation in requests
in an attack scenario compared to a normal scenario. Click the "Packets
Comparison Graph" button to access the graph below.
Conclusion
❏ This program's ease of use through the command line and the ability to automate
the detection of ddos attacks defined by their IP addresses must be highlighted.
❏ If huge requests arrive from same IP then CUSUM of that IP address will be high
which indicate it as attack, so this application will give us an alarm to stop traffic
from the IP
❏ I it an implemented emergency DDoS incident response plan in addition to the
preventive steps because even the finest defenses can occasionally be overcome by
clever attacks.
❏ As packets reach our system, need analyze them according to various rules
mentioned and filter out any that might be dangerous so that we would not allow
ddos attacks on our networks.
THANK YOU