Detailed Essay On DDOS Attack.

Distributed Denial of Service (DDoS) and Worm attacks are contemporary and common attack types, targeting specific hosts and networks. Your task is to select one attack type from either DDoS or Worm attacks as the basis for your report and explain and graphically depict all components of the attack by addressing the following two requirements:

1. Develop a detailed walkthrough of how your chosen attack type operates in the real-world. This section should clearly represent each stage of the attack with supportive discussions and graphical images.

2. Select one real world example of your chosen attack type and proceed to identify and explain the intricacies of that incident. By explaining your selected real-world incident, you should at a minimum, address the following questions:

a. When did the attack occur and was it given a specific name?

b. What was the outcome of your chosen incident?

c. What was the impact of your chosen incident (financial, devices affected etc.)?

d. Which aim(s) of security was breached and what were the resultant consequences?

e. What specific action(s) did the vendor/company/organisation take to address the issue?

Details of Distributed Denial of Services (DDOS) attack

This report depicts the negative influence and impact of external hacking such as spoofing, phishing, DOS, DDOS, worm attack and malicious virus attack done by the external unwanted users. In order to prepare this report the specific attack that has been nominated is the DDOS attack. The details process map of the DDOS attack is demonstrated in this report. After details discussion over the DDOS attack phases how the attack can be prevented or controlled are also described in the report

In order to analyze the impact of the DDOS attack in the business a real life case scenario of Amazon Web Services is chosen for preparing this report. The impact of the attack on the user’s and how to mitigate and prevent this attack are also discussed in this report.

Distributed Denial of Service attack can be demonstrated as making a resource unavailable due to overloading. Rather it can be explained as an attempt for making a device or equipment or even a resource unavailable for the users who are intended toward using it. The main feature of DDOS attack is that the server associated to the attacked system is never being compromised even the database and data are also never viewed or deleted by the hijackers (Sonar & Upadhyay, 2014). However, the attack deals with the confidentiality, integrity and the availability of the information and system. In the current world of computing, the DDOS attack affects the infrastructure level, bandwidth level and in the server level. The application and serer protocol are also attacked by the DDOS attack.

In case of the OSI network model, where the 7 layers are physical, data link, network, data link, session, presentation and application both the application and the transport layers are affected by the attacker’s actions in terms of SYN flood, RST flood, FIN flood, SPAM, DNS Queries and HTTP GET flood (Behal & Kumar, 2017).

The phases of DDOS attacks are as follows:

The process of DDOS attack is attempt for making an online service completely unavailable through overwhelming it by multiple resource tracking. Wide varieties of resources are being attacked through this mechanism starting from banks, online shopping service providers etc (Bawany, Shamsi & Salah, 2017). By using multiple numbers of compromised computer systems as a source of attack the process started and successfully completed by the external attackers. Clogging a website through high traffic is the main aim of these DDOS attackers and they do this by recruiting a slave or zombie machine (Tama & Rhee, 2015). It needs an attacker to obtain control over the network of online devices for carrying out the attack.

Phase 1: Recruiting of slave or zombie machine

The computers and other devices or system (like Internet of Things) are interfaces through malware and turn each other to a zombie (also known as bot). Then the group of bots comes under the complete control of the attackers. This specific approach is also known as botnet (Osanaiye, 2015) As soon as the botnet establishes the attackers become capable of directing the machines by delivering updated instructions too rest of the bots or zombie machines through a remote control.  As the IP (Inter Protocol) address of any one victim is targeted by the external botnet then each of the present bot starts responding through sending request towards the targeted. As a result the traffic capacity of the targeted network or the server gets overflowed (David & Thomas, 2015). It has been found that as each of the bot is legitimate devices connected through internet services thus, separation of the devices from the high traffic is very much difficult.   

In different layers of the network models this attack took place such as in application layers, transmission layers etc. The attackers aim the application layer to exhaust the targeted resources. Wherever the website pages are generated over the server and conveyed response to the STTP requests (Zhang & Green, 2015). Execution of a single HTTP request is very cheap form the client’s end but it become much expensive for the targeted server as soon as it has to response to multiple numbers of files and also while running the database queries for creating the connected web pages.

HTTP flood is another DDOS attack that is alike pressing the refresh button in a web browser turn by turn on different computing systems till the server flooded through the HTTP requests (Hoque, Bhattacharyya & Kalita, 2016). It also results to DDOS attack though the attack ranges from a simple one to a complex.

Protocol attack which is also known as the state exhaustion attack results disruption over the service through consuming all state table availability on the web application servers. It can also attack the intermediate resources such as load balancer, application firewall etc (Deshmukh & Devadkar, 2015). The attackers send zombie machines (bot) which again send spoofed SYN datagram to the targeted network or server that results SYN acknowledgement.

The process of SYN flood is somewhere equivalent to the workers sitting in a supply room and getting requests from the store front. Huge numbers of initiation connection requests are sending to the target server through TCP/IP hand shaking protocol. Amplification is an example of the volumetric DDOS attack (Bhuyan, Bhattacharyya & Kalita, 2015). This DDOS attack approach is used by the hackers to increase congestion through consuming the available bandwidth between the internet and the target server or network. Hugh numbers of requests are send to the target through the amplification approach this may create massive traffic to the network channel.

Phase 2: Discovering the vulnerabilities of the machine

Figure 1: Graphical representation of the DDOS attack

(Source: Wang et al., 2015, pp-310)

a. The real world incident that is chosen for this paper is the case scenario of Amazon Web Services. It is reported on 25^th October, 2016 that some of the users of Amazon Web Services (AWS) are affected by a massive DDOS attack.

b. The targets of the attack were dynamic network services (DNS) that is also known as the DYN. As soon as the attack was identified the disconnected the use of their Domain name services. In order to avoid this DNS they rerouted their services to different providers.

c. The agility, flexibility, availability, usability, reliability and mostly the confidentiality of the users of AWS were affected and compromised due to this attack. The firewall and the encryption technology used for the system security was not enough for the business owners to prevent it from the massive DDOS attack. The public cloud platform offered for the users needs more security and the chief of the company ensured its security. Though it does not put such massive impact on the finance structure of the company but the confidentiality was somewhere affected.

d. As the Domain Name Service (DNS) was identified to be attacked thus, the for securing the channel the company discontinued their existing connection and switched it other service provider.

e. In order to address the identified issues the technical department of the company to the final initiatives and they decided to change the provider for that specific point of time. The public cloud service offered by the company was protected further through backup data, antivirus software installation, disaster recovery plan etc (Wang et al., 2015). This is expected that, with the successful security approaches the server will be able to control itself from further external attacks and malicious attack.

References

Ain, A., Bhuyan, M. H., Bhattacharyya, D. K., & Kalita, J. K. (2016). Rank Correlation for Low-Rate DDoS Attack Detection: An Empirical Evaluation. IJ Network Security, 18(3), 474-480.

Apiecionek, ?., Czerniak, J. M., & Dobrosielski, W. T. (2015). Quality of services method as a DDoS protection tool. In Intelligent Systems' 2014 (pp. 225-234). Springer, Cham.

Bawany, N. Z., Shamsi, J. A., & Salah, K. (2017). DDoS attack detection and mitigation using SDN: methods, practices, and solutions. Arabian Journal for Science and Engineering, 42(2), 425-441.

Behal, S., & Kumar, K. (2017). Characterization and Comparison of DDoS Attack Tools and Traffic Generators: A Review. IJ Network Security, 19(3), 383-393.

Bhuyan, M. H., Bhattacharyya, D. K., & Kalita, J. K. (2015). An empirical evaluation of information metrics for low-rate and high-rate DDoS attack detection. Pattern Recognition Letters, 51, 1-7.

David, J., & Thomas, C. (2015). DDoS attack detection using fast entropy approach on flow-based network traffic. Procedia Computer Science, 50, 30-36.

Deshmukh, R. V., & Devadkar, K. K. (2015). Understanding DDoS attack & its effect in cloud environment. Procedia Computer Science, 49, 202-210.

Devi, G. U., Priyan, M. K., Balan, E. V., Nath, C. G., & Chandrasekhar, M. (2015). Detection of DDoS attack using optimized hop count filtering technique. Indian Journal of Science and Technology, 8(26).

Hoque, N., Bhattacharyya, D. K., & Kalita, J. K. (2016, January). A novel measure for low-rate and high-rate DDoS attack detection using multivariate data analysis. In COMSNETS (pp. 1-2).

Jun, J. H., Ahn, C. W., & Kim, S. H. (2014, March). DDoS attack detection by using packet sampling and flow features. In proceedings of the 29th annual ACM symposium on applied computing (pp. 711-712). ACM.

Osanaiye, O. A. (2015, February). Short Paper: IP spoofing detection for preventing DDoS attack in Cloud Computing. In Intelligence in Next Generation Networks (ICIN), 2015 18th International Conference on (pp. 139-141). IEEE.

Sonar, K., & Upadhyay, H. (2014). A survey: DDOS attack on Internet of Things. International Journal of Engineering Research and Development, 10(11), 58-63.

Tama, B. A., & Rhee, K. H. (2015). Data mining techniques in DoS/DDoS attack detection: A literature review. Information (Japan), 18(8), 3739.

Wang, B., Zheng, Y., Lou, W., & Hou, Y. T. (2015). DDoS attack protection in the era of cloud computing and software-defined networking. Computer Networks, 81, 308-319.

Xu, Y., & Liu, Y. (2016, April). DDoS attack detection under SDN context. In INFOCOM 2016-The 35th Annual IEEE International Conference on Computer Communications, IEEE(pp. 1-9). IEEE.

Zhang, C., & Green, R. (2015, April). Communication security in internet of thing: preventive measure and avoid DDoS attack over IoT network. In Proceedings of the 18th Symposium on Communications & Networking (pp. 8-15). Society for Computer Simulation International.