An adaptive multi tier cross layer security framework to defend against DDoS attacks in active networks

Abstract

The use of e-technologies enables integration of information from various sources and users of Internet increases multifold that leads to severe security concern. The objective of this research work is to provide a comprehensive defense framework against distributed denial of service (DDoS) attacks in active networks, by proposing a realistic integration of three different strategies that makes the network less susceptible to attacks. The thesis work defines a defense framework for active networks. A way of avoiding attacks is to ensure that attacks may not exploit the vulnerabilities. This is achieved in this work through enhanced anti-spoofing techniques that resolve insider attacks, and a differentiated routing based on traffic classification. In this work, application layer and network layer are combined to deal with the attacks that do not have many distinguishable characteristics. The cross layer approach is adopted by the defense sub systems to make more complete decisions on the anomalous traffic. In the proposed method, a novel semi supervised k-means weighted group clustering technique is adopted to improve the clustering purity. In this research work, an attack resilient multi-tier architecture encompassing the activities of preventing and detecting DDoS attacks with minimum deployment overhead is presented for active networks. The defense system is designed to support legitimacy analysis on the traffic with simple packet structure enhancements to attend to fast changing DoS attacks. The system supports scalability by way of deploying the various strategies in each AS so that the local defense leads to global defense with less collaborative operations. Success of the defense system lies in allowing the client traffic to pass through the network during attacks as well as possessing high attack detection accuracy and the proposed defense strategy shows less false positive and false negative alarms. As attack and legitimate traffic vary widely across networks, both proactive and reactive defense strategie