Active DDoS Attack Mitigation and Secure Threat Intelligence Sharing

Khuda Bux; Akhtar Hussain Jalbani; Ghulam Hussain Jalbani; Saima Siraj Soomro; Salma Jamali

Author(s)

Khuda Bux Riphah Institute of Systems Engineering, Riphah International University,Islamabad,Pakistan

Akhtar Hussain Jalbani Department of Information Technology, Quaid-e-Awam University of Engineering, Science &Technology, Nawabshah, Pakistan

Ghulam Hussain Jalbani Department of Information Technology, Quaid-e-Awam University of Engineering, Science &Technology, Nawabshah, Pakistan

Saima Siraj Soomro Department of Information Technology, Quaid-e-Awam University of Engineering, Science &Technology, Nawabsha, Pakistan

Salma Jamali Department of Information Technology, Quaid-e-Awam University of Engineering, Science &Technology, Nawabshah, Pakistan.

Abstract

The DDoS (Distributed Denial of Service) attacks are increasing by each passing day on networks. There is a need to mitigate or prevent the networks from these types of attacks. To mitigate the DDoS active attack there are too many entities involved for sending signals and messages securely.This incident information is shared with the help of DoSTS (Denial of Service Open Threat Signaling). The DOTS framework provides a separate path along with DOTS clients and DOTS server for the process of information-sharing regarding active DDoS attack on attack target. For detection and mitigation of DDoS attack or any other malicious traffic on the network there is a need for continuous monitoring and automate all this process. Security Automation and Continuous Monitoring is deployed, with this, the incident threat information will be shared securely. The detection of active DDoS attacks, tracing of source, and mitigation is processed with the help of Managed Incident Lightweight Exchange. These incident messages are shared with the modified XML (Extensible Markup Language) or JSON (JavaScript Object Notation) function for security and privacy of network information on the attack target. With the help of a service provider or a third party, the active DDoS attack will be mitigated. These three frameworks are proposed by the standard body IETF (Internet Engineering Task Force). In this paper, we have proposed to combine these three frameworks for good results. Due to these frameworks, the existing devices and protocol are used to share the threat information and mitigate the activeDDoSattack also. Due to this, the action against the malicious traffic on the network will be taken timely for detection and mitigation. And also, the services of attack targets for their customers will remain offline for a short period of time.

Publication Details

Page(s) 6-13

DOI DOI not available

Published Journal: New Horizons: Journal of the Institution of Electrical & Electronics Engineers Pakistan, Volume: 101, Issue: 1--2, Year: 2019

Request the full text from PASTIC

Keywords

mitigation, DDoS Attacks, Security Events, TargetedNetwork, InformationInformation, network security