Search Results (6)

SYN flooding attacks remain a persistent threat to network availability, particularly in Distributed Denial-of-Service (DDoS) scenarios that exploit the TCP three-way handshake. Traditional SYN cookies mitigate half-open connection exhaustion but may exhibit limited replay resistance under certain adversarial conditions. This paper presents a nonce-enhanced, HMAC-SHA256-based SYN cookie mechanism designed to strengthen handshake validation while preserving stateless operation. The implemented framework binds each connection attempt to a time-bounded, per-session nonce and embeds a truncated HMAC within the TCP sequence number field. The mechanism is implemented and experimentally evaluated using a custom-built simulation framework, NOxSYN. Under concurrent SYN flood conditions, the enhanced design successfully validated legitimate handshakes while maintaining stable operation under adversarial load. Measured server-side cryptographic processing remained below 1 ms per connection, with stable CPU utilization during testing. These results demonstrate that nonce-based replay protection can be integrated into a SYN cookie framework while preserving scalability and stateless operation. The current evaluation focuses on implementation-level validation and performance characterization, providing a foundation for future security-oriented assessment across a broader range of replay-based attack scenarios. Full article

For multi-agent systems under Denial-of-Service (DoS) attacks, a relative threshold strategy for event triggering and a state-constrained control method with prescribed performance are proposed. Within the framework of combining graph theory with the leader–follower approach, coordinate transformation is utilized to decouple the multi-agent system. Inspired by the three-way handshake technology of TCP communication, a DoS detection system is designed based on event-triggering. This system is used to detect DoS attacks, prevent the impacts brought by DoS attacks, and reduce the update frequency of the controller. Fuzzy logic systems are employed to approximate the unknown nonlinear functions within the system. By using a first-order filter to approximate the derivative of the virtual controller, the computational complexity issue in the backstepping method is addressed. Furthermore, The Barrier Lyapunov Function (BLF) possesses unique mathematical properties. When the system state approaches the pre-set boundary, it can exhibit a special variation trend, thereby imposing a restrictive effect on the system state. The Prescribed Performance Function (PPF), on the other hand, defines the expected performance standards that the system aims to achieve in the tracking task, covering key indicators such as tracking accuracy and response speed. By organically integrating these two functions, the system can continuously monitor and adjust its own state during operation. When there is a tendency for the tracking error to deviate from the specified range, the combined function mechanism will promptly come into play. Through the reasonable adjustment of the system’s control input, it ensures that the tracking error always remains within the pre-specified range. Finally, through Lyapunov analysis, the proposed control protocol ensures that all closed-loop signals remain bounded under attacks, with the outputs of all followers synchronizing with the leader’s output in the communication graph. Full article

With the proliferation of mobile devices and various mobile services, ensuring smooth mobility for users has become a major challenge. The future internet is expected to be more mobile-friendly, with advancing technologies that will transform internet management in the coming decades. These technological advancements will help address mobility issues and provide a better internet experience for mobile devices and users. The transport layer plays a crucial role in the internet protocol suite by enabling communication between applications running on different servers. However, the widely used protocols, TCP and UDP, have several limitations, such as unreliability and slow performance due to three-way handshakes. To tackle these issues, Google introduced quick UDP internet connections (QUIC). QUIC aims to enhance latency, delay, and data transmission reliability. Q-MOFI, a future internet architecture focused on mobile devices and based on QUIC, strives to achieve these goals. Moreover, it enhances throughput by implementing multiplexing. Q-MOFI outperforms traditional UDP-based MOFI in terms of throughput gains, minimizing packet loss, and reducing binding operation latency, even when the number of hosts increases. The efficiency of this model has been validated through experimental testing. Full article

Distributed denial of service (DDoS) attacks aim to deplete the network bandwidth and computing resources of targeted victims. Low-rate DDoS attacks exploit protocol features such as the transmission control protocol (TCP) three-way handshake mechanism for connection establishment and the TCP congestion-control induced backoffs to attack at a much lower rate and still effectively bring down the targeted network and computer systems. Most of the statistical and machine/deep learning-based detection methods proposed in the literature require keeping track of packets by flows and have high processing overheads for feature extraction. This paper presents a novel two-stage model that uses Long Short-Term Memory (LSTM) and Random Forest (RF) to detect the presence of attack flows in a group of flows. This model has a very low data processing overhead; it uses only two features and does not require keeping track of packets by flows, making it suitable for continuous monitoring of network traffic and on-the-fly detection. The paper also presents an LSTM Autoencoder to detect individual attack flows with high detection accuracy using only two features. Additionally, the paper presents an analysis of a support vector machine (SVM) model that detects attack flows in slices of network traffic collected for short durations. The low-rate attack dataset used in this study is made available to the research community through GitHub. Full article

In this paper, we aim to detect distributed denial of service (DDoS) attacks, and receive a notification of destination service, changing immediately, without the additional efforts of other modules. We designed a kernel-based mechanism to build a new Transmission Control Protocol/Internet Protocol (TCP/IP) connection smartly by the host while the users or clients not knowing the location of the next host. Moreover, we built a lightweight flooding attack detection mechanism in the user mode of an operating system. Given that reinstalling a modified operating system on each client is not realistic, we managed to replace the entry of the system call table with a customized sys_connect. An effective defense depends on fine detection and defensive procedures. In according with our experiments, this novel mechanism can detect flooding DDoS successfully, including SYN flood and ICMP flood. Furthermore, through cooperating with a specific low cost network architecture, the mechanism can help to defend DDoS attacks effectively. Full article

Distributed denial of service attacks have become more and more frequent nowadays. In 2013, a massive distributed denial of service (DDoS) attack was launched against Spamhaus causing the service to shut down. In this paper, we present a three-way handshaking server for Transmission Control Protocol (TCP) connection redirection utilizing TCP header options. When a legitimate client attempted to connect to a server undergoing an SYN-flood DDoS attack, it will try to initiate a three-way handshake. After it has successfully established a connection, the server will reply with a reset (RST) packet, in which a new server address and a secret is embedded. The client can, thus, connect to the new server that only accepts SYN packets with the corrected secret using the supplied secret. Full article