سازوکار نوین برای شناسایی حملات Syn Flood در شبکه های وایرلس

ABSTRACT A Novel Syn Flood Detection Mechanism for Wireless Network

Wireless networks like Mobile Adhoc network (MANET) is infrastructure-less network, or there is no centralized controller [1]. It consists of mobile nodes which are free to move independently in any direction. Nodes can join and leave the network at any time, and so links are changing frequently. Due to the dynamic nature of MANET and since the nodes act asrouters MANET is vulnerable to different attacks. Since nodes can join and leave at any time, and can move in any direction it is difficult to detect attack.

In the TCP three- way handshake, when the server receives a client’s SYN request, it replies with a SYN/ACK packet and then waits for the client to send the ACK to complete the three-way handshake. While waiting for the final ACK, the server maintains a half-open connection. But the attacker never sends final ACK, and the server maintains half open connection for the entire duration of normal ideal TCP connection which is 75s normally. SYN flood attack leads to denial of service. As a result of SYN flood attack, the number of half open connections in a node is increasing. Since the connections are half open the server cannot provide service to good nodes that request for new connection. Thus the services provided by the server are denied. It is important to detect SYN-flood attacks at an early stage before there are a large number of half-open connections maintained by the protected server.

Algorithms like CUSUM [2] used to defend SYN flood attack, is complex. Trace-back mechanism uses the network layer or MAC layer abnormalities to characterize the SYN flood attack. After detecting the presence of attack, a search process is initialized by the victim to trace the attacker. Defending mechanisms which detect and defend attack at an early stage is more efficient. It should also inform other nodes about the attack. Many Detection algorithms like the algorithm based on chaos theory uses the network traffic for characterizing and detecting SYN flood attack. Some detection mechanisms use MAC layer abnormalities for detection. Abnormalities may occur in a layer due to delay, increased traffic etc.Many detection algorithms are proposed to detect syn flood attack.

Still a perfect solution is not yet developed. If each node monitor different symptoms of SYN flood attack in transport layer like abnormal increase in transport layer packet, abnormal increase in SYN-FIN rate and abnormal increase in SYN-ACK rateand make a decision based on majority, detection will be more accurate. Every node monitors all the three parameters.Based on the collected information each parameter independently process and detects the presence of SYN flood attack. Victim takes a decision based on the majority result obtained.

The organization of thesis is as follows. This section introduces to the main properties of the problem identified. In section 2, a brief review of several research papers related to the thesis are given. Parameters used and proposed work of this thesis is included in chapter sections 3 and 4. Section 5 includes result analysis and conclusion of the work is given in section 6.