Topology based packet marking

The Internet has transformed greatly the improved way of business, this vast network and its associated technologies have opened the doors to an increasing number of security threats which are dangerous to networks. The first part of this chapter presents a new dimension of denial of service attacks called TCP SYN Flood attack has been witnessed for severity of damage and second part on worms which is the major threat to the internet. The TCP SYN Flood attack by means of anomaly detection and traces back the real source of the attack using Modified Efficient Packet Marking algorithm (EPM). The mechanism for detecting the smart natured camouflaging worms which is sensed by means of a technique called Modified Controlled Packet Transmission (MCPT) technique. Finally the network which is affected by these types of worms are detected and recovered by means of Modified Centralized Worm Detector (MCWD) mechanism. The Network Intrusion Detection and Prevention Systems (NIDPS) on Flooding and Worm Attacks were analyzed and presented.

Download Full-text

Modified Probabilistic Packet Marking Algorithm for IPv6 Traceback Using Chinese Remainder Theorem

Innovations in Computer Science and Engineering - Lecture Notes in Networks and Systems ◽

10.1007/978-981-10-3818-1_28 ◽

2017 ◽

pp. 253-263 ◽

Cited By ~ 1

Author(s):

Y. Bhavani ◽

V. Janaki ◽

R. Sridevi

Keyword(s):

Chinese Remainder Theorem ◽

Packet Marking

Download Full-text

Evolution of Enterprise Security Federation

Handbook of Research on Information Security and Assurance ◽

10.4018/978-1-59904-855-0.ch004 ◽

2009 ◽

pp. 29-41

Author(s):

Gaeil An ◽

Joon S. Park

Keyword(s):

False Positive ◽

Security Policies ◽

Security Framework ◽

Security Systems ◽

Network Attacks ◽

Cooperative Security ◽

Management Architecture ◽

Enterprise Security ◽

Packet Marking ◽

False Positive Problem

In this chapter, we discuss the evolution of the enterprise security federation, including why the framework should be evolved and how it has been developed and applied to real systems. Furthermore, we analyze the remaining vulnerabilities and weaknesses in current approaches and propose new approaches to resolve those problems. Then, to overcome those weaknesses and vulnerabilities, we propose the PSM (Policy-based Security Management) architecture for an integrated security framework, and the PM (Packet-Marking) architecture for a cooperative security framework. The PSM architecture is able to efficiently realize the security purposes of an organization by controlling, operating, and managing various kinds of security systems consistently based on security policies. The PM architecture is able to effectively deal with suspicious network traffic without requiring new protocol, while reducing the false-positive problem and perfectly protecting QoS for innocent traffic from attacks. We simulated the PSM and PM architectures to evaluate their performance. The simulation result shows that the PSM architecture can automatically detect and respond against network attacks, and the PM architecture can effectively handle suspicious traffic, such as DDoS traffics.

Download Full-text