Flow-Representation Approach For ICMPV6-Based DDOS Attacks Detection

Simple item page
dc.contributor.authorElejla, Omar E. O.
dc.date.accessioned2019-03-06T08:06:43Z
dc.date.available2019-03-06T08:06:43Z
dc.date.issued2018-04
dc.description.abstractIn addition to the address expandability, IPv6 broughts new functionalities, such as Neighbor Discovery Protocol (NDP) and address auto-configuration scheme, which depends on Internet Control Message Protocol version 6 (ICMPv6) protocol. ICMPv6 is delegated with more responsibilities than Internet Control Message Protocol version 4 (ICMPv4) in IPv4, and it is considered the backbone and the mandatory part in IPv6 native networks. IPv6 is vulnerable to a number of attacks from IPv4, besides new attacks have appeared within its new features. The most popular IPv6 attacks are Denial of Service (DoS) and its distributed version (DDoS) that use ICMPv6 messages. ICMPv6-based DoS & DDoS attacks are one of the major problems of today’s Internet, impacting economic damages in some serious cases. Anomaly Intrusion Detection Systems (AIDSs) have been proposed to address the problem of ICMPv6-based DoS & DDoS attacks. Unfortunately, these AIDSs rely on packet-based representations of the network traffic as their inputs, which fail to capture the nature of the attacks that consist of streams of malicious traffic. Moreover, these AIDS are unable to accurately detect the attacks due to their lack of considerations for the attacks related features and the attacks polymorphic behaviors. In addition, poor quality datasets have been used to train and test the existing AIDS which also impacting their detection accuracy. This research proposes an approach that is able to accurately detect ICMPv6-based DoS & DDoS attacks. The proposed approach uses a flow-based network traffic representation to overcome the limitations of packets-based representation. The flow-based representation constructs the traffic that capture the essential elements in the streams and behaviour of ICMPv6-based DoS & DDoS attacks. In addition, the proposed approach identifies a set of novel relevant features to be used for detecting the attacks as well as enriching these features with behaviour & contextual based features to further improve the attacks detection ability.en_US
dc.identifier.urihttp://hdl.handle.net/123456789/7848
dc.language.isoenen_US
dc.publisherUniversiti Sains Malaysiaen_US
dc.subjectFlow-representation approach for ICMPV6en_US
dc.subjectbased DDOS attacks detectionen_US
dc.titleFlow-Representation Approach For ICMPV6-Based DDOS Attacks Detectionen_US
dc.typeThesisen_US
Files
License bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
license.txt
Size:
1.71 KB
Format:
Item-specific license agreed upon to submission
Description:
Download
Collections
Pusat Pengajian Sains Komputer - Tesis