TRAP: A Three-Way Handshake Server for TCP Connection Establishment
Source abstract
Abstract
Distributed denial of service attacks have become more and more frequent nowadays. In 2013, a massive distributed denial of service (DDoS) attack was launched against Spamhaus causing the service to shut down. In this paper, we present a three-way handshaking server for Transmission Control Protocol (TCP) connection redirection utilizing TCP header options. When a legitimate client attempted to connect to a server undergoing an SYN-flood DDoS attack, it will try to initiate a three-way handshake. After it has successfully established a connection, the server will reply with a reset (RST) packet, in which a new server address and a secret is embedded. The client can, thus, connect to the new server that only accepts SYN packets with the corrected secret using the supplied secret.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Internet Traffic Analysis and Secure E-voting · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Computer Science and Information Engineering, National Central University, Taoyuan 32001, Taiwan
School of Applied Foreign Languages, Chung Shan Medical University, Taichung 40201, Taiwan
CyberTrust Technology Institute, Institute for Information Industry, Taipei 10622, Taiwan
References (23)
Show source-provided references
1. Abu Rajab, M., Zarfoss, J., Monrose, F., and Terzis, A. (2006, January 25–27). A multifaceted approach to understanding the botnet phenomenon. Proceedings of the 6th ACM SIGCOMM Conference on Internet Measurement, Rio de Janeiro, Brazil.10.1145/1177080.1177086 ↗
2. Kaspersky Lab Statistics on Botnet-Assisted DDoS Attacks in Q1 2015. Available online: https://securelist.com/blog/research/70071/statistics-on-botnet-assisted-ddos-attacks-in-q1–2015/.
3. Prince, M. The DDoS that Knocked Spamhaus Offline (and How We Mitigated It). Available online: https://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-offline-and-ho.
4. Graham, R. Pin-Pointing China’s Attack against GitHub. Available online: http://blog.erratasec.com/2015/04/pin-pointing-chinas-attack-against.html.
5. Sebastian, A. GitHub Battles “Largest DDoS” in Site’s History, Targeted at Anti-Censorship Tools. Available online: http://arstechnica.com/security/2015/03/github-battles-largest-ddos-in-sites-history-targeted-at-anti-censorship-tools/.
6. RFC 793—Transmission Control Protocol. Available online: https://tools.ietf.org/html/rfc793.
7. A taxonomy of DDoS attack and DDoS defense mechanisms10.1145/997150.997156 ↗
8. Juniper Networks, Inc. Understanding Teardrop Attacks. Available online: https://www.juniper.net/techpubs/software/junos-es/junos-es92/junos-es-swconfig-security/understanding-teardrop-attacks.html.
9. Muscat, I. How to Mitigate Slow HTTP DoS Attacks in Apache HTTP Server. Available online: http://www.acunetix.com/blog/articles/slow-http-dos-attacks-mitigate-apache-http-server/.
10. Shekyan, S. How to Protect against Slow HTTP Attacks. Available online: https://blog.qualys.com/securitylabs/2011/11/02/how-to-protect-against-slow-http-attacks.
11. Miao, L., Ding, W., and Gong, J. (2015, January 22–24). A real-time method for detecting internet-wide SYN flooding attacks. Proceedings of the IEEE International Workshop Local and Metropolitan Area Networks (LANMAN), Beijing, China.10.1109/LANMAN.2015.7114740 ↗
12. Transmission Control Protocol (TCP) Parameters. Available online: http://www.iana.org/assignments/tcp-parameters/tcp-parameters.xhtml#tcp-parameters-1.
13. Salzman, P. The Linux Kernel Module Programming Guide. Available online: http://www.tldp.org/LDP/lkmpg/2.6/html/lkmpg.html#AEN40.
14. Linux netfilter Hacking HOWTO: Netfilter Architecture. Available online: http://www.netfilter.org/documentation/HOWTO/netfilter-hacking-HOWTO-3.html.
15. Lemon, J. (2002, January 15–17). Resisting SYN Flood DoS Attacks with a SYN Cache. Proceedings of the BSD Conference 2002 on BSD Conference, Amsterdam, The Netherlands.
16. Jin, H., Tang, D., Zhang, Y., and Chen, H. (2004, January 26–30). SHAK: Eliminating faked three-way handshaking in socket handoff. Proceedings of the 18th International Parallel and Distributed Processing Symposium, Santa Fe, Mexico.
17. Lorenz, P. (2001). Networking—ICN 2001, Springer.10.1007/3-540-47728-4 ↗
18. Wu, Z., and Chen, Z. (2006, January 25–27). A three-layer defense mechanism based on web servers against distributed denial of service attacks. Proceedings of the First International Conference on Communications and Networking in China, Beijing, China.10.1109/CHINACOM.2006.344851 ↗
19. McHardy, P. Netfilter: Implement Netfilter SYN Proxy. Available online: https://lwn.net/Articles/563151/.
20. TCPDUMP/LIBPCAP public repository. Available online: http://www.tcpdump.org/.
21. GitHub-Sam-Github/Libnet: Libnet Provides a Portable Framework for Low-Level Network Packet Construction. Available online: https://github.com/sam-github/libnet.
22. Wireshark Go Deep. Available online: https://www.wireshark.org/.
23. Hping—Active Network Security Tool. Available online: http://www.hping.org.