RAPT: A Robust Attack Path Tracing Algorithm to Mitigate SYN-Flood DDoS Cyberattacks.

Area of Science:

• Computer Science
• Network Security
• Cybersecurity

Background:

• Distributed Denial of Service (DDoS) attacks pose a significant threat to network infrastructure and web server availability.
• TCP SYN-Flood attacks exploit the Transmission Control Protocol (TCP) 3-Way handshake, causing service disruption and potential server crashes.

Purpose of the Study:

• To propose a resilient, efficient, and lightweight IP traceback algorithm for real-time detection and mitigation of TCP SYN-Flood DDoS attacks.
• To develop a method for edge routers to identify and trace attack paths by generating IP trace packets.

Main Methods:

• The proposed algorithm utilizes IP trace packets generated by edge routers upon detecting TCP SYN-Flood attack signatures.
• Trace packets record router IP addresses along the attack path from the attacker/daemon to the victim.
• The system analyzes traffic patterns to identify high percentages destined for specific web servers.

Main Results:

• The algorithm efficiently traces attack paths in real-time, enabling prompt reaction by discarding malicious SYN packets.
• The solution demonstrates low computation and message overhead.
• Detection and tracing times are efficient, with convergence near optimal time.

Conclusions:

• The developed IP traceback algorithm offers an effective solution for mitigating ongoing TCP SYN-Flood DDoS attacks.
• This research presents a novel approach to efficiently trace and counteract these prevalent cyber threats.
• The proposed method is validated through extensive simulation runs, confirming its robustness and efficiency.