Detection and Prevention of DDoS Attacks on the Cloud using Double-TCP Mechanism and HMM-based Architecture

Abstract

The rising interest in cloud services has increased the number of security issues in cloud computing. In recent times, several cloud based servers have experienced inevitable DDoS attacks. This papers deals with the denial of service attacks on cloud computing which are on a rising scale. Considering the TCP SYN Flood attack and Application layer DDoS attacks, the proposed architecture for cloud servers can detect them at an early stage and prevent the server from denying services to its legitimate users. The proposed method uses the Double TCP Connection mechanism to ignore the spoofed packets and establish connection only with the legitimate sources and prevent any SYN Flood DDoS attack on the layer 4. For the Slow HTTP Post and related Application layer attacks, a Hidden Markov Model based system called PBMRD has been proposed which gives probability of an incoming request of being malicious or non malicious and handles them accordingly.