546 220 228

Proc. of Int. Conf. on Recent Trends in Information, Telecommunication and Computing, ITC

Impact Analysis of DDoS Attacks on FTP Services Daljeet Kaur1 and Monika Sachdeva2 1

SBS State Technical Campus/ Deptt. Of Computer Science & Engg., Ferozepur Cantt-152004, Punjab, India Email: daljeetkaur617@gmail.com 2 SBS State Technical Campus/ Deptt. Of Computer Science & Engg., Ferozepur Cantt-152004, Punjab, India Email: monika.sal@rediffmail.com

Abstract— Because the ability of Distributed Denial of Service (DDoS) attack creates huge volume of unwanted traffic so it is widely regarded as a major threat for the current Internet. A flooding-based DDoS attack is a very common way in which a victim machine is attacked by sending a large amount of malicious traffic. Because of these attacks,existing network-level congestion control mechanisms are inadequate for preventing service quality from deteriorating. Although a number of techniques have been proposed to defeat DDoS attacks but still It is very hard to detect and respond to DDoS attacks due to large and complex network environments, the use of source-address spoofing, and moreover its difficult to make difference between legitimate and attack traffic. To measure the impact of DDoS attack on FTP services, repeated research in cyber security that is important to the scientific advancement of the field is required. To fullfill this requirement, the cyberDEfense Technology Experimental Research (DETER) testbed has been developed. In this paper, we have created one dumb-bell topology and generated background traffic as FTP traffic. We have launched different types of DDoS attacks along with FTP traffic by using attack tools available in DETER testbed. Finally we have measured impact of DDoS attack on FTP server in terms of metrics such as throughput, percentage link utilization, and normal packet survival ratio (NPSR).

Index Terms— Normal Packet Survival Ratio (NPSR), vulnerability, confidentiality, botnet, DDoS, availability.

I. INTRODUCTION As DDoS attacks are used to create unwanted traffic for increasing the problems of all Internet Service Providers (ISPs). This unwanted traffic is “malicious or unproductive traffic that attempts to compromise vulnerable hosts, propagate malware, spread spam, or deny valuable services”[1]. It degrade the service quality of networks. Unwanted traffic can be generated due to a flooding-based DDoS (Distributed Denial of Service) attack. A DDoS attack disturbs normal functionality of the Internet servers by exhausting resources.

For exhausting resources, an attacker can create a huge volume of attack traffic to consume the bandwidth of the bottleneck link in the victim network.

Confidentiality, authentication, message integrity and non repudiation are desirable security aspects for secure communication. More people are aware that availability and access control are also urgent requirements of secure communication because of the notorious Denial of Service (DoS) attacks that render by the illegitimate users into a network, host, or other piece of network infrastructure to harm them, especially it is done against the frequently visited websites of a number of high-profile companies or government websites.

DOI: 02.ITC.2014.5.546 © Association of Computer Electronics and Electrical Engineers, 2014

An attacker or hacker gradually send attack programs on insecure machines. These compromised machines are called Handlers or Zombies and are collectively called bots and the attack network is called botnet in hacker’s community depending upon sophistication in logic of implanted programs. In this, hackers send control instructions to masters, which then communicate it to zombies for launching attack. As shown in Figure 1, typical DDoS attack has two stages, the first stage is to compromise susceptible systems that are accessible in the Internet and then install attack tools in these compromised systems. This is known as turning the computers into “zombies.” In the second stage, the attacker sends an attack command to the “zombies” through a secure channel to launch a bandwidth attack against the targeted victim(s).

Figure 1. Attack Modus Operandi

The current attacks on some web sites like Amazon, Yahoo, e-Bay and Microsoft and their resultant disruption of services have uncovered the weakness of the Internet to Distributed Denial of Service (DDoS) attacks. It has been observed through reports that TCP is used in more than 85% of the DoS attacks [2]. The TCP and UDP SYN flooding is the most commonly-used attack. It consists of a stream of spoofed and TCP and UDP SYN packets directed to a listening ports of the victim. The Web servers are not only but also any systems connected to the Internet providing UDP and TCP-based network services, such as FTP servers or Mail servers, are also susceptible to the UDP and TCP SYN flooding attacks.

II. RELATED WORK To measure the effect of DDoS defense approaches, analyzation of impact of DDoS attack is very important.

As per [3],[4], no benchmarks are available for measuring effectiveness of DDoS defense approaches.

Mostly the existing strategies compare good-put and normal packet survival with and without attack and with defense [5]. Some of defense approaches [6] have calculated the response time. By measuring normal packets survival ration proves to be most important because it clearly reflects accuracy of the defense and normal packet loss [7], [8]. Jelena et al. [9], [10] have used percentage of failed transactions (transactions that do not follow QoS thresholds) as a metric to measure DDoS impact. They define a threshold-based model for the relevant traffic measurements, which is application specific. It indicates poor services quality when a measurement exceeds its threshold. One another metric i.e Server timeout has been also used [11]. Because legitimate traffic drop i.e. collateral damage is not indicated. Sardana et al. [12] have used good put, mean time between failure and average response time as performance metrics whereas Gupta et al. [13] have used two statistical metrics namely, Volume and Flow to detect DDoS attacks. As per [9] metrics such as goodput, bad-put, response time, number of active connections , ratio of average serve rate and request rate, and normal packet survival index [8] properly signal denial of service for two way applications such as HTTP, FTP and DNS, but not for media traffic that is sensitive to one-way delay, packet and jitter.

221

III. RECENT INCIDENTS It is observed that 2010 should be viewed as the year distributed denial of service (DDoS) attacks became main stream, says Arbor Networks [14].

TABLE I. R ECENT DDOS INCIDENTS ON IMPORTANT WEB SITES [15] Date 2012, October

DDoS target /Incidents Web site of Capital One Bank

2012, March

South Korea and United states Websites

2012, January

Official Web-site of the office of the vice president of Russia

2011, November

Asian Ecommerce Company

2011, November

Server

2011, October

Site of National Election Com-mission of South Korea

2011, March

On Blogging Platform Live Journal

2010, December

Master Card, PayPal, Visa and Post Finance

2010, November

Whistleblower site Wikileaks

2010, November

whistleblower site Wikileaks

2010, November

Domain registrar Register.com

Consequences/Description The incident was the second attack allegedly waged by a hacktivist group against the bank, It is similar to those launched in 2009

2010, November

Burma’s main Internet provider

2010, September

Fast growing botnet

It caused the site to be down by more than 15 hours.

Flood of Traffic was launched and 250,000 Computers are infected with malware participated The traffic load has been immense with several thou-sands request per second.

Attacks were launched during the morning when citizens would look up information and attack leads to fewer turnouts Experienced serious functionality problems for over 12 Hours and resumed on April 4 and 5, 2011 Attack was launched in support of WikiLeaks.ch and its founder. Attack lasts for more than 16 hours.

Attack size was 10 Gbps. Caused the site unavailable to visitors. Attack was launched to prevent release of secret cables.

Attack size was 2-4 Gbps. Attack was launched just after it released confidential US diplomatic cables.

Impacted DNS, hosting and webmail clients Disrupted most network traffic in and out of the country for 2 days. Geopolitical motivated attack. Attack size was of 1.09 Gbps (average) & 14.58 Gbps (maximum) .

Attack vectors were TCP Syn/rst 85%, flooding 15%.

Botnet’s motive was to provide commercial service

Arbor Networks [14] in its Sixth Annual Worldwide Infrastructure Security Report, released by revealed that DDoS attack Size has increased to 100 Gbps for first time and it is up by 1000% since 2005. This year has witnessed a sharp escalation in the scale and frequency of DDoS attack activity on the Internet. DDoS attacks have been launched against many high profile websites and popular Internet services. In addition to hitting the 100 Gbps attack barrier for the first time, application layer attacks hit an all-time high. The Table I lists some of the recent DDoS attacks incidents [14][15].

IV. PERFORMANCE METRICS Due to seriousness of DDoS problem and growing sophistication of attackers have led to development of numerous defense mechanisms [16],[17]. But the growing number of DDoS attacks and their financial implications still needs of a comprehensive solution. Moreover, as we studied that attackers share their attack codes to fight against these attacks, Internet community needs to devise better ways to accumulate details of these attacks. Only then a comprehensive solution against DDoS attacks can be devised. Technically, when DDoS attacks are launched, the various network performance metrics are affected. In current work, our focus is on measuring these network performance metrics and then comparing them with and without attacks.

As mentioned in Table II, We have measured impact of DDoS attack using following metrics: 222

TABLE II. METRICS FOR ATTACK’S IMPACT ANALYSIS Metric Description Vα= (ьl + ьa)/Δ, ьl , ьa and Δ represents no. of legitimate bytes, no. of attack bytes and time window for analysis respectively.

Throughput (α) Percentage Link Utilization (£)

£ represents percentage of bandwidth that is being used for good put.

Normal Packet Survival Ratio (η)



 

η = pl /( pl + pa ), pl represents the no. of legitimate packets and pa represents total no of packets received at victim.

Throughput: Throughput is defined as the rate of sending or receiving of data by a network. It is a good measure of the channel capacity of a communications link, and connections to the internet are which is mostly rated in terms of how many bits they pass per second (bit/s). Throughput is measured in terms of good-put and bad-put respectively. Good-put is defined as no. of bits per second of legitimate traffic that are received at the server and bad-put is defined as no. of bits per second of attack traffic that are received at the server.

Backbone Link Utilization: Backbone Link Utilization is defined as percentage of bandwidth that is being used for good put (legitimate traffic) Normal Packet Survival Ratio: This metric is used to measure impact of attack as we can measure impact of attack as a percentage of legitimate packets delivered during the attack. If this percentage is high, then the service continues with little interruption.

V. EVALUATION IN TESTBED EXPERIMENT We have used DETER testbed to evaluate our metrics in experiments using SEER (Security Experimentation EnviRonment) GUI BETA6 environment [18][19]. This test bed is located at the USC Information Sciences Institute and UC Berkeley and security researchers used this testbed to evaluate attacks and defenses in a controlled environment.

A. Experimental Topology Figure 2 shows the experimental topology and Figure 3 shows our experimental topology definition for FTP applications in which R1, R2, R3 and R4 are routers, node S is server and L1-L20 are clients. These clients are used to send legitimate requests to server S via router R1 and R2. The bandwidth of all links is to be set 100Mbps, and 1.5Mbps is the bandwidth of bottleneck link (R1-R2). In this topology node A1 acts as attacking node and it sends attack traffic to server S via router R1 and R2. The link between R1 and R2 is called bottleneck link.

Figure 2. Experimental Topology

223

set ns [new Simulator] source tb_compat.tcl #Create the topology nodes foreach node { V S R1 R2 R3 R4 L1 L2 L3 L4 L5 L6 L7 L8 L9 L10 L11 L12 L13 L14 L15 L16 L17 L18 L19 L20 A1 A2 control } { #Create new node set $node [$ns node] #Define the OS image tb-set-node-os [set $node] FC4-STD #Have SEER install itself and startup when the node is ready tb-set-node-startcmd [set $node] "sudo python /share/seer/v160/experiment-setup.py Basic" } #Create the topology links set linkRV [$ns duplex-link $V $R1 100Mb 3ms DropTail] set linkRS [$ns duplex-link $S $R1 100Mb 3ms DropTail] set linkRA1 [$ns duplex-link $A1 $R3 100Mb 3ms DropTail] set linkRA2 [$ns duplex-link $A2 $R4 100Mb 3ms DropTail] set linkRR3 [$ns duplex-link $R2 $R3 100Mb 3ms DropTail] set linkRR4 [$ns duplex-link $R2 $R4 100Mb 3ms DropTail] set linkRR2 [$ns duplex-link $R2 $R1 1.5Mb 0ms DropTail] set lannet0 [$ns make-lan "$L1 $L2 $L3 $L4 $L5 $R3" 100Mb 0ms] set lannet1 [$ns make-lan "$L6 $L7 $L8 $L9 $L10 $R3" 100Mb 0ms] set lannet2 [$ns make-lan "$L11 $L12 $L13 $L14 $L15 $R4" 100Mb 0ms] set lannet3 [$ns make-lan "$L16 $L17 $L18 $L19 $L20 $R4" 100Mb 0ms] $ns rtproto Static $ns run Figure 3. Experimental Topology Definition

The purpose of attack node is to congest the bandwidth of bottleneck link so that legitimate traffic could not get accessed by the server S. We have generated a random network consist of FTP clients, servers and attack source. Multiple legitimate clients connected with server and one attack source is used as DDoS flooding attacker in our emulated network,. This emulates the real situation of DDoS flooding attack.

B. Legitimate Traffic We have used FTP traffic in our experiment is used and there are 20 legitimate client nodes which send requests to the server S for 1-30 seconds and then 61-90 seconds with following thinking time. The configuration of said traffic parameters used to send legitimate traffic is demonstrated in Table III : TABLE III. EMULATION PARAMETERS USED IN EXPERIMENT Parameters Clients Server Attack Host Thinking Time File Size Emulation Time Bottleneck Bandwidth Access Bandwidth Legitimate Request Time Attack Time Attack Type Server Delay Access Link Delay Backbone Link Delay

Values L1-L20 S A1 Minmax(0.01,0.1) Minmax(512,1024) 90 sec 1.5Mb 100Mb 1-30 sec and 61-90 sec 31-60 sec DDoS Packet Flooding 3ms 3ms 0ms

224

C. Attack Traffic In experimeny,we have used packet flooding attack to generate DDoS attack. Node A1 launches attack towards S and thus consumes bandwidth of bottleneck in link R1-R2. UDP protocol is used for launching attacks. Further attack types flat, ramp-up, pulse and ramp-pulse are used in our experiment. Attack traffic from A1 starts at 31st second and stops at 60th second. Then we have analyzed impact of DDoS attacks on FTP service. Table IV shows attack parameters used in our emulation experiment. We have generated following flooding attack types: Flat Attack: Flat attack is the attack in which high rate is achieved and maintained till the attack is stopped.

Ramp-up Attack: In the Ramp-up attack the high rate is achieved gradually within the rise time specified and is maintained until the attack is stopped.

Ramp-down Attack: In this attack the high rate is achieved gradually and after high time it falls to the low rate with in low time.

Pulse Attack: Pulse attack is the attack in which the attack oscillates between high rate and low rate. It remains at high rate for high time specified and then falls to low rate specified for the low tie specified and so on.

Ramp-pulse Attack: In Ramp-pulse attack it is a mixture of Ramp-up, Rampdown and Pulse attack means it used three attacks.

TABLE IV. ATTACK PARAMETERS USED IN EXPERIMENT [20] Attack Type

Flooding

Flooding

Flooding

Attack Source Attack Target

A1

A1

A1

S

S

S

Protocol

UDP

UDP

UDP

S UDP

Length Min

100

200

200

100

Length Max

200 Flat 200 100 100 0 0 0 0 0 57 57 1000

300 Ramp-up 300 5000 100 8000 1.0 10000 0 0 57 57 1000

300 Pulse 500 6000 200 5000 0 0 0 0 57 57 1000

200 Ramp-pulse 400 5000 200 4000 1.0 10000 1.0 10000 57 57 1000

2000 SYN

2000 SYN

2000 SYN

2000 SYN

Flooding

Flood Type High Rate High Time Low Rate Low Time Rise Shape Rise Time Fall Shape Fall Time Sport Min Sport Max Dport Min Dport Max TCP Flags

A1

VI. RESULTS AND DISCUSSIONS The effect of DDoS attacks on the performance of FTP service is analyzed below:A. Throughput For measuring the throughput, during a DDoS attack, backbone link is attacked to force the edge router at the ISP of victim end to drop most legitimate packets. In Figure 4 and Figure 5, we have measured throughput in terms of good-put and bad-put to get the measure of actual loss. The throughput is divided into good-put and bad-put respectively. Good-put is defined as no. of bits per second of legitimate traffic that are received at the server whereas bad-put gives no. of bits per second of attack traffic that are received at the server.

225

B. Backbone Link Utilizationt As Backbone Link utilization is defined as percentage of bandwidth that is carrying legitimate traffic. It is shown in Figure 6, that Backbone Link utilization is nearly 100% without attack. During Attack, Backbone Link utilization drops more than 50%.

C. Normal Packet Survival Ratio (NPSR) As NPSR is defined as ratio of good-put and bad-put. This is the percentage of legitimate packets that can survive during attack. NPSR should be high. We can measure impact of attack as a percentage of legitimate packets delivered during the attack. If this percentage is high, service continues with little interruption. NPSR starts decreasing with increased rate of attack traffic and as bandwidth of the link is limited, so legitimate packets starts dropping. As shown in Figure 7, 100% legitimate packets are delivered without attack but during attacks, only 50% legitimate packets are delivered.

1.7

Flat Attack Rampup Attack Ramp-pulse Attack Pulse Attack

1.2

91.0

81.0

71.0

61.0

51.0

41.0

31.0

21.0

0.2

11.0

0.7 1.0

Throughput (Mbps)

Goodput of FTP Service under UDP Attack

Time (Sec)

Figure 4. Good-put of FTP traffic through bottleneck link during UDP Attack

Throughput (Mbps)

Badput of FTP Service under UDP Attack 0.4 0.3 0.2 0.1 0 00 .00 .00 .00 .00 .00 . 00 .00 .00 .00 .00 .00 . 00 .53 1.

8 15 22 29 36 43 50 57 64 71 78 85 91

Flat Attack Ramp-up Attack Ramp-pulse Attack Pulse Attack

Time (Sec)

Figure 5. Bad-put of FTP traffic through bottleneck link during UDP Attack

% Link Utilization

Avg Link Utilization of UDP Attack 120 100 80 60 40 20 0 0 1.

Flat Attack Pulse Attack Ramp-pulse Attack Ramp-up Attack

0 0 0 0 0 0 0 0 0 0 0 0 8. 15. 22. 29. 36. 43. 50. 57. 64. 71. 78. 85.

Time (Sec)

Figure 6. Average Bottleneck Bandwidth Utilization in FTP Service during UDP Attack

226

NPSR (Mbps)

Normal Packet Survival Ratio Flat Attack Pulse Attack Ramp-pulse Attack Ramp-up Attack

1.2 1 0.8 0.6 0.4 0.2 0 0 0 0 0 0 0 0 0 0 0 0 0 1. 9. 17. 25. 33. 41. 49. 57. 65. 73. 81. 89.

Time (Sec) Figure 7. Average Ratio of Legitimate FTP Packets Survival during UDP Attack

VII. CONCLUSIONS DDoS attack incidents are increasing day by day. Not only, DDoS incidents are growing day by day but the technique to attack, botnet size, and attack traffic are also attaining new heights. Effective mechanisms are needed to elicit the information of attack to develop the potential defense mechanism. We evaluated our metrics in experiments on the DETER testbed. DETER testbed allows to carry the DDoS attack experiment in a secure environment. It also allows creating, plan, and iterating through a large range of experimental scenarios with a relative ease. We pointed out the possibility of DDoS attacks on FTP application by analyzing the characteristics of FTP application. DDoS attacks are launched on FTP server and measure the impact of DDoS attacks on FTP service. Measurement of Service degradation due to DDoS attacks are quantified in terms of Throughput, Normal Packet Survival Ratio and Backbone Link Utilization in this paper. We generated attacks at different strengths so that DDoS attack’s impact can be measured. The attacks are generated by keeping some realistic conditions in mind, such as Limited Bottleneck Bandwidth.

Moreover the quantitative measurements clearly indicated the impact of attack on FTP service.

Distributed Denial of Service attack is one of the major threats for current internet. In the present paper we have measured the impact of DDoS attacks using a number of metrics. We are working on extending the existing work as below:  Adding some more realistic features to the topology, traffic parameters and Attack parameters (such as ISP Level topology, Large Number of Legitimate Clients, High Legitimate Traffic Rate, High Attack Rate), so as to get more accurate results of DDoS attack’s influence on FTP services.  Comparison of various DDoS Defense Mechanism using weighted metrics.

ACKNOWLEDGMENT We would like to express our gratitude to Director, SBS State Technical Campus, Ferozepur, for providing the academic environment to pursue research activities. We are extremely thankful to Dr. Krishan Kumar, Associate Professor, Department of Computer Science & Engg., for their guidance and inputs. Finally the authors wishes to appreciate the support extended by family and friends.

REFERENCES [1] K. Xu, Z.L. Zhang, and S. Bhattacharyya, “Reducing unwanted traffic in a backbone network,” in Steps to Reducing Unwanted Traffic on the Internet Workshop (SRUTI), 2005, pp. 9–15.

[2] A. Keromytis, V. Misra, D. Rubenstein(2002) SOS: Secure overlay services. In: ACMSIGCOMM Computer Communication Review, Proceedings of the 2002 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications, Pittsburgh, PA, vol. 32, pp 61–72 [3] J. Mirkovic and P. Reiher, A University of Delaware Subcontract to UCLA, www.lasr.cs.ucla.edu/Benchmarks_DDoS_Def_Eval.html.

[4] J. Mirkovic, E Arikan, S. Wei, R. Thomas, S. Fahmy, and P. Reiher. “Benchmarks for DDOS Defense Evaluation”, In Proceedings of Military Communications Conference (MILCOM), pp. 1-10, 2006.

227

[5] Y. You. “A defense framework for flooding based DDoS Attacks”, M.S. Thesis, Queen’s University, Canada,2007.

[6] J. Mirkovic,P. Reiher,S. Fahmy,R. Thomas, A. Hussain, S. Schwab. “Measuring denial Of service”, 2nd ACM workshop on Quality of protection QoP, pp. 53 – 58, 2006.

[7] S.Kumar,M.Singh,M.Sachdeva,K.Kumar,”Flooding based DDoS attacks and their influence on web services”, International Journal of Computer Science and Information technology, Vol.2(3),pp 1131-1136,2011.

[8] K. Kumar. Protection from Distributed Denial of Service (DDoS) Attacks in ISP Domain, Ph.D. Thesis, Indian Institute of Technology, Roorkee, India, 2007.

[9] J. Mirkovic, A. Hussain, B. Wilson, S. Fahmy, P. Reiher, R Thomas, W. M. Yao, S Schwab. “Towards user-centric metrics for denial-of-service measurement” , in proceedings of the 2007 workshop on Experimental computer science, San Diego, California.

[10] J. Mirkovic, S. Fahmy, P. Reiher, R. Thomas, A. Hussain, S. Schwab,and C. Ko. “Measuring Impact of DoS Attacks”In Proceedings of the DETER Community Workshop on Cyber Security,Experimentation, June 2006.

[11] C. Ko, A. Hussain, S. Schwab, R. Thomas, and B. Wilson. “Towards systematic IDS evaluation", in Proceedings of DETER Community Workshop, pp. 20- 23, June 2006.

[12] A. Sardana and R.C. Joshi, “An Integrated Honeypot Framework for Proactive Detection, Characterization and Redirection of DDoS Attacks at ISP level,” International Journal of Information Assurance and Security (JIAS), 3 (1), pp. 1-15, March 2008. Available at http://www.mirlabs.org/jias/sardana.pdf.

[13] B.B. Gupta, R. C. Joshi, and M. Misra, “An ISP Level Solution to Combat DDoS Attacks using Combined Statistical Based Approach,” Journal of Information Assurance and Security 3(2), 102-110, June 2008. Available at http://www.mirlabs.org/jias/gupta.pdf.

[14] DoS Attacks Exceed 100 Gbps, Attack Surface Continues to Expand By Mike Lennon on February 01, 2011 available at http://www.securityweek.com/ddos-attacks-exceed-100-gbps-attacksurface-continues-expand .

[15] K.Arora, K.Kumar, M.Sachdeva,”Impact Analysis of Recent DdoS Attacks”, International Journal of Computer Science and Engg., ISSN 0975-3397,Vol. 3,pp 877-884, 2011.

[16] D. kaur, M. Sachdeva and K. Kumar,” Study of Recent DDoS Attacks and Defense Evaluation Approaches” International Journal of Emerging Technology and Advanced Engineering, ISSN 2250-2459(online), Volume 3, Issue 1, pp. 332-336, January 2013. http://www.ijetae.com/Volume3Issue1.html [17] R. Chen, J. Park, and R.Marchany, “A Divide and Conquer Strategy for Thwarting Distributed Denial of Service Attacks,” Computer Journal of IEEE Transactions on Parallel and Distributed Systems, vol. 18, no. 5, pp. 577-588, 2007.

[18] D. kaur, M. Sachdeva and K. Kumar,” Study of DDoS Attacks using Deter Testbed”,International Journal of Computing and Business Research, IISN:2229-6166, Vol 3,May 2012.

[19] J. Mirkovic, S. Wei, A. Hussain, B. Wilson, R. Thomas, S. Schwab, S. Fahmy, R. Chertov, and P. Reiher. “DDoS Benchmarks and Experimenter’s Workbench for the DETER Testbed”, Proceedings of Tridentcom, 2007.

[20] D. kaur, M. Sachdeva,” Study of Flooding Based DDoS Attacks and Their Effect Using Deter Testbed”, International Journal of Research in Engg and Tech.,ISSN:2319-1163,Vol 2,pp 879-884,2013.

228