Abstract
Distributed denial of service (DDoS) attacks have always been one of the most important issues in network security, and SYN Flood attacks are currently the most popular and commonly used attack methods for denial of service (DoS) and distributed denial of service DDoS. This paper proposes a system framework based on extended Berkeley Packet Filter (eBPF) and eXpress Data Path (XDP) to realize automatic detection and defense against Synchronize Sequence Numbers (SYN) Flood attacks. By analyzing the principle of SYN Flood attack, using eBPF to track and monitor the attack process of SYN Flood attack in the Linux kernel network protocol stack, extract the number of SYN request connections per unit time corresponding to the IP address and the number of server retransmission SYN request connections Indicator data. The indicator data corresponding to each IP address is sent to the detection algorithm for analysis and source tracing, and the abnormal connection IP address is found. Finally, XDP is used to defend against abnormal connection IP addresses. The experimental results show that the system framework can realize automatic detection and defense of SYN Flood attacks. SYN Flood attack characteristic data can be easily extracted using eBPF. The detection algorithm can accurately trace the source to abnormal IP addresses. XDP can accurately defend against abnormal IP addresses. At the same time, data packets are processed faster on the data receiving path, which greatly reduces the consumption of system resources and improves the efficiency of the system.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Wang, Y.X., Huang, H.X.: Overview of the development and defense of DDoS attacks. Mod. Comput. 02, 51–56 (2021)
Liu, Y., He, Y.: The SYN flood detection method based on statistical properties. Softw. Eng. 20(04), 4–8 (2017)
Li, Z.W., Wu, C.B., Xu, X.C.: Research on DDoS intrusion detection system based on linux high speed packet capturing platform. Comput. Sci. 41(04), 159–162 (2014)
Yu, B., Wang, X., Huang, T.M.: A scheme to prevent DDoS attacks based on eBPF and XDP. In: 2019 Internet Security and Governance Forum, 3 (2019)
Liu, Y.: Research of new SYN flood defense model based on linux. Comput. Sci. 40(S2), 210–213 (2013)
Liu, P.E., Sheng, Z.H.: Defending against tcp syn flooding with a new kind of syn-agent. In: 2008 International Conference on Machine Learning and Cybernetics, pp. 1218–1221 (2008)
Hussain, K., Hussain, S.J., Jhanjhi, N., et al.: SYN flood attack detection based on bayes estimator (SFADBE) for manet. In: International Conference on Computer and Information Sciences (ICCIS), 2019 ICCIS Conference, pp. 1–4. IEEE (2019)
Dimolianis, M., Pavlidis, A., Maglaris, V.: SYN flood attack detection and mitigation using machine learning traffic classification and programmable data plane filtering. In: Conference on Innovation in Clouds, Internet and Networks and Workshops (ICIN), 2021 24th ICIN Conference, pp. 126–133. IEEE (2021)
Nam, T., Kim, J.: Open-source IO visor eBPF-based packet tracing on multiple network interfaces of linux boxes. In: International Conference on Information and Communication Technology Convergence (ICTC), 2017 ICTC Conference, pp. 324–326. IEEE (2017)
Troia, S., Mazzara, M., Zorello, L.M.M., et al.: Resiliency in SD-WAN with eBPF monitoring: municipal network and video streaming use cases. In: International Conference on the Design of Reliable Communication Networks (DRCN), 2021 17th DRCN Conference, pp. 1–3. IEEE (2021)
Scholz, D., Raumer, D., Emmerich, P., et al.: Performance implications of packet filtering with linux eBPF. In: International Teletraffic Congress (ITC), 2018 30th ITC Conference, pp. 209–217. IEEE (2018)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2022 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Zhang, X., Chen, L., Bai, J. (2022). SYN Flood Attack Detection and Defense Method Based on Extended Berkeley Packet Filter. In: Xie, Q., Zhao, L., Li, K., Yadav, A., Wang, L. (eds) Advances in Natural Computation, Fuzzy Systems and Knowledge Discovery. ICNC-FSKD 2021. Lecture Notes on Data Engineering and Communications Technologies, vol 89. Springer, Cham. https://doi.org/10.1007/978-3-030-89698-0_145
Download citation
DOI: https://doi.org/10.1007/978-3-030-89698-0_145
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-89697-3
Online ISBN: 978-3-030-89698-0
eBook Packages: Intelligent Technologies and RoboticsIntelligent Technologies and Robotics (R0)