ID NO : 1070 S. VARALAKSHMI Sethu Institute Of Tech IV year -ECE department CEC Batch : AUG 2012

The Internet was initially designed for openness and scalability

The attacker first takes control of a large number of vulnerable hosts on the internet, and then uses them to send a huge flood of packets to the victim simultaneously, exhausting all of its resources.

 Sender authentication process Marking M (24 bit random number generated by the source) is sent to the receiver proxy server by the sender After receiving the Marking value M, the receiver proxy server sends back an echo message for the verification of the marking value If the marking value is correct, then the sender drops a positive acknowledgement After receiving positive acknowledgement, the receiver will send a new marking digest to the source The sender will put the digest value to the option field of the packet and then sends the packet

 TCP flow rate calculation Normal user usually sends 3 to 4 packet successively and wait for reply Attacker sends the packets continuously Normal flow rate = tp/2 TD is the time duration between two packets tp is the propagation time If ((tp/2)< TD)  Normal packet Else  Attack packets

 Entropy calculation Entropy is the measure of uncertainty or randomness associated with a random variable (data over the network) The entropy value is  small when the class distribution is pure  large when the class distribution is impure Change in randomness is detected on comparing the value of a sample of packet header files to that of another sample of packet header files Entropy on receiver proxy server is given by P (xi) = (Number of attack)/ Total No of packet

Normalized Entropy is given by NE = H/log n0 n0 = no of source node in particular Time Interval If NE < threshold (Δ), then attack is there in receiver proxy server The routers with NE rate less than threshold are suspected as attack routers The NE rate for the neighboring routers of the attack routers are calculated The process is repeated until we reach the source attacker

The date and time of the agent software installation is gathered from the attacker The above details are provided to the attacker’s ISP to get the IP address of the source attacker The IANA provides the information related on which ISP the IP address belongs From the new ISP, the source attacker is traced ATTACKER IDENTIFICATION