Detecção de ataques syn-flooding em redes definidas por software - Fox, Eduardo Farias Brinds-Ley (2019)
With the amount of information available on the Internet, one can easily perform a DoS attack by just following an available tutorial, without having to have much computational knowledge for this action. Syn-ﬂooding is a simple attack to be carried out, but has disastrous consequences, making it impossible to access a site or other resources on a network. In Software Deﬁned Networks (SDN), this type of attack can also affect the entire infrastructure and can stop a network altogether, from the denial of the service of the controller itself. Thi swork proposes the detection of Syn-ﬂooding attacks in na SDN network by measuring the variation of the amount of ﬂows in a pre-established time interval and the monitoring the TCP ports, helping the network administrator to perform corrective and preventive actions from the detection of the attack. To implement the proposal, a tool called FindFlows has been developed that displays a list of all the active hosts in an SDN network, informing the amount of ﬂows of each host in different time intervals, the variation of the ﬂows in those intervals and, ﬁnally, the classiﬁcation of this host as an attacker, victim or legitimate user. Of the tests performed, the FindFlows was able to detect the Syn-ﬂooding attack in 90% of cases.