 |
DDoS attacks in the context of Blockchain. The machine
learning/deep learning models are trained on data from attacks
and genuine traffic. The framework will enable the trigger
for flagging white or boycotted IP addresses and identify the
attacks targeting the network.
In a normal TCP connection, the first step is the TCP
connection establishment which is a 3-way handshake. In a
3-way handshake, the client sends a SYN packet, the server
sends a SYN+ACK packet after receiving the SYN packet.
When the client receives the SYN+ACK packet, it sends an
ACK packet. In the framework, three computers are used as
attack computers that send TCPSYN requests from different
source IP addresess targeting a victom server which is listeing
on port 80. This floods the server with TCPSYN requests
as the Server will send SYN+ACK packet to each TCPSYN
packet.
According to the framework shown in Fig.1, the raw features
are fed to the ExtraTreeClassifier to obtain the important
features relevant to the classification task. The classification
task is a three-class classification task: Benign, UDP flood,
and TCPSYN flood attacks.
|
IEEE/ICACT20220078 Slide.07
[Big Slide]