DOS Attack from the vendor's network

This document provides an overview of DOS attacks from the vendor's network and discusses the scenario, assumptions, integral actions, information captured from snort IDS, configuration of snort IDS, implementation of snort IDS in a virtual machine, performing DOS attack on kali linux, IDS and web server, and conclusion.

Assignment
DOS Attack from the vendor's network

Table of contents
1. Introduction ……………………………………………………………………………….. 2
2. Scenario where DOS attack occur from vendor’s network ……………………………….. 2
3. Assumptions ……………………………………………………………………………….. 4
4. Integral actions ……………………………………………………………………………. 4
5. Information captured from snort IDS ……………………………………………………… 5
6. Configuration of snort IDS ………………………………………………………………… 5
7. Implementation of snort IDS in virtual machine ………………………………………….. 8
8. Performing DOS attack on kali linux, IDS and web server ………………………………. 10
9. Conclusion …………………………………………………………………………………. 13
10. Reference …………………………………………………………………………………. 14
Page 1

Introduction
As innovation advancement and capacities of data warfare have grown fundamentally as of late, the
likelihood of digital attacks have expanded too. PC organize attacks principally known as digital
attacks can crush enemy information, PC frameworks, and arranges, and can majorly affect a foe's
capacity to take up arms. In the digital field, the circumstance is, somehow or another, more awful
than essentially paying too little notice to a potential new risk until it shows itself. Dangers in the
digital field have showed themselves. We are helped continually to remember our vulnerabilities to
the risk, yet regardless we are not doing what's needed(Chen, Ho, Zhang, & Yu, 2017). Each hour of
consistently, some individual or gathering is composing or spreading another troublesome infection
or worm or is breaking into a PC arrange or to hurt a system by some different methods. It is
typically said that it is exceptionally profitable and easy to acquire PC our system and to expand its
use and yet it is altogether troublesome and undeniably progressively costly to create innovations to
make it secure essentially in light of the web, a system which is utilized to share data as opposed to
concealing it. Most digital aggressors are pulled in to high esteem targets, for example, systems,
servers, or switches, whose disturbance could yield money related.
Scenario where DOS attack occur from vendor's network.

In this sort of attack, the attacker utilizes a genuine PC to dispatch an attack against the target
individual by concealing its very own IP address. The attacker sends a bucket of information to the
network so that the network perceives it is from inside the network. The real machine will, thus,
send back information to the attacker(Ormazabal, Schulzrinne, Yardeni, & Patnaik, 2015).
In the event that the reaction information is enormous, the effect is enhanced. We can call the
genuine PCs reflectors and this sort of assault, where the aggressor sends little information and the
unfortunate casualty gets a bigger measure of information, is called an enhancement assault. Since
the assailant does not straightforwardly utilize PCs constrained by him and rather utilizes real PCs,
it's known as an intelligent DDoS attack(Cheng, Yue, Hu, & Chen, 2019, April).

The reflectors are not traded off machines, not at all like botnets. Reflectors are machines that react
to a specific solicitation. It very well may be a DNS demand or a Networking Time Protocol (NTP)
demand, etc.
DNS intensification assaults, WordPress pingback assaults, and NTP assaults are enhancement
assaults. In a DNS intensification assault, the assailant sends a produced bundle to the DNS server
containing the IP address of the person in question. The DNS server answers back to the
unfortunate casualty rather with bigger information. Different sorts of enhancement assault
incorporate SMTP, SSDP, etc.
We will take a gander at a case of such an assault in the following segment. The PCs that are
utilized to send traffic to the injured individual are not the traded off ones and are called reflectors.
There are a few gatherings of digital crooks in charge of doing pay-off DDoS assaults, for example,
DD4BC, Armada Collective, Fancy Bear, XMR-Squad, and Lizard Squad.
These gatherings target undertakings. They will initially convey a coercion email, trailed by an
assault if the unfortunate casualty does not pay the payment.
(Chelladhurai, Chelliah, & Kumar, 2016, June).
Assumptions.
• A start to finish burrowing architecture: the organization transparently builds up a passage over
the interPLMN spine straightforwardly towards a Packet Data Gateway in the HPLMN
• Tunnel foundation is free of the underlying WLAN Access Authentication and Authorisation
(specifically, it is autonomously verified and approved)

• After passage foundation, channels can be given to the VPLMN which permit characterization of
traffic-related with a solitary passage in the VPLMN
Integral Actions:
Organizations can take a few strategic strides to secure themselves. These include:
Authorizing a multi-layered safeguard methodology. Guarantee that it covers your whole
endeavor, all endpoints, cell phones, applications, and information. Where conceivable, use
encryption and a few factor validation for system and information get to.
Playing out an vendor evaluation or making administration level concurrences with vendors:
Implement a "least benefit" approach in regards to who and what others can get to. Make it a
propensity to survey the utilization of accreditations with vendors. You could even make it a stride
further with an administration level understanding, which authoritatively commits that vendors
follow your organization's security approaches. Your SLA should give your organization the
privilege to review the vendor's consistence.
Ceaselessly backing-up information. This can defend against ransomware, which freezes PC
documents until the victims fulfills the money related needs. Sponsorship up information can
demonstrate basic if your PCs or servers get bolted in light of the fact that you wouldn't have to pay
for access to your information.
Patching frequently. A product fix is a code update in existing programming. They are regularly
impermanent fixes between full arrivals of programming. A fix may fix a product bug, address new
security powerlessness, address programming dependability issues, or put in new drivers.
Whitelisting software applications. Application whitelisting would keep PCs from introducing
non-endorsed software. This enables overseers to have substantially more control.
Information captured in snort IDS.

 System Intrusion Detection System (NIDS) that catch information bundles going on the
system media and match them to a database of marks
 Host-based Intrusion Detection System (HIDS) that are introduced as operators on a host.
This framework can investigate framework and application log records to recognize any
gatecrasher action
 Engraving based interruption affirmation structures screen the majority of the packs crossing
the system and look at them against a database of imprint of known malicious dangers,
much like antivirus programming(Gope, Lee, & Quek, 2016).
Configuring snort IDS
Introduction to IDS
IDS Stands for Intrusion Detection System. The procedures and techniques on which an IDS is
established on are utilized to screen and uncover malignant exercises both on the host and system
level. When the said exercises happen then an alarm is issued to mindful all of the assault. It tends
to be equipment or programming or a blend of both; relies upon the prerequisite. An IDS utilize
both mark or peculiarity based procedure together or independently; again relying upon necessity.
Your system topology figures out where to include interruption discovery frameworks. Regardless
of whether it ought to be situated at least one spots relies upon in the event that you need to follow
inner danger or outer risk. For example, on the off chance that you need to shield yourself from
outside traffic, at that point you should put an IDS at the switch and in the event that you need to
ensure the internal system, at that point place the IDS on each system section(Wei, Fung, 2015, June).
Classifications of IDS
Signature-Based IDS

This IDS checks marks of information parcels in the system traffic. Fundamentally, it finds the
information bundles and uses their marks to affirm whether they are a danger or not. Such marks are
generally known for interruption related marks or peculiarities identified with web convention.
Gatecrashers, for example, PC infections, and so forth, dependably have a mark, subsequently, it
tends to be effectively recognized by programming IDS. As it utilizes marks to recognize the
dangers(Wu, Zhang, Yue, 2016).
Anomaly IDS
This IDS generally distinguishes if an information parcel carries on irregularity. It issues an alarm if
parcel inconsistencies are available in convention header parts. This framework creates preferred
outcomes at times over mark based IDS. Ordinarily such IDS catches information from the system
and on these bundles, it at that point applies the standards to it so as to identify irregularities(Dridi,
Zhani, 2016, October).
Snort is installed with the command below;
After installation is complete, open configuration file via nano or any other text editor with the
command below;
After opening, set up the network addresses that you would like to protect. For example, in our case
it is;

We now run the below command to enable IDS mode of the snort;
We can start making changes to the rules in snort through the commands given below;
Implementation of the configuration in (4) above
Installation of snort IDS
Type the command below

Set up addresses to protect in the network
Enable IDS by running the command below;

Make changes to the rules with the commands shown below;
Writing some rules to snort IDS(Ding, Li, Quevedo, Dey, & Shi, 2017)

Performing DOS attack on the web server
DOS Metasploit – Kali linux
I will use virtual machine to perform an attack on a web server with snort IDS so that we can
observer how snort IDS prevents an attack.
SYN flood

It is a kind of DoS attack which use to send an immense measure of Sync to expend every one of
the assets of the target system. How about we begin by propelling Metasploit by just composing
msfconsole in your terminal Window. It will take a few minutes to dispatch the reassure.
Type show options once auxiliary is loaded type
 show options
After that set RHOST and RPORT which represents the target address and the port to be used in
launching the attack(Peng, Li, Fei, 2017).
The attack is launched in the web server. The next step is to check on our snort IDS in the virtual
machine.
From the figure below, snort IDS detected our payload from our kali linux(Yuan, Yuan, Guo, Yang, &
Sun, 2016).

We go back to our metasploit to check the process of the payload.
No any running process since our payload have been prevented by the snort IDS

Conclusion
The procedures and techniques on which an IDS is established on are utilized to screen and uncover
malignant exercises both on the host and system level. When the said exercises happen then an
alarm is issued to mindful all of the assault. It tends to be equipment or programming or a blend of
both; relies upon the prerequisite. An IDS utilize both mark or peculiarity based procedure together
or independently; again relying upon necessity. Your system topology figures out where to include
interruption discovery frameworks. Regardless of whether it ought to be situated at least one spots
relies upon in the event that you need to follow inner danger or outer risk. For example, on the off
chance that you need to shield yourself from outside traffic, at that point you should put an IDS at
the switch and in the event that you need to ensure the internal system, at that point place the IDS
on each system section.

Reference
Yuan, Y., Yuan, H., Guo, L., Yang, H., & Sun, S. (2016). Resilient control of networked control system under
DoS attacks: A unified game approach. IEEE Transactions on Industrial Informatics, 12(5), 1786-
1794.
Peng, C., Li, J., & Fei, M. (2017). Resilient Event-Triggering $ H_ {\infty} $ Load Frequency Control for Multi-
Area Power Systems With Energy-Limited DoS Attacks. IEEE Transactions on Power
Systems, 32(5), 4110-4118.
Ding, K., Li, Y., Quevedo, D. E., Dey, S., & Shi, L. (2017). A multi-channel transmission schedule for remote
state estimation under DoS attacks. Automatic, 78, 194-201.
Dridi, L., & Zhani, M. F. (2016, October). SDN-guard: DoS attacks mitigation in SDN networks. In 2016 5th
IEEE International Conference on Cloud Networking (Cloudnet) (pp. 212-217). IEEE.
Wu, Z., Zhang, L., & Yue, M. (2016). Low-rate DoS attacks detection based on network multifractal. IEEE
Transactions on Dependable and Secure Computing, 13(5), 559-567.
Wei, L., & Fung, C. (2015, June). FlowRanger: A request prioritizing algorithm for controller DoS attacks in
5254-5259). IEEE.
Gope, P., Lee, J., & Quek, T. Q. (2016). The resilience of DoS attacks in designing anonymous user
authentication protocol for wireless sensor networks. IEEE Sensors Journal, 17(2), 498-503.
Chen, B., Ho, D. W., Zhang, W. A., & Yu, L. (2017). Distributed dimensionality reduction fusion estimation
cyber-physical systems under DoS attacks. IEEE Transactions on Systems, Man, and Cybernetics:
Systems, (99), 1-14.
Cheng, Z., Yue, D., Hu, S., & Chen, L. (2019, April). Event-based resilient H∞ fuzzy filter design under DoS
attacks. In 2018 5th IEEE International Conference on Cloud Computing and Intelligence Systems
(CCIS) (pp. 198-202). IEEE.
Chelladhurai, J., Chelliah, P. R., & Kumar, S. A. (2016, June). Securing docker containers from denial
of service (dos) attacks. In 2016 IEEE International Conference on Services Computing (SCC) (pp.
856-859). IEEE.

Ormazabal, G. S., Schulzrinne, H. G., Yardeni, E., & Patnaik, S. B. (2015). U.S. Patent No. 8,966,619.
Washington, DC: U.S. Patent and Trademark Office.
Zhang, T., Zhang, Y., & Lee, R. B. (2017, April). Dos attacks on your memory in the cloud. In Proceedings of
the 2017 ACM on Asia Conference on Computer and Communications Security(pp. 253-
265)ACM.
ACM.