DOS Attack on Web Server

This document provides an overview of DOS attacks on web servers, including the scenario and assumptions. It also discusses solutions to address cyber security attacks, information gathered from snort IDS, and configuring snort IDS to protect against DOS attacks.

Assignment
DOS Attack on web server

Table of contents
1. Introduction ……………………………………………………………………………………. 2
2. DOS attack scenario ……………………………………………………………………………. 2
3. Assumptions ……………………………………………………………………………………. 3
4. Solutions to address cyber security attack ……………………………………………………… 4
5. Information gathered from snort IDS ………………………………………………………….. 5
6. Configuring snort IDS …………………………………………………………………………. 6
7. Implementation of configuration on snort IDS ……………………………………………….. 7
8. Demonstration of how snort IDS works ………………………………………………………. 9
9. Conclusion ……………………………………………………………………………………. 11
10. Reference ……………………………………………………………………………………. 12
Page 1

Introduction
Nowadays, individuals spend much time on the Internet. This virtual world to a great extent mirrors
the genuine one: there is wrongdoing, which tragically is a necessary piece of society. The
developing trade of data and electronic installments - this is actually the goody that draws in
lawbreakers. The purpose of the current day cybercrime is to extort money from organizations.
They are well structured and planned by the hackers. Productivity, chance administration,
improvement of new markets are likewise its significant parts. Casualties of cybercriminals, are
private clients, undertakings and associations everything being equal. Monetary harm from such
vindictive acts could reach $9 trillion by 2021. Among different dangers, late attacks have prompted
the conclusion of independent ventures, delays in performing indispensable careful tasks and
disturbances in the arrangement of open administrations.
DOS Attack scenario.
The Armada Collective group was first observed in 2015. They attacked different money related
administrations and web facilitating destinations in Russia, Switzerland, Greece, and Thailand.
They again re-developed in Central Europe in October 2017. They used to do a demo-DDoS assault
to compromise the person in question.
Here is a coercion letter from Armada Collective:
Page 2

This group is known to bring out intelligent DoS attacks through NTP. The NTP convention is a
convention that is utilized to synchronize PC check times in a convention. The NTP convention
gives help in decision making in the network. At the point when an overseer sends the monlist order
to a NTP server, the server reacts with a rundown of 600 hosts that are associated with that NTP
server.
The attacker can misuse this by making a fashioned NTP parcel which has a monlist order
containing the IP address of the person in question and after that sending various duplicates to the
NTP server. The NTP server send reaction to more that 600 PCs connected to the server upon
receiving instruction from the unkown address. Accordingly the injured individual gets an excessive
amount of information from the NTP reaction and it can crash:
Assumptions.
• Ttunneling engineering: the association straightforwardly develops an entry over the interPLMN
spine direct towards a Packet Data Gateway in the HPLMN
• Tunnel establishment is free of the basic WLAN Access Authentication and Authorisation.
Page 3

• After entry establishment, channels can be given to the VPLMN which grant portrayal of traffic-
related with a lone section in the VPLMN
Solution to address cyber security attack.
Real time intelligence is an amazing asset for avoiding and containing cyber attacks. The more it
takes to recognize a hack, the more exorbitant it results. A research carried out by Ponemon
Institute stated that the IT team should notice cyber attack in there systems within the first 15
minutes. With only 120 seconds' notice of a trade off, coming about expenses could be decreased
by 30%.
As indicated by James Hatch, chief of digital administrations at BAE Systems, "Recognizing [a
cyber attack] early is critical. It could be the contrast between losing 10% of your [computers] and
half." Unfortunately, as a general rule, overall it takes organizations over seven months to find a
pernicious attack.
With laws expecting organizations to uncover cyber attacks and the dimension at which these
attacks happen, it is never again less expensive to fix the attack than it is to proactively stop them.
Organizations need to alleviate these dangers or risk harming their notorieties to the point that
clients never again trust them with their business. Many organizations do not know were to start
protecting their systems against cyber attack. Some of the steps that an organisation should take
include;
 Keeping systems upto date by applying the most recent patches to PCs, servers, and
equipment. These patches frequently contain basic security refreshes that plug known
vulnerabilities.

Page 4
 Setting up a procedure for the reinforcement and recuperation of fundamental information.
With this set up, a business can recoup from ransomware dangers and obliteration brought
about by insider dangers without costly cleanup costs.
 Character and access the executives arrangements that limit clients from getting to
information that they don't have to see. IAM study prefers that most of the clients should be
working on offline mode so that in case of cyber attack, it can’t affect the whole system.
 Appropriately arranged security controls that alert you to potential assaults and help frustrate
them. These incorporate firewalls, hostile to malware applications, interruption discovery
and anticipation arrangements, and email security arrangements.
 Having multiple cyber security team in an organization. By not depending on a solitary
seller, you can work with items and arrangements that attention on explicit requirements
from specialists instead of a merchant that is a handyman yet ace of none.
Information gathered from snort IDS.
 Host impedance region structures keep running on all PCs or contraptions in the system with
direct access to both the web and the endeavor internal system. HIDS have extraordinary
position over NIDS in that they may more then likely recognize odd structure bundles that
begin from inside the alliance or poisonous traffic that a NIDS has neglect to see. HIDS may
additionally have the choice to see destructive traffic that begins from the host itself, as
when the host has been sullied with malware and is endeavoring to spread to different
frameworks.
 SIDS gathers information packet on the network and compares it with the database data.

Page 5
 Host-based Intrusion Detection System that are introduced as operators on a host. This
framework can investigate framework and application log documents to recognize any
interloper action
Configuring snort IDS
Types of IDS
NIDS
NIDS represent Network Intrusion Detection System. The snort IDS gathers all the packets passing
through the network and compares with the ones stored in the database. In case a packet coming
from outside matches the one in the database then alarm will be raised on the system.Grunt is an
astounding case of a NIDS.
HIDS
HIDS represents Host Intrusion Detection System which, clearly, goes about as a host. Such sorts of
IDS screen framework and application logs to identify interloper movement. A few IDS responds
when some vindictive movement happens, others screen every one of the deals going to the host
where IDS is introduced and give cautions continuously.
Introduction to snort
Snort is a Network Intrusion Detection System (NIDS). It's very prevalent and is open source which
which helps in screen organize traffic progressively, thus it can likewise be considered as a parcel
sniffer. Basically snort IDS analyses all the data packets passing through the network to ensure that
there is no malware or payload. It can also be used for investigating and and searching if there are
any malware in the system . It is fit for distinguishing different assaults like port sweeps, cradle
flood, and so forth. It's accessible for all stages for example Windows, Linux, and so forth. It
doesn't require any recompilation with the framework or equipment to added to your conveyance;

Page 6
root benefits are required however. It reviews all the system traffic against the gave set of
guidelines and
after that alarms the organization about any suspicious action. it's isolated into numerous parts and
every one of the segments cooperate to identify an interruption. Following are the significant parts
of snort :
 Parcel Decoder
 Pre-processors
 Location Engine
 Logging and Alerting System
 Yield Modules
Configuring snort IDS
Type the command below to add the the group and add user to the group
Type the command below to check on the libraries of snort IDS
Create a symbolic with the command below

Page7
After that, execute the command below
To add snort IDS registries enter the commands below
For displaying IP lists type the commands below
To create login directories type the below command
To adjust permissions enter the commands below

Page 8
To open the configuration files enter the commands below
Implementation of snort IDS configuration
You define IP address that we will use in configuring our snort IDS

Page 9
We then run the command below
d – instructs the snort to display the data.
L – identifies the log directories
h – shows the network to the monitor
A- instructs the snort to display

We include rules as shown below
Page 10
After that run snort again with the command below

Conclusion
With laws expecting organizations to uncover cyber attacks and the dimension at which these
attacks happen, it is never again less expensive to fix the attack than it is to proactively stop them.
Organizations need to alleviate these dangers or risk harming their notorieties to the point that
clients never again trust them with their business. Many organizations do not know were to start
protecting their systems against cyber attack.
Page 11
Reference
Yuan, Y., Yuan, H., Guo, L., Yang, H., & Sun, S. (2016). Resilient control of networked control
system under

DoS attacks: A unified game approach. IEEE Transactions on Industrial
Informatics, 12(5), 1786-
1794.
Peng, C., Li, J., & Fei, M. (2017). Resilient Event-Triggering $ H_ {\infty} $ Load Frequency
Control for Multi-
Area Power Systems With Energy-Limited DoS Attacks. IEEE Transactions on Power
Systems, 32(5), 4110-4118.
Ding, K., Li, Y., Quevedo, D. E., Dey, S., & Shi, L. (2017). A multi-channel transmission schedule
for remote
state estimation under DoS attacks. Automatic, 78, 194-201.
Dridi, L., & Zhani, M. F. (2016, October). SDN-guard: DoS attacks mitigation in SDN networks.
In 2016 5th
IEEE International Conference on Cloud Networking (Cloudnet) (pp. 212-217). IEEE.
Wu, Z., Zhang, L., & Yue, M. (2016). Low-rate DoS attacks detection based on network
multifractal. IEEE
Transactions on Dependable and Secure Computing, 13(5), 559-567.
Wei, L., & Fung, C. (2015, June). FlowRanger: A request prioritizing algorithm for controller DoS
attacks in
5254-5259). IEEE.
Page 12
Gope, P., Lee, J., & Quek, T. Q. (2016). The resilience of DoS attacks in designing anonymous user
authentication protocol for wireless sensor networks. IEEE Sensors Journal, 17(2), 498-
503.

Chen, B., Ho, D. W., Zhang, W. A., & Yu, L. (2017). Distributed dimensionality reduction fusion
estimation
cyber-physical systems under DoS attacks. IEEE Transactions on Systems, Man, and
Cybernetics:
Systems, (99), 1-14.
Cheng, Z., Yue, D., Hu, S., & Chen, L. (2019, April). Event-based resilient H∞ fuzzy filter design
under DoS
attacks. In 2018 5th IEEE International Conference on Cloud Computing and Intelligence
Systems
(CCIS) (pp. 198-202). IEEE.
Chelladhurai, J., Chelliah, P. R., & Kumar, S. A. (2016, June). Securing docker containers from
denial
of service (dos) attacks. In 2016 IEEE International Conference on Services Computing
(SCC) (pp.
856-859). IEEE.