DDoS Attack Defense against Source IP Address Spoofing Attacks

Distributed Denial of Service (DDoS) attacks is the most challenging problems for network security. The attacker uses large number of compromised hosts to launch attack on victim. Various DDoS defense mechanisms aim at detecting and preventing the attack traffic. Source IP address spoofing is one of the most common ways of launching Distributed Denial of Service attacks. In these types of attacks, attack packet’s true origin is difficult to identify. Thus, it is very challenging to detect attack packets and handle defense mechanisms against such attacks. In this paper, defense mechanism uses cryptographic technique for identifying attack packets with source IP address spoofing and dropping those attack packets. This mechanism does not require restrictions or changes to internet routing protocols and is easy to deploy. The algorithm is efficient in identifying spoof attack packets and its effectiveness is evaluated by simulation experiments in NS3.