Detecting Malicious Packet LossesAbstract:- In this paper, we consider the problem of detecting whether a compromised router is maliciously manipulat

Abstract:-

In this paper, we consider the problem of detecting whether a compromised router is maliciously manipulating its stream of packets. In particular, we are concerned with a simple yet effective attack in which a router selectively drops packets destined for some victim. Unfortunately, it is quite challenging to attribute a missing packet to a malicious action because normal network congestion can produce the same effect. Modern networks routinely drop packets when the load temporarily exceeds their buffering capacities. Previous detection protocols have tried to address this problem with a user-defined threshold: too many dropped packets imply malicious intent. However, this heuristic is fundamentally unsound; setting this threshold is, at best, an art and will certainly create unnecessary false positives or mask highly focused attacks. We have designed, developed, and implemented a compromised router detection protocol that dynamically infers, based on measured traffic rates and buffer sizes, the number of congestive packet losses that will occur. Once the ambiguity from congestion is removed, subsequent packet losses can be attributed to malicious actions. We have tested our protocol in Emulab and have studied its effectiveness in differentiating attacks from legitimate network behavior.




Existing System:-
• Here we are using user defined (static) threshold to identify the packet loss.
• It is difficult to analyse or distinguish the packet loss weather router dropping packet maliciously or router dropping the packet due to the congestion.
Proposed System:-

• Router detection protocol _ that dynamically infers, based on measured traffic rates and buffer sizes, the number of congestive packet losses that will occur.


• This technique allows us to identify the fine grained attacks such as stopping a host from opening a connection by discarding the SYN packet,can be detected.

Hardware Interface

• Hard disk : 40 GB
• RAM : 512 MB
• Processor Speed : 3.00GHz
• Processor : Pentium IV Processor

Software Interface

• JDK 1.5.
• Swing Builder.