Abstract

Network security is a big topic and is growing into a high profile in the field of Information Technology, due to its vast growth they are prone to various security concerns. In order to control these security concerns and prevent them this system is proposed. The security breaches of network include Denial of Service attacks. Botnets and SYN flooding attack are two Denial of Service attacks. SYN flood occurs when attackers make half-open connections by not responding to the SYN+ACK packet from server. When the server’s SYN buffer is full with these half-open TCP connections, it stops accepting SYN packets, thus resulting in denial of service to legitimate clients. Bots are the malicious scripts that perform automated tasks at a much higher rate than would be possible for a human alone. The SYN flooding and Botnets are detected and addressed before they become an issue and bring down the network service. SYN flooding attack is detected by considering the rate at which the SYN packets are sent, the server will then reject all these suspicious TCP connections, with TCP-RST packets to prevent the potential DOS attack. Later all the connections in the SYN-RECV state will be closed forcibly by the server with the RST packets. Bots usually perform actions faster than humans hence the best way to detect them is by analyzing its behavior. Hence the action time and action frequency considering the number of clicks and the rate at which the form is submitted are determined. The activities which generate abnormal network traffic are detected and the attacker IP is obtained, then the log of these attackers IP are stored in the database so that no further bot activities takes place from the infected client machine.

Authors and Affiliations