A Comprehensive Study On Intrusion And Extrusion Phenomena

(IJACSA) International Journal of Advanced Computer Science and Applications,Vol. 12, No. 8, 2021A. TCP-ACK Storm AttackThis particular attack occurs over TLS/SSL connectionsalong with TCP connections that remain unprotected. However,system having IPsec or link-layer encrypted connections isprotective against this attack [20].It is launched by a man in the middle attacker who onlyeavesdrops when needed and creates malicious packets. Theoretically, this attack[21] might spread in a limitless manner. The worst case can be N-packets of ACK-storm DoS attackmay consume the overall bandwidth of a network. When areceiver receives an unacceptable packet from the attacker, thehost acknowledges the packet and sends the expected sequencenumber to the attacker by using its own sequence number.In most cases, an attacker receives a packet with receiver’ssequence number larger than the one sent by a receiving clientwith the standard TCP connection. Even though, this packetis unacceptable, it generates an acknowledgment packet. Thisgenerated packet eventually generates other acknowledgmentpackets causing unlimited loops for each data packet. Whenever the ACK packet [22] is lost, it will not be retransmittedsince it contains no meaningful data. ACK storm is less if thenetwork drops more packets.3)host B. Packet must have at least one byte of data.Packet must be inside the TCP connection.Finally, hacker manages to send packets form HostA to Host B maintaining the time frame. As theattackers gets reply, it will continue in a loop of backand forth of packets.The basic one packet TCP-ACK storm attack [24] canbe further amplified to the Two-packets Ack-Storm attack,exhausting bandwidth and lengthening the session duration.This attack causes disruption of the regular web activities bysending huge traffic.Some existing solutions related to this attack are shown inTable I.B. Fraggle AttackThe Mitnick case (1994): A disguised attacker verilyhacked the computers in the San Diego Supercomputer Center.This was happened to be the most secure computer system inUS [23]. The financial services industry also experienced sametype of attack. In March 2019, the attack was so sophisticatedwhich was not previously seen before. Though it has an easyfix by tuning TCP or using a packet-filtering firewall system.Fig. 4. An Example of Fraggle Attack.Fig. 4, attacker is attacking the computers using BOT PCA to generate UDP flood to PC X, Y and Z. This UDP floodis then propagated to the nodes downward. Note that, port 7is open for all computers and it supports character generationsystem. Eventually, the traffic will overwhelm the target PC Tand block its normal functioning, resulting in fraggle attack.Fig. 3. TCP-ACK Storm: Attacker Changes One Network Packet withMalicious Packet.Fig. 3 depicts the procedure of TCP-ACK storm with onepacket that consists of three processes:1)2)Attacker picks up a packet from connected networkamong host A and host B as there is an open portexist in the router.Then, attacker generates one packet which will address to host A and sends with host A’s address toThe Fraggle attack is a type of amplification attack whereUDP packets are dispatched to ports 7 and 19 depending onwhich one is open. Also, character generation service may runwhich is eligible for character generation. This intrusion maycause havoc to the system with the help of the insiders asthey unintentionally help the hackers to flood UDP packets.As this attack is not new, all operating systems are protectedfrom such attack. Therefore, no new such attacks[28] havebeen found nowadays, although in the late 90s, the attack wasvery acute.A successful attempt of Fraggle attack may hang anysystem servers for an indefinite period of time (e.g., hours,days or even months). To Identify Fraggle attack, three typesof techniques are introduced: traffic degree monitoring, sourceIP address monitoring, and packet attributes analysis. When theattack is detected, some countermeasures might be taken suchas filtration [29], congestion control [30], Submissive traceback [31], Reproduction [32], etc.www.ijacsa.thesai.org878 P a g e

(IJACSA) International Journal of Advanced Computer Science and Applications,Vol. 12, No. 8, 2021TABLE I. S TATE - OF - THE - ART S OLUTIONS OF TCP-ACK S dto allplatformRaz et al2011[25]Modifyingthe TCP73Generated everlastingTCP amplificationonly1%packet lossYesYesNeminathet al 2018[22]Statetransitionmodel37Real experiment of attack and detection intest bed setupClose100%YesYesDuc et al2019 [26]Hypervisoratclosestate37Defining the packetsize every-time is hardfor the systemTakes60secdetectNoNoTopalovaet al 2019[27]MLPNNstructure3Hassle-somefor the networkarchitecture.Snatches TCP’scapability to resynchronisingthe sequencenumbersAnalyzedTCPACKStormDoSattack againstvirtual networksystemsIt doesn’t havepreventionmethodAnalysis of automatedsystem based on Multilayer neural networkApproximatelyYes75%Yes7totomanipulating the router. Hence, the files finds the new pathand goes to the attacker’s PC considering it as the destination.In what follows, the Table II enlists some existing solutions tothis attacks.C. An ICMP Redirect Message AttackD. Internet Protocol (IP) Fragmentation AttackIP fragmentation attack exploits the IP fragmentationmechanism as an attack vector [40] [41].Black nurse attack is one of the most common organizational names of IP fragmentation attack. Basically, it is basedon sending crafted IP fragments in order to eliminate firewallservices [42].This process may occur in two ways as described in thefollowing:Fig. 5. ICMP Redirect Message Attack: Attackers Manipulating ICMPMessages between Server and Client’s PC.ICMP redirect message sends out of bound message thatpasses the information to a host regarding the existence ofmore optimal routes through the server network. But thissystem is effectively misused by the attacker to redirect thetraffic or information to his own system. In this attack, thehacker poisons the router by sending ICMP redirect messageto the targeted host, so that all traffic uses optimal way forthe destination. These attacks mostly happen on the port ornetwork layer. These attacks can also cause problems if thereexists firewall and non-deterministic traffic [33]. ZimperiumMobile Security Labs have researched last year attack named“DoubleDirect” which can be generated through ICMP redirectmassage attack. It enables the attacker to redirect target’s traffic[34] to attacker’s PC. Once the process is done, attacker maysteal or inject payload to the victim’s PC. Machine learningapproach generates the best detection rate till now.In Fig. 5, host A is the source and host B is the destination.The files are supposed to transfer from source to destinationthrough router. But the attacker redirects the messages by1)2)UDP and ICMP fragmentation attacks: This attack[43] exploits the transmission of malicious UDP orICMP packets exceeding the maximum transmissionunit. The inability of reassembling these packetscauses high resource consumption resulting in thevictim server issues.TCP fragmentation attacks: This attack, also regardedTeardrop attack, inhibits reassembly procedure of theTCP/IP for the fragmented data packets resulting indata packets overlap. Consequently, the server getsswamped [44].Improving packet loss and 95% accuracy rate makes sparselytagged fragmentation marking a best solution for this attack.Table III presents existing solutions related to this attack.E. Perpetual Echo AttackPerpetual echo attack [51], a fraudulent activity, takes placeat port 7. Source port and the destination port perpetuallyecho each other when the connection is established . UDPrequests are sent to a malicious IP address for all victims to getback their responses. The malicious source address is not thewww.ijacsa.thesai.org879 P a g e

(IJACSA) International Journal of Advanced Computer Science and Applications,Vol. 12, No. 8, 2021TABLE II. S TATE - OF - THE -A RT S OLUTIONS OF AN ICMP R EDIRECT M ESSAGE iedto allplatformPrerna etal.2015[35]Centralizedsystem73If Central server isunable to find correct match, it needsto send broadcastrequest. Time complexity increasescomplexityO(logN)YesYesJaspreet astproxyservice37Low accuracy rateAnalyzeICMPandVotingwithBackwardCompatibility, LessCost,MinimalTraffic and EasilydeployedApplication of machine learning tools93% ofprotocolAR-matchtechnique73complexityand convergence timecantakeupto 200massagesNotmentionedYesAhmed etal.2018[37]Viegasetal.2019[38]YesYes butsomemodificationrequired.YesBigFlow37No solution forDNS amplificationoriginated from anexternal networktowards a hostinside a LANWeak hash functionalgorithm for highsecurity purposeOnly Worked onlimited bandwidthYesYesJonas et al.2019[39]Open l et al.2018 [33]There is no ratelimiting of the Virtual machine whensending to muchtraffic into the networksolving High complexity using Armatch techniqueAnalyze the behavior of several traditional ML classifiersimprovement of security of libvirt virtual machines connect via an OpenvSwitchattacker’s correct address. Hence, the hacker remains disguisedand the targeted user becomes the victim of large traffic.This may lead to DoS attacks [52] on the UDP ports. SomeUDP applications unconditionally respond to every datagramreceived. If a datagram is inserted into the network with oneof these applications as the destination and another of theseapplications spoofed as the source, the two applications willrespond to each other continually. Each inserted datagram willresult in another perpetual echo conversation between them. Inthe worst case, attacker’s attempt is to hide attacks or renderthem and become untraceable. Ant colony optimization hasmore efficiency to generate true alarm rate while detecting theattackIn Fig. 6, attacker uses another PC’s IP address to remainhidden and sends UDP flood through port 7 of the router tothe target PC to establish connection. If one connection isestablished, the affected PC will be working as BOT that sendsUDP flood to other PC. Table IV presents existing solutionsto this attack.F. Internet Control Message Protocol (ICMP) Tunneling AttackICMP tunnel is created where the information flow maynot be regulated by security technique. ICMP is used as anattack vector shield of IP-Sec gateway [55]. In the worst case,Fig. 6. Echo on user Datagram Protocol (UDP) Ports: Source Port PerpetualsEcho to All Target Ports Modified by Attacker.attackers are able to disturb the network design architectureby doing malicious activity. An ICMP tunneling attack makesconnection between the hosts, and ruins the firewall service ina way that it fails to alarm if any data sent via ICMP. It isa covert connection [56] between hosts using ICMP messageswww.ijacsa.thesai.org880 P a g e

(IJACSA) International Journal of Advanced Computer Science and Applications,Vol. 12, No. 8, 2021TABLE III. S TATE - OF - THE -A RT S OLUTIONS OF I NTERNET P ROTOCOL (IP) F RAGMENTATION iedto allplatformBernsteinet al elyTaggedFragmentationMarkingapproach73It is not a benchmark frameworkStrongdefensesagainstsoftwareside-channel attackDrasticallyreducingthe numberof branchesYesNo33ImprovestheProbabilisticpacket marketingby reducing thenumber of packets95% accuracyYesYesSecuPANproposedtoolIntegratedIP pecrules33Authenticationof the markingatvictimisneeded to preventcompromiserouters to spoof themarkingMitigates the attackverify authenticityand integrityCompletiontime 35msYesNo33Filtering rate is not100 percent accurateMaximizestheSDNcontrolpatternTransfertime 8sYesYes37It can not be usedas the only way ofdefenseSpecify rules ontraffic and it’s limitationsYesNoNewmechanismagainstattacks37Can not block allkinds of packetsIt can evade theOpenFlow firewalleffectivenessishigher thanImpactNotmentionedYesNoHasmukhet al 2018[46]Mahmudetal.2018[47]Chaoqin etal.2018[48]Bakker etal 2019[49]Al-Ani et al2019[50]TABLE IV. S TATE - OF - THE -A RT S OLUTIONS OF P ERPETUAL E CHO iedto allplatformGupta et al2014[53]Ant ationYesPrey Predator (PP) approach37betterdetectionrates andreducedfalse alarmratesNotmentionedYesOkeke et al2016[54]The performanceofthemodelconsiderably varieson a larger andmorecongestednetworkMany issues likemanifestingandbufferoverflowexistsNoNoand reply packets. It can be done by changing the payload dataso that it contains the attacker’s data. So, if anyone uses ICMPmessages, he may easily inject malicious data to be destinedto the targeted PC. The targeted PC also replies into anotherICMP message and returns it back.In Fig. 7, host A is using an original server through a proxyserver. Proxy server may be easily manipulated or authorizedby the attacker without the knowledge of the firewall. ICMPmessages are used as the payload in this figure. Thus, the information is routed through the attacker’s PC without anyone’sinterference or knowledge.Described the application of PreyPredator approachG. Smurf AttackSmurf attack mostly resembles to ping flood attack due totheir similar nature of sending ICMP echo request packets.It, being an amplification attack vector [57], accelerates itsdamage potential through utilizing broadcast network characteristics. It is different than ping flood.1990 is the year when first smurf attack [58] happened inUniversity of Minnesota. It has effected more than 1 hour andchaining throughout the state. It has completely shut downmany computers and servers. As a result, we face loss ofwww.ijacsa.thesai.org881 P a g e

(IJACSA) International Journal of Advanced Computer Science and Applications,Vol. 12, No. 8, 2021Fig. 8. Router Attack: Attacker Changed the Established Protocol with theModified Protocol to Ensure Vulnerabilities in Network.Fig. 7. ICMP Tunneling: Attackers Manipulating ICMP Payload to the HostA and Receiving Desired Packets.data and slowdowns. We need to IP broad casting to eliminateSmurf attack.Following describes the procedure of Smurf attack.1)2)The malware generates a network packet attached toa fake IP address. There is a ping message insidethe packet. Upon receiving these spoofed packets, thenodes echo back causing a loop eventually leading toa complete denial of service.An insider may directly inject smurf Trojan or it maybe accidentally downloaded from forged e-mail orweb site. Typically it will remain as it is until activated by the attacker. Consequently, a good numberof Smurfs are integrated with rootkits, allows hackersto create backdoor for system access.Table V shows state-of-the-art solutions of smurf attack.H. Router AttackRouter attacks mainly exploit the vulnerabilities in thenetworking protocols that lead to inconsistency in softwareand weak authentication [61]. It normally occurs in the networklayer. Attacks [62][63], that can be a part or origin from routerattacks, are mainly brute force and denial of service attacks.When it occurs, it impacts network services and businessoperations.2018’s report from eSentire shows 539% of increase inrouter attackers since 2017. ACI (American consumer institute)also found 84% WiFi routers [64] are under risk of cyberattacks or malicious activity. As, people are not aware ofsecurity vulnerabilities properly, hackers takes the chance.Black hole routers can detect most types of the router attackand can be modified if the attacker’s way changes with time.In Fig. 8, attacker modified the valid protocol to makenew protocol which is malicious and may cause havoc to thesystem. Some attacks that might disrupt the performance ofthe router is discussed in the following.1) Brute Force: Brute force attack is a method where trialand error process is used to get data such as user’s passwordor pin details. In this attack, an automated software generates alarge number of close to accurate guesses as to get the desiredvalue. It may be used by the attacker to crack the encrypteddata. It may also be used to test the security system of anyorganization.2) Packet Mistreating Attack: Router attacks may lead topacket mistreating, mostly like DoS attacks. These packetsget mistreated by injecting malicious packets to confuse andoverwhelm the system.3) Routing Table Poisoning: A routing table in a routeris not immune to protection and encryption vulnerabilities.Routing table may poison the whole routing routine. Theseattacks are achieved by manipulating the packet informationthat are routed through the router.4) Hit and Run Attacks: This attack is also known as testhacks, and occurs when malicious data is injected into a router.However, the injection process may or may not be successful.The main aim of the is to disturb the environment of a system.5) Persistent Attacks on Routers: Persistent attack is somewhat similar to hit and run, but in this attack, the injectionprocess becomes successful and the attacker may gain controlover the system. After injecting, it will continue it’s intendedwork. The attacker will continue to add malicious packets andconfuse the routing table thereafter.Table VI depicts some existing solutions related to routerattack.I. Slow and Fast Port Scans AttackPort scanning [67] is one of the dangerous network intrusions for getting exploitable communication channel betweenthe attacker and the target. Attacker uses attack to discoverservice to get into the network. It consists of probing a hostin a network for open host. It not only scans but also gathersinformation that attempts to profile the services running on apotential target. Port scan attack on 4G router of HUAWEIcompany [68], detected last year, is one of the recent portscan attack complained by the consumers. Artificial immunesystems and fuzzy logic provide more accuracy and also havea robust model compared to other models.In Fig. 9, attacker uses two scanners to send maliciousrequests disguised as service messages for scanning systemwww.ijacsa.thesai.org882 P a g e

(IJACSA) International Journal of Advanced Computer Science and Applications,Vol. 12, No. 8, 2021TABLE V. S TATE - OF - THE -A RT S OLUTIONS OF S MURF iedto allplatformJayashreeet al 2018[59]Myo et al2019 [57]PatternMatchingTechniquesSDN basedtechnique37Pattern matching technique for WSNNo7YesNoTrung et 7packet delivery ratio1.3averageaccuracy is0.97responsetime 60msto 120 msYes3Accuracyis less thandesiredReal time results are missing.Lackofenhancementin the packetprocessYesNoSDN and DDoS attackis discussedDescribed IP model forIP filteringTABLE VI. S TATE - OF - THE -A RT S OLUTIONS OF ROUTER iedto allplatformRyoki et al2016[65]An 33Described countermeasures of IFANot mentionedNoNo37Structureandprocess of routershadowminimumlatencyandintended loadreduceNoYesHT-basedthreatmodel,known asBlack HoleRouter(BHR)33Therouterdoes not recordinformation forfurther useThe connectionbetween creased thewaiting timeReal life experiment of black er,andperformanceYesYesYufeng etal 2018[21]Dauod et al2019[66]Fig. 9. Scan Attacks: Attackers use BOT Scanners to Scan Data fromSystem’s Machine.2)devices. These scanners scan the system PC and machine andsend results to the attacker.These attacks are of two types

The rest of the of paper is organized as follows. Section 2 outlines the taxonomy of intrusion and extrusion events. The intrusion events are described in details in Section 3. Section 4 continues with the detailed description on extrusion events. We present a big picture in tabular form summarizing all the intrusion and extrusion events in .