Entropy Based Deep Attention Mechanism (EDAM) To Mitigate Denial of Service (Dos) Attack Orchestrated Through Idempotent Operation

Abstract

Measuring entropy in a system represents  the degree of uncertainty that characterizes the smooth, free  and fair conduct of the network operations. The change in  quantum of entropy value raises an alarm of the  unscrupulous behavior in the vicinity of the network. The  continuous inspection of network characteristics and  internet flow profiling maintains a constant vigil of the  state, behavior and actions performed by the participating  hosts in the network. The traffic flow from the multiple  senders to either same/different receiver evinces a  significant entropy escalation trend as the network  composition at any timestamp is a rightful mixture of  quality transmission attributes like source IP address,  destination IP address, Sequence no. This suffers a setback  when the senders camouflaging as legitimate ones tries to  fool the network administrators of the impending threat viz.  DoS (Denial of Service) attack that the adversary may wish  to coordinate via an idempotent HTTP Get Request  operation. A request method is considered idempotent if the  intended effect on the destination server with multiple  identical requests is the same as the effect for a single such  request. It produces the same result when executed over and  over again. This ambiguous request operation directed from  multiple/single sender to the intended receiver generates a  broadcast storm that dampens the network services to the  core. The ability of the idempotent nature is to generate as  many genuine requests as possible and swamp the receiver  with HTTP Get request packets. The receiver believes that  the same host connection metric per flow count is generated  by multiple senders but the reality is reverse. The proposed  solution to this problem is to aggregate and maintain a time  stamp based and granular based flow attributes reserved for  future entropy synchronization at several intermediate  routers which will serve as evaluation checkpoints for the  receiver. This Entropy based Deep Attention Mechanism  (EDAM) coupled with DES (Deferred Entropy  Synchronization) acts as a determinant for receiver to  perform multi-level cross verification at different time  instants and perform deferred synchronization with the  reserved values. The performance of this deep attention based entropy synchronization approach witness a deep  spike in prediction accuracy and this is plotted with no. of  idempotent attackers in the x axis and the improved  accuracy in Y axis.