DoS Attack: A Novel Approach to Mitigate

Denial of service attack is one of the major problems faced by the internet today. According to the existing internet architecture, any host can disrupt legitimate traffic by flooding a link between any other hosts. When the traffic send through a link becomes more than the bandwidth of the link, then the router will drop the excess traffic it receives, as the forward link is filled with traffic. As a result, the legitimate traffic may be dropped and in turn the valid user will not be able to access the server and make avail its service. This paper explains the mechanism which is used to mitigate the flooding attacks in the internet. The sender before sending data to the receiver has to obtain the permission to send, from the receiver. This permission is called as capability. Once the permission is obtained, the sender attaches the capability to the data it sends. The routers will check the validity of the capability and the amount of data allowed in a particular time, which will be mentioned in the capability. The routers will process the packet and the check whether the packets are valid or not according to the information available in capability. If the packets are valid the router will forward otherwise will discard the packet. We introduce this mechanism in inter ISP, with one ISP acting as centralized control. When a router in an ISP detects an attack, it will send alert message to the centralized ISP. When the centralized ISP receives the same alert message from different ISP, it will conclude that distributed denial of service attack has occurred. The centralize ISP, then send control messages to other ISPs about the attack and the victim and also inform to reduce the data rate to that victim. Thus, this method will provide a better way to limit denial of service attack and thereby also limit distributed denial of service attack.