# data[].attributes.attachment_link.readable_text
Occasionally referred to as a "zombie army," a botnet is a group of hijacked Internet-connected devices, each injected with malware used to control it from a remote location without the knowledge of the device's rightful owner. From the point of view of hackers, these botnet devices are computing resources that can be used for any type of malicious purposes-most commonly for spam or DDoS attacks.

An individual botnet device can be simultaneously compromised by several perpetrators, each using it for a different type of attack and often at the same time. For instance, a malware-infected personal computer could be ordered to rapidly access a website as part of a larger DDoS attack. At the same time it could also be performing vulnerability scans, with its owner browsing the web-unaware of both occurrences.

"We have a Botnet army ready to take down your site. You have 48 hours to pay us 1200$. Merry Xmas!"
DDoS ransom note

What is a DDoS Attack?

DDoS is an acronym for distributed denial of service. A DDoS attack is a malicious attempt to make a server or a network resource unavailable to users. It is achieved by saturating a service, which results in its temporary suspension or interruption.

A Denial of Service (DoS) attack involves a single machine used to either target a software vulnerability or flood a targeted resource with packets, requests or queries. A DDoS attack, however, uses multiple connected devices-often executed by botnets or, on occasion, by individuals who have coordinated their activity.

DDoS attacks can be divided into two general categories:

1. Application layer DDoS attack types include HTTP floods, slow attacks ( Slowloris, RUDY), zero-day assaults, and those targeting vulnerabilities in operation systems, web applications and communication protocols.

Comprised of seemingly legitimate and innocent requests, their magnitude usually being measured in requests per second (RPS), the goal of the attacks is to overwhelm a target application with requests. This causes high CPU and memory usage that eventually hangs or crashes the application.

2. Network layer DDoS attack types include UDP floods, SYN floods, NTP amplification, DNS amplification, SSDP amplification, IP fragmentation and more.

These are high-capacity barrages, measured in gigabits per second (Gbps) or packets per second (PPS). They're almost always executed by botnets, with a goal of consuming the target's upstream bandwidth, resulting in network saturation.

It should be noted that DDoS attacks can also target supporting infrastructures and services-most commonly the target's DNS servers. These can be over-encumbered with a flood of fabricated DNS requests, originating from botnet devices.

DDoS Botnets and Botnet Tools

The originator of a botnet is commonly referred to as a "bot herder," or "botmaster." This individual controls the botnet remotely, often through intermediate machines known as the command and control (C&C, or C2) servers.

To communicate with a C&C server, the botmaster uses various hidden channels, including seemingly innocuous protocols like IRC and HTTP websites, as well as popular services like Twitter, Facebook and even Reddit.

Botnet servers are able to communicate and cooperate with other botnet servers, effectively creating a P2P network controlled by a single or multiple botmasters. This means that any given botnet DDoS attack may have multiple origins, or be controlled by multiple individuals-sometimes working in a coordinated manner, other times operating independently.

Botnets-for-hire are available from various sources, their services often being auctioned and traded among attackers. Online marketplaces have even sprung up-these are commercial entities trading in huge numbers of malware-infected PCs. They can be rented and used for DDoS or other attacks (e.g., brute force).

These platforms, often hiding behind the ambiguous service definition of stressers, or booters , sell DDoS-as-a-service. They provide their clients with a richly-featured toolkit, as well as a distribution network, so as to execute their attacks on call.

Typical DDoS stresser price list

Now armed with a rented botnet, DDoS attacks have become a viable (if criminal) and cost-effective option for anyone looking to take out a website or disturb communication of home and office networks. This results in a number of attack scenarios, ranging from shady businesses using DDoS to gain a competitive advantage to assaults in which DDoS becomes a tool of vandalism, revenge or simply a way to get some attention.

Full-service DDoS attacks are available for as little as $5 per hour, and the interested party can easily stretch their hour with a monthly plan that averages $38. Within the cybercrime ecosystem, botnet DDoS attacks are a mainstream commodity; prices continually drop, while efficacy and sophistication is constantly on the rise.

Known Botnets

Botnets are typically named after malware kits used in their creation. However, since botnet herders operate in anonymity, not all such kits are identifiable. Some of the most commonly used DDoS botnets are:
Nitol / IMDDOS / Avzhan / ChinaZ
This is an evolving DDoS botnet family that periodically morphs. It mostly operates in China. Once installed, its malware usually connects to the botnet's C&C server using a TCP socket and then sends performance information from the victim's machine.

Microsoft security researchers discovered in 2012 that Nitol-infected PCs were being sold in China on a mass scale; each device had a counterfeit Windows OS installed. Three years later, an Imperva report showed Nitol to be the most widely-spread botnet, infected machines accounting for 59.2 percent of all attacking botnet IPs.
MrBlack
Also known as Trojan.Linux.Spike.A, this malware targets the Linux platform, but is also available for various architectures and platforms (most commonly SOHO routers). It contacts a remote server, sending system information. Moreover, it receives control commands to perform different types of DDoS attacks against a given target, download a file and execute it, and then terminate a process.

In May 2015 a large-scale router-based, MrBlack botnet revealed itself, after taking part in mass-scale attacks against Imperva clients.
Cyclone
This is DDoS malware created in the U.S. It's IRC-based and its C&C details are obfuscated. It's known to kill off other bots on an infected host, in addition to stealing FTP credentials from Filezilla. Attacks include multiple HTTP floods, SlowLoris (though not slow), and ARME (Apache remote memory exhaustion).
Pushdo / Cutwail
Founded around 2007, Cutwail is a botnet mostly involved in sending spam e-mails. The bot is typically infects computers running Microsoft Windows by way of a Trojan component called Pushdo.

Early in 2010 the botnetʼs activities were slightly altered when it was used in DDoS attacks against 300 major sites-including the CIA, FBI, Twitter and PayPal.

A 2015 report showed the Pushdo botnet affecting computer users in over 50 different countries-mainly India, Indonesia, Turkey and Vietnam.

Mitigating Botnet DDoS Attacks with Imperva

To protect against all DDoS attack types and with no additional software nor hardware installation, in a matter of minutes websites can benefit from Imperva's comprehensive, cloud-based botnet DDoS protection service.

In the event of a network layer attack, Imperva provides dynamic resource overprovisioning-offering nearly limitless, on-call scalability. Additionally, Imperva's reverse proxy helps mask original service IPs-a first line of protection against direct-to-IP attacks.

In an event where target IPs are already known, and the masking effect is insufficient, Imperva can enforce routing policies using BGP announcements. These ensure that all incoming traffic travels through Imperva scrubbing centers first, where it undergoes deep packet inspection.

Only then is clean traffic permitted to reach the origin via a secure, two-way GRE tunnel.
Network Layer Attacks

Imperva mitigates a 250GBps DDoS attack-one of Internet's largest.

>> Learn more about Imperva's Infrastructure DDoS Protection

During the mitigation process, the Imperva security system continually documents attacking IP addresses and assault patterns.

In real-time this data is transmitted to Imperva's DDoS threat database, so as to benefit all of our service users. This further enables a rapid response to emerging threats while minimizing risks posed by botnet IPs (and IP ranges) that were readily identified in previous attacks against Imperva clients.

Having the ability to sort DDoS bots from regular human visitors, Imperva's proprietary security algorithms automatically detects any application layer offensive.

Here, bots are immediately identified using a combination of signature-based and behavior-based heuristics. Security challenges are employed behind the scenes to finalize the transparent profiling process.

As it is with network layer assaults, attacker information is added to Imperva's communal DDoS threat database. Each mitigated attack adds to our system's overall resilience, automatically improving it with each intrusion attempt.
Application Layer Attacks

Imperva mitigates a 268K RPS HTTP flood DDoS attack.

Webmasters can set Imperva as their authoritative domain name server, while DNS zone file management remains independent of the Imperva cloud network.

With this service in place, all inbound DNS queries first reach Imperva, where malicious requests are automatically filtered out. Only legitimate ones are allowed to pass through, enabling smooth traffic flow at all times.
Website DDoS Protection

Imperva mitigates a massive DNS flood, peaking at over 25 million packets per second

DNS-Targeted Attacks
>> Learn more about Imperva's Name Server DDoS Protection

# data[].attributes.attachment_link.title
What is a DDoS Botnet | Common Botnets and Botnet Tools | Incapsula

# data[].attributes.attachment_link.description
Occasionally referred to as a "zombie army," a botnet is a group of hijacked Internet-connected devices, each injected with malware used to control it from a remote location without the knowledge of the device's rightful owner.

# data[].attributes.attachment_link.readable_text
"Denial of service" or "DoS" describes the ultimate goal of a class of cyber attacks designed to render a service inaccessible. The DoS attacks that most people have heard about are those launched against high profile websites, since these are frequently reported by the media. However, attacks on any type of system, including industrial control systems which support critical processes, can result in a denial of service.

When a website suffers a DoS attack, the apparent effect will depend on your perspective. For the average user, it appears that the site has simply stopped displaying content. For businesses, it could mean that the online systems they depend upon have ceased to respond. The symptoms of a DoS attack against industrial control systems may include the inability to retrieve sensor data, or control critical processes.

DoS attacks can range in duration and may target more than one site or system at a time. An attack becomes a 'distributed denial of service', referred to as "DDoS", when it comes from multiple computers (or vectors) instead of just one. This is the most common form of DoS attack on websites.

A typical denial of service attack

DoS events are often brought about by a service's underlying systems being overloaded. We'll use a simple web-based example to clarify exactly how overload-based DoS attacks work, so let's imagine a shopping website you visit is under attack.

Ordinarily, when you visit an online shopping site, your requests pass through your Internet Service Provider's network, through one or more exchanges and out, onto other providers' networks. From there your clicks pass onto the hosting service used by the shopping site, and finally onto the site's own infrastructure.

Within the shopping site, a number of servers will each handle a small bit of the work needed to generate the page you see. This will include database servers that provide lists of products, application servers that interpret that product information and web servers that create the pages you are browsing.

However, much like a human, each server can only do so much work in a given period. So, when too many users are requesting pages from the shopping site at one time, the site's infrastructure or servers may not be able to handle everyone's requests in a timely manner.

Depending on how the shopping site is set up, this results in some or all users being unable to view the site. To put it another way, they are denied access to the service.

As the shopping site example suggests, a Denial of Service can be caused by perfectly legitimate use. For example, Black Friday sales, when thousands of users are clamouring for a bargain, often cause a denial of service. But they can also be malicious. In this case, an attacker purposefully tries to exhaust the site's resources, denying legitimate users access.

Malicious attacks can take one of two general forms: Denial of Service (DoS) or Distributed Denial of Service (DDoS).

The difference is:

A Denial of Service attack uses only a small number of attacking systems (possibly just one) to overload the target. This was the most common type of attack in the early days of the Internet, where services were relatively small in scale and security technology in its infancy. However, nowadays, a simple DoS attack is often simple to deflect as the attacker is easy to identify and block. One notable exception here may be industrial control systems, where equipment may have a low tolerance to bogus traffic, or may be connected via low bandwidth links that are easily saturated.

In a Distributed Denial of Service attack, the attacker enlists the help of (many) thousands of Internet users to each generate a small number of requests which, added together, overload the target. These participants may either be willing accomplices (such as attacks initiated by loosely organised illegal "hactivist" groups) or by unwitting victims whose machines have been infected with malware.

The key difference between legitimate denial of service (eg, Black Friday browsing) and an attack is that an attack generally happens with no warning. Therefore, the service cannot plan to handle the increased load.

Two types of overload-based denial of service attacks

The online shopping example above explores an attack that attempts to overload the available resources of a website in order to cause a DoS condition. These overload-based DoS attacks can target different types of resource. The majority fall into one of the following two categories:

Overload DoS attacks at the network layer: These DoS attacks typically attempt to consume all available capacity on network links, or to cause network hardware or software to fail due to overload.

Overload DoS attacks at the application layer: These DoS attacks typically attempt to consume the compute resources of the service by exercising compute-expensive functionality, or by generating many more application sessions than the service has been designed to cope with.

You can read more technical details about specific types of overload attacks and how you can reduce their impact in the Center for Internet Security's Guide to DDoS attacks.

Other forms of denial of service attack

DoS events can be caused by system overload, but there are other ways that an attacker may deny access to your service:

Destruction of physical equipment: An attack which causes physical damage through digital means. Saudi Aramco suffered an attack of this kind which disabled tens of thousands of user workstations. But probably the best known example is Stuxnet, where malware subtly change an industrial control process in order to destroy centrifuges.

Denying the ability to fix: An attacker may execute a denial of service attack and then purposfully disrupt your ability to resolve the issue. This may be through over-writing firmware, deleting accounts, or blocking administrative access. For example, an attacker may turn off remote process control equipment and then damage the firmware, or more subtly, update network routes in network infrastructure, to prevent administrators from being able to access equipment.

Theft of public identifiers: An attacker may hijack your domain name, Twitter account or other essential online accounts. If using cloud services, an attacker who is able to gain access to your account can disable your infrastructure whilst preventing you from gaining access to revert any changes.

RF interference: An attacker may use radio jamming to interfere with local WiFi or longer range wireless connections to remote sites (such as sensor installations). This type of attack carries significant risk on the attacker's part, due to their need to be physically close to the target location.

Understanding attacker motivation

Attackers may have a range of motivations when initiating a denial of service attack. These range from "fun" to extortion or even furthering state goals. Some objectives include:

Hackers may simply find it fun to bring down a service, often to show off their skills to other hackers gaining kudos. Attacks may be carried out using "off-the-shelf" tools or, if an attacker is skilled, bespoke attacks may be carried out to demonstrate new techniques or tools they have developed.

A group of 'hacktivists' will use their hacking skills for social or political goals, for example launching a DoS campaign against a company which carry out activities they do not agree with. The attackers are unlikely to be determined in this scenario and the attack likely to be short-lived. The attack is usually a oS attack on publicly facing websites, although some groups may attempt "web defacement" of poorly protected servers.

A desire to create bad publicity for an organisation with which the attacker has a grievance. The grievance may be ideological (such as animal testing or politics), or personal (disgruntled ex-staff, for example). Again, they are likely to be short-lived DoS style attacks, however a motivated attacker could persevere with the attack. You should work out the business impact of a loss of service for different periods of time.

Organised criminals may attempt to extort money based on either the threat of a denial of service or by a short attack to prove their capability. If the adversary is able to execute such an attack, it is likely to be longer in duration and severity. Some organised crime groups may move beyond simple DoS and look to gain unauthorised access to your system, either to increase the severity of the attack or execute the attack itself.

High capability attackers, possibly with state sponsorship or involvement are likely to attempt the most serious attacks. These may involve physical effects (such as the Ukrainian power grid failures) or be very long lasting, with a large amount of resource behind them. The objectives in this case can be diverse, but you should not presume that these attackers will only target governments. They may use denial of service attacks in order to undermine confidence in high profile services such as banking or critical infrastructure. They may also aim to undermine public confidence more generally, through attacks on household names such as retail outets, weather or broadcast services.

Also, be aware of high capability actors using a DoS attack to distract attention from an attempt to compromise your system. Do not become so focussed on defending against a DoS attack that you ignore other security monitoring.

# data[].attributes.attachment_link.title
Understanding denial of service (DoS) attacks

# data[].attributes.attachment_link.description
"Denial of service" or "DoS" describes the ultimate goal of a class of cyber attacks designed to render a service inaccessible. The DoS attacks that most people have heard about are those launched against high profile websites, since these are frequently reported by the media.

# data[].attributes.attachment_link.title
Famous DDoS attacks | Biggest DDoS attacks

# data[].attributes.attachment_link.description
A DDoS attack attempts to overwhelm a targeted server. Learn about some of the biggest DDoS attacks ever, along with famous DDoS attacks from the past.

# data[].attributes.attachment_link.readable_text
A "denial of service" or DoS attack is used to tie up a website's resources so that users who need to access the site cannot do so. Many major companies have been the focus of DoS attacks. Because a DoS attack can be easily engineered from nearly any location, finding those responsible can be extremely difficult.

A bit of history: The first DoS attack was done by 13-year-old David Dennis in 1974. Dennis wrote a program using the "external" or "ext" command that forced some computers at a nearby university research lab to power off.

DoS attacks have evolved into the more complex and sophisticated "distributed denial of service" (DDoS) attacks. The biggest attack ever recorded - at that time - targeted code-hosting-service GitHub in 2018. We'll discuss DDoS attacks in greater detail later in this article.

Attackers include hacktivists (hackers whose activity is aimed at promoting a social or political cause), profit-motivated cybercriminals, and nation states.

Denial of service attacks explained

DoS attacks generally take one of two forms. They either flood web services or crash them.

Flooding attacks

Flooding is the more common form DoS attack. It occurs when the attacked system is overwhelmed by large amounts of traffic that the server is unable to handle. The system eventually stops.

An ICMP flood - also known as a ping flood - is a type of DoS attack that sends spoofed packets of information that hit every computer in a targeted network, taking advantage of misconfigured network devices.

A SYN flood is a variation that exploits a vulnerability in the TCP connection sequence. This is often referred to as the three-way handshake connection with the host and the server. Here's how it works:

The targeted server receives a request to begin the handshake. But, in a SYN flood, the handshake is never completed. That leaves the connected port as occupied and unavailable to process further requests. Meanwhile, the cybercriminal continues to send more and more requests, overwhelming all open ports and shutting down the server.

Crash attacks

Crash attacks occur less often, when cybercriminals transmit bugs that exploit flaws in the targeted system. The result? The system crashes.

Crash attacks - and flooding attacks - prevent legitimate users from accessing online services such as websites, gaming sites, email, and bank accounts.

How a DoS attack works

Unlike a virus or malware, a DoS attack doesn't depend on a special program to run. Instead, it takes advantage of an inherent vulnerability in the way computer networks communicate.

Here's an example. Suppose you wish to visit an e-commerce site in order to shop for a gift. Your computer sends a small packet of information to the website. The packet works as a "hello" - basically, your computer says, "Hi, I'd like to visit you, please let me in."

When the server receives your computer's message, it sends a short one back, saying in a sense, "OK, are you real?" Your computer responds - "Yes!" - and communication is established.

The website's homepage then pops up on your screen, and you can explore the site. Your computer and the server continue communicating as you click links, place orders, and carry out other business.

In a DoS attack, a computer is rigged to send not just one "introduction" to a server, but hundreds or thousands. The server - which cannot tell that the introductions are fake - sends back its usual response, waiting up to a minute in each case to hear a reply. When it gets no reply, the server shuts down the connection, and the computer executing the attack repeats, sending a new batch of fake requests.

DoS attacks mostly affect organizations and how they run in a connected world. For consumers, the attacks hinder their ability to access services and information.

Other types of attacks: DDoS

Distributed denial of service (DDoS) attacks represent the next step in the evolution of DoS attacks as a way of disrupting the Internet. Cybercrimininals began using DDoS attacks around 2000.

Here's why DDoS attacks have become the weapon of choice for disrupting networks, servers, and websites.

The attacks use large numbers of compromised computers, as well as other electronic devices - such as webcams and smart televisions that make up the ever-increasing Internet of Things - to force the shutdown of the targeted website, server or network.

Security vulnerabilities in Internet-of-Things devices can make them accessible to cybercriminals seeking to anonymously and easily launch DDoS attacks.

In contrast, a DoS attack generally uses a single computer and a single IP address to attack its target, making it easier to defend against.

How to help prevent DoS attacks

If you rely on a website to do business, you probably want to know about DoS attack prevention.

A general rule: The earlier you can identify an attack-in-progress, the quicker you can contain the damage. Here are some things you can do.

Method 1: Get help recognizing attacks

Companies often use technology or anti-DDoS services to help defend themselves. These can help you recognize between legitimate spikes in network traffic and a DDoS attack.

Method 2: Contact your Internet Service provider

If you find your company is under attack, you should notify your Internet Service Provider as soon as possible to determine if your traffic can be rerouted. Having a backup ISP is a good idea, too. Also, consider services that can disperse the massive DDoS traffic among a network of servers. That can help render an attack ineffective.

Method 3: Investigate black hole routing

Internet service providers can use "black hole routing." It directs excessive traffic into a null route, sometimes referred to as a black hole. This can help prevent the targeted website or network from crashing. The drawback is that both legitimate and illegitimate traffic is rerouted in the same way.

Method 4: Configure firewalls and routers

Firewalls and routers should be configured to reject bogus traffic. Remember to keep your routers and firewalls updated with the latest security patches.

Method 5: Consider front-end hardware

Application front-end hardware that's integrated into the network before traffic reaches a server can help analyze and screen data packets. The hardware classifies the data as priority, regular, or dangerous as they enter a system. It can also help block threatening data.

How Symantec and Norton can help mitigate against DoS attacks and DDoS attacks

Symantec Complete Website Security with DDoS protection can provide significant protection against DoS attacks and the more destructive DDoS attacks.

Symantec's protection is easy to implement and does not require any on-site hardware or software and no changes need to be made to your hosting provider or applications. Symantec Complete Website Security's DDoS protection stops attacks at Symantec's network and screens out the bogus traffic, while your legitimate users maintain uninterrupted access to your website.

What's more, Symantec Complete Website Security's DDoS protection provides comprehensive protection against a variety of DDoS threats such as brute force attacks, spoofing, zero-day DDoS attacks and attacks targeting DNS servers.

If you operate on a smaller scale - say, you operate a basic website offering a service - your chances of becoming a victim of a DDoS attack is probably quite low. Even so, taking certain precautions will help protect you against becoming a victim of any type of attack by hackers.

Here are a few things that can help.

Keep your security software, operating system, and applications updated. Security updates help patch vulnerabilities which hackers may try to exploit. Consider a trusted security software like Norton Security.

Consider a router that comes with built-in DDoS protection.

Look for a website hosting service with an emphasis on security.

Taking simple precautions can make a difference when it comes to your online security. For large organizations, the precautions become far more complex.

# data[].attributes.attachment_link.title
What are Denial of Service (DoS) attacks? DoS attacks explained

# data[].attributes.attachment_link.description
A "denial of service" or DoS attack is used to tie up a website's resources so that users who need to access the site cannot do so. Many major companies have been the focus of DoS attacks. Because a DoS attack can be easily engineered from nearly any location, finding those responsible can be extremely difficult.

# data[].attributes.attachment_link.readable_text
Q2 2018 news includes: non-standard use of old vulnerabilities, new botnets, the cutthroat world of cryptocurrencies, a high-profile DDoS attack (or not) with a political subtext, the slashdot effect, some half-baked attempts at activism, and a handful arrests. But first things first.

Knowing what we know about the devastating consequences of DDoS attacks, we are not inclined to celebrate when our predictions come true. Alas, our forecast in the previous quarter's report was confirmed: cybercriminals continue to seek out new non-standard amplification methods. Even before the panic over the recent wave of Memcached-based attacks had subsided, experts discovered an amplification method using another vulnerability-in the Universal Plug and Play protocol, known since 2001. It allows garbage traffic to be sent from several ports instead of just one, switching them randomly, which hinders the blocking process. Experts reported two attacks (April 11 and 26) in which this method was likely used; in the first instance, the DNS attack was amplified through UPnP, and in the second the same was applied to an NTP attack. In addition, the Kaspersky DDoS Protection team observed an attack that exploited a vulnerability in the CHARGEN protocol. A slightly weaker attack using the same protocol to amplify the flood (among other methods) targeted the provider ProtonMail, the reason for which was an unflattering comment made by the company's executive director.

New botnets are causing more headaches for cybersecurity specialists. A noteworthy case is the creation of a botnet formed from 50,000 surveillance cameras in Japan. And a serious danger is posed by a new strain of the Hide-n-Seek malware, which was the first of all known bots to withstand, under certain circumstances, a reboot of the device on which it had set up shop. True, this botnet has not yet been used to carry out DDoS attacks, but experts do not rule out such functionality being added at a later stage, since the options for monetizing the botnet are not that many.

One of the most popular monetization methods remains attacking cryptocurrency sites and exchanges. What's more, DDoS attacks are used not only to prevent competitors from increasing their investors, but as a way of making a big scoop. The incident with the cryptocurrency Verge is a case in point: in late May, a hacker attacked Verge mining pools, and made off with XVG 35 million ($1.7 million). In the space of two months, the currency was hacked twice, although the preceding attack was not a DDoS.

Not only that, June 5 saw cybercriminals bring down the Bitfinex cryptocurrency exchange, with the system crash followed by a wave of garbage traffic, pointing to a multistage attack that was likely intended to undermine credibility in the site. It was probably competitive rivalry that caused the renowned online poker site, Americas Cardroom, to suffer a DDoS attack that forced first the interruption and then cancellation of a tournament. That said, it was rumored that the attack could have been a political protest against the in-game availability of Donald Trump and Kim Jong Un avatars.

As always, the most media hype in the past quarter was generated by politically motivated DDoS attacks. In mid-April, British and US law enforcement bodies warned that a significant number of devices had been seized by Russian (supposedly Kremlin-sponsored) hackers in the US, the EU, and Australia with a view to carrying out future attacks. Then just a few days later, in late April, it was a Russian target that got hit: the site of the largest Russian political party, United Russia, was down for two whole days, yet there was precious little public speculation about the masterminds behind the DDoS campaign.

An attack on the Danish railway company DSB, which struggled to serve passengers for several days as a result, was also alleged to be politically motivated. Some see it as a continuation of the attack on Swedish infrastructure last fall.

At the end of the quarter, attention was focused on the Mexican elections and an attack on an opposition party website hosting materials about the illegal activities of a rival. According to the victim, the attack began during a pre-election debate when the party's candidate showed viewers a poster with the website address. However, it was immediately rumored that DDoS was not the culprit, but the Slashdot effect, which Reddit users also call "the hug of death." This phenomenon has been around since the dawn of the Internet, when bandwidth was a major issue. But it's still encountered to this day when a small resource suffers a major influx of legitimate web traffic on the back of media hype.

The Slashdot effect was also observed by the Kaspersky DDoS Protection team in early summer. After a press conference by the Russian president, a major news outlet covering the event experienced a powerful wave of tens of thousands of HTTP GET requests all sent simultaneously. The size of the supposed botnet suggested a new round of attacks involving IoT devices, but further analysis by KDP experts showed that all suspicious queries in the User Agent HTTP header contained the substring "XiaoMi MiuiBrowser". In fact, owners of Xiaomi phones with the browser app installed received a push notification about the outcome of the conference, and it seems that many took an interest and followed the link, causing a glut of requests.

Meanwhile, law enforcement agencies have been making every effort to prevent organized attacks: in late April, Europol managed to shut down Webstresser.org, the world's largest DDoS-for-hire service. When it was finally blocked, the portal had more than 136,000 users and had served as the source of more than 4 million DDoS attacks in recent years. After the fall of Webstresser, conflicting trends were reported: some companies observed a significant decline in DDoS activity in Europe (although they warned that the drop was going to be relatively short-lived); others, however, pointed to a rise in the number of attacks across all regions, which may have been the result of attackers seeking to compensate by creating new botnets and expanding old ones.

On top of that, several DDoS attack masterminds were caught and convicted. German hacker ZZboot was sentenced for attacking major German and British firms with ransom demands. However, he avoided jail time, receiving 22 months of probation. At the other end of the Eurasian continent, in Taipei, a hacker named Chung was arrested for allegedly attacking the Taiwan Bureau of Investigation, the Presidential Administration, Chungwa Telecom, and the Central Bank. In the other direction, across the pond, a self-proclaimed hacktivist was arrested in the US for obstructing the work of police in Ohio.

Another, less significant, but more curious arrest took place in the US: an amateur hacker from Arizona was arrested, fined, and jailed after an online acquaintance posted a tweet with his name. Despite his rudimentary skills, the cybercriminal, calling himself the "Bitcoin Baron," had terrorized US towns for several years, crashing the websites of official institutions and demanding ransoms; in one incident, his actions seriously hindered emergency response services. He too tried to position himself as a cyberactivist, but his bad behavior ruined any reputation he might have had, especially his alleged (only by himself, it should be said) attempt to bring down the site of a children's hospital by flooding it with child pornography.

In H1 2018, the average and maximum attack power fell significantly compared to H2 2017. This can be explained by the seasonal slowdown that is usually observed at the start of the year. However, a comparison of H1 indicators for 2017 and 2018 shows a measurable rise in attack power since last year.

One way to increase the attack power is third-party amplification. As mentioned in the news overview, hackers continue to look for ways to amplify DDoS attacks through new (or well-forgotten old) vulnerabilities in widely popular software, not without success, unfortunately. This time, the KDP team detected and repelled an attack with a capacity in the tens of Gbit/s that exploited a vulnerability in the CHARGEN protocol-an old and very simple protocol described in RFC 864 way back in 1983.

CHARGEN was intended for testing and measurement purposes, and can listen on both the TCP and UDP sockets. In UDP mode, the CHARGEN server responds to any request with a packet with a string length from 0 to 512 random ASCII characters. Attackers use this mechanism to send requests to the vulnerable CHARGEN server, where the outgoing address is substituted by the address of the victim. US-CERT estimates the amplification factor at 358.8x, but this figure is somewhat arbitrary, since the responses are generated randomly.

Despite the protocol's age and limited scope, many open CHARGEN servers can be found on the Internet. They are mainly printers and copying devices in which the network service is enabled by default in the software.

The use of CHARGEN in UDP attacks, as reported by KDP and other providers (Radware, Nexusguard), may indicate that attacks using more convenient protocols (for example, DNS or NTP) are becoming less effective, since there exist well-developed methods to combat this kind of UDP flooding. But the simplicity of such attacks makes cybercriminals unwilling to abandon them; instead they hope that modern security systems will not be able to resist antiquated methods. And although the search for non-standard holes will doubtless continue, CHARGEN-type amplification attacks are unlikely to take the world by storm, since vulnerable servers lack a source of replenishment (how often are old copiers connected to the Internet?).

If cybercriminals are going retro in terms of methods, when it comes to targets they are breaking new ground. DDoS attacks against home users are simple, but not profitable, whereas attacks on corporations are profitable, but complex. Now DDoS planners have found a way to get the best of both worlds-in the shape of the online games industry and streamers. Let's take as an example the growing popularity of e-sports tournaments, in which the victors walk away with tens-sometimes hundreds-of thousands of dollars. The largest events are usually held at special venues with specially setup screens and stands for spectators, but the qualifying rounds to get there often involve playing from home. In this case, a well-planned DDoS attack against a team can easily knock it out of the tournament at an early stage. The tournament server might also be targeted, and the threat of disruption could persuade the competition organizers to pay the ransom. According to Kaspersky Lab client data, DDoS attacks on e-sports players and sites with the goal of denying access are becoming increasingly common.

Similarly, cybercriminals are trying to monetize the market of video game streaming channels. Streaming pros show live playthroughs of popular games, and viewers donate small sums to support them. Naturally, the larger the audience, the more money the streamer gets for each broadcast; top players can earn hundreds or thousands of dollars, which basically makes it their job. Competition in this segment is fierce and made worse by DDoS attacks with the capacity to interfere with livestreams, causing subscribers to look for alternatives.

Like e-sports players, home streamers have virtually no means of protection against DDoS attacks. They are essentially reliant on their Internet provider. The only solution at present could be to set up specialized platforms offering greater protection.

Kaspersky Lab has extensive experience of combating cyber threats, including DDoS attacks of all types and complexity. Company experts monitor the actions of botnets using the Kaspersky DDoS Intelligence system.

The DDoS Intelligence system is part of the Kaspersky DDoS Protection solution, and intercepts and analyzes commands sent to bots from C&C servers. What's more, the system is proactive, not reactive-there's no need to wait for a user device to get infected or a command to be executed.

This report contains DDoS Intelligence statistics for Q2 2018.

In the context of this report, it is assumed that an incident is a separate (single) DDoS-attack if the interval between botnet activity periods does not exceed 24 hours. For example, if the same web resource was attacked by the same botnet with an interval of 24 hours or more, then this incident is considered as two attacks. Bot requests originating from different botnets but directed at one resource also count as separate attacks.

The geographical locations of DDoS-attack victims and C&C servers used to send commands are determined by their respective IP addresses. The number of unique targets of DDoS attacks in this report is counted by the number of unique IP addresses in the quarterly statistics.

DDoS Intelligence statistics are limited to botnets detected and analyzed by Kaspersky Lab. Note that botnets are just one of the tools for performing DDoS attacks, and that the data presented in this report do not cover every single DDoS attack that occurred during the period under review.

The stormiest period for DDoS attacks was the start of the quarter, particularly mid-April. By contrast, late May and early June were fairly quiet.

Top spot in terms of number of attacks was retained by China (59.03%), with Hong Kong (17.13%) in second. It also entered the Top 3 by number of unique targets with 12.88%, behind only China (52.36%) and the US (17.75%).

The attacks were quite evenly distributed across the days of the week. The most and least popular were Tuesday and Thursday, respectively, but the difference is slight.

The share of SYN attacks rose sharply to 80.2%; second place went to UDP attacks with 10.6%.

The share of attacks from Linux botnets increased significantly to 94.47% of all single-family attacks.

Geography of attacks

The latest quarter threw up a number of surprises. The leader by number of attacks is still China, with its share practically unchanged (59.03% against 59.42% in Q1). However, for the first time since monitoring began, Hong Kong broke into the Top 3, rising from fourth to second: its share increased almost fivefold, from 3.67% to 17.13%, squeezing out the US (12.46%) and South Korea (3.21%), whose shares declined by roughly 5 p.p. each.

Another surprise package in the territorial ranking was Malaysia, which shot up to fifth place, now accounting for 1.30% of all DDoS attacks. It was joined in the Top 10 by Australia (1.17%) and Vietnam (0.50%), while the big-hitters Japan, Germany, and Russia all dropped out. Britain (0.50%) and Canada (0.69%) moved into eighth and seventh, respectively.

The Top 10 in Q2 also had a greater share of the total number of attacks than in Q1: 96.44% compared with 95.44%.

The territorial distribution of unique targets roughly corresponds to the distribution of the number of attacks: China has the largest share (52.36%), a rise of 5 p.p. against the previous quarter. Second place belongs to the US (17.5%) and third to Hong Kong (12.88%), up from fourth, replacing South Korea (4.76%) (note that in Hong Kong the most popular targets are now Microsoft Azure servers). Britain fell from fourth to eighth, now accounting for 0.8% of unique targets.

The Top 10 said goodbye to Japan and Germany, but welcomed Malaysia (2.27%) in fourth place and Australia (1.93%) just behind in fifth. This quarter's Top 10 accounted for slightly more of the total number of unique attacks, reaching 95.09% against 94.17% in Q1.

Dynamics of the number of DDoS attacks

Peak activity in Q2 2018 was observed in mid-April: a significant increase in the number of attacks was registered in the middle third of this month, with two large spikes occurring just days apart: April 11 (1163) and April 15 (1555). The quarter's deepest troughs came in the second half and at the end: the calmest days were May 24 (13) and June 17 (16).

In Q2 2018, Sunday went from being the quietest day for cybercriminals to the second most active: it accounted for 14.99% of attacks, up from 10.77% in the previous quarter. But gold in terms of number of attacks went to Tuesday, which braved 17.49% of them. Thursday, meanwhile, went in the opposite direction: only 12.75% of attacks were logged on this day. Overall, as can be seen from the graph, in the period April-June the attack distribution over the days of the week was more even than at the beginning of the year.

Duration and types of DDoS attacks

The longest attack in Q2 lasted 258 hours (almost 11 days), slightly short of the previous quarter's record of 297 hours (12.4 days). This time, the focus of persevering hackers was an IP address belonging to China Telecom.

Overall, the share of long-duration attacks fell by 0.02 p.p. to 0.12%. Whereas the share of attacks lasting from 100 to 139 hours remained the same, the share of attacks from 10 to 50 hours almost doubled (from 8.28% to 16.27%); meanwhile, the share of attacks lasting from five to nine hours increased nearly by half (from 10.73% to 14.01%). The share of short-duration attacks (up to four hours) fell sharply from 80.73% in January to 69.49% in March.

All other types of attacks decreased in share; UDP attacks are in second place (10.6%), while TCP, HTTP, and ICMP constitute a relatively small proportion.

Geographical distribution of botnets

The Top 10 regions by number of botnet C&C servers underwent some significant changes. Top spot went to the US with almost half of all C&C centers (44.75% against 29.32% in Q1). South Korea (11.05%) sank from first to second, losing nearly 20 p.p. China also dropped significantly (from 8.0% to 5.52%). Its place was taken by Italy, whose share climbed from 6.83% in the previous quarter to 8.84%. The Top 10 saw the departure of Hong Kong, but was joined-for the first time since our records began-by Vietnam, whose 3.31% was good enough for seventh place.

In Q2 2018, cybercriminals continued the above-outlined trend of searching for exotic holes in UDP transport protocols. It surely won't be long before we hear about other sophisticated methods of attack amplification.

Another technical discovery of note is the potential for creating botnets using the UPnP protocol; although evidence for them exists, they are still extremely rare in the wild, fortunately.

Windows botnet activity decreased: in particular, Yoyo activity experienced a multifold drop, and Nitol, Drive, and Skill also declined. Meanwhile, Xor for Linux significantly increased its number of attacks, while another infamous Linux botnet, Darkai, scaled back slightly. As a result, the most popular type of attack was SYN flooding.

The total attack duration changed little since the previous quarter, but the share of medium-duration attacks increased, while the share of shorter ones decreased. The intensity of attacks also continues to grow. The most lucrative targets for cybercriminals seem to be cryptocurrencies, but we can soon expect to see high-profile attacks against e-sports tournaments as well as relatively small ransoms targeting individual streamers and players. Accordingly, there will be market demand for affordable individual anti-DDoS protection.

# data[].attributes.attachment_link.description
In H1 2018, the average and maximum attack power fell significantly compared to H2 2017. In Q2 2018, cybercriminals continued the above-outlined trend of searching for exotic holes in UDP transport protocols. It surely won't be long before we hear about other sophisticated methods of attack amplification.

# data[].attributes.body
How to plan and conduct a project dissertation/reserach

# data[].attributes.attachment_link.readable_text
This guide addresses the task of planning and conducting a small research project, such as for an undergraduate or masters' level dissertation. It aims to help you develop a clear sense of direction early on in the project, and to support you in organising, planning, and monitoring your project.

The companion guide Writing a dissertation focuses on the preparation of the written report or thesis.

What is a dissertation?

A dissertation is a particular kind of academic task. You will usually be asked to generate a topic for yourself; to plan and execute a project investigating that topic; and to write-up what you did and what your findings were. Important stages in the dissertation process include:

choosing a topic;

developing a research question;

effective planning of the research;

being organised and methodical while conducting your research; and

reporting the research.

Choosing a topic

While some students come to their research project with a clear research question to address, many others arrive at this point with several ideas, but with no specific research question. In view of the pressure to get started fairly quickly, this can cause anxiety and even panic. It is, however, a common situation to be in. There are several ways forward:

Remember that a research study can:

This list is not exhaustive, and you need to check whether your department has a preference for particular kinds of research study.

Discuss your proposed topic with a member of academic staff who you think might be appropriate to supervise the project. Provided they feel that they know enough about the subject to supervise it, and provided that it can be interpreted as falling within the broad fields of your degree subject, academic staff are generally open to suggestions.

You should think realistically about the practical implications of your choice, in terms of:

For example, a project on coal mining in the North East of England may require you to visit Newcastle's Record Office, or to interview coal miners from the region. Is this something that you are prepared and able to do? If the practical considerations associated with your research ideas are unrealistic, you need to consider whether you are willing to modify or reconsider your project.

Developing a research question

Once your topic has been accepted by your department, you need to begin the process of refining the topic and turning it into something that is focused enough to guide your project. Try describing it as a research problem that sets out:

the issue that you are going to be investigating;

your argument or thesis (what you want to prove, disprove, or explore); and

the limits of your research (i.e. what you are not going to be investigating).

It is important that you establish a research problem at, or close to the start of, your project. It is one of the key tools you have, to ensure that your project keeps going in the right direction. Every task you undertake should begin with you checking your research problem and asking "will this help me address this problem?".

You should be willing to revise your research problem as you find out more about your topic. You may, for example, discover that the data you were hoping to analyse is not available, or you may encounter a new piece of information or a new concept while undertaking a literature search, that makes you rethink the basis of your research problem. You should always talk to your supervisor before you make any substantial revision to your plans, and explain why you think you need to make the change.

Research problem

Commentary

'Public transport in Scotland'

This sets out your research field but does not frame a research problem because it is too general. You do not have time to study everything about a topic, so you should focus on an aspect that you are interested in.

'Examination of the influence of public transport links on new housing development in Western Scotland'

This is a much better research problem as it establishes an argument (existence of public transport may have some influence on new housing development). However, it is still quite general and could be improved by further focus.

'Investigation of the relationship between public transport links and the development of new areas of housing in Western Scotland: a comparison of local plans and building development since 1990'

This is better still. It shows the limits of the project. You will be investigating a complex subject (public transport in Scotland), but will be focusing on only one aspect of it (possible influence on new housing development). You will make this large subject manageable by focusing on a limited period of time (1990 onwards), and limited sources.

Effective planning of the research

Writing a research proposal

A research proposal is a more detailed description of the project you are going to undertake. Some departments require you to submit a research proposal as part of the assessment of your dissertation, but it is worth preparing one even if it is not a formal requirement of your course. It should build on the thinking that you have done in defining your research problem; on the discussions that you have had with your supervisor; and on early reading that you have done on the topic. A comprehensive research proposal will make you think through exactly what it is that you are going to do, and will help you when you start to write up the project.

You could try outlining your project under the following headings (Booth, Williams, & Colomb, 2003. The craft of research. Chicago: The University of Chicago Press.):

Topic:

this project will study...

Question/problem:

to find out...

Significance:

so that more will be known about...

Primary resources:

the main data will be...

Secondary sources:

additional data comes from...

Methods:

the research will be conducted as follows...

Justification:

the method is most appropriate because...

Limitations:

there are some matters that this methodology may not help me to explain. These might include...

You may find that some of these headings are difficult to fill in right at the start of your project. However, you can use the gaps to help identify where you need to begin work. If, for example, you are unsure about the limitations of your methodology you should talk to your supervisor and read a bit more about that methodology before you start.

Creating a research plan

A dissertation is an extended project that asks you to manage your time and undertake a variety of tasks. Some courses schedule the dissertation at the end, while others have it running along concurrently with other modules. Whichever way your course is organised, it is essential that you create a plan that helps you allocate enough time to each task you have to complete.

It is useful to work out how many weeks you have until you need to submit your completed dissertation, and draw a chart showing these weeks. Block out the weeks when you know you will be unable to work, and mark in other main commitments you have that will take time during this period. Then allocate research tasks to the remaining time.

January

Christmas

Write research proposal

Literature review

Complete literature review and conduct pilot study

Main data collection

February

Complete data collection

Analyse data

Analyse data

Write dissertation plan, then begin first draft

March

Complete first draft

Discuss draft with supervisor

Second draft

Second draft

Proofing/checking

It is very important to be realistic about how long each task is likely to take. Some focused thought at the beginning, then at the planning stage of each phase, could save hours later on. Write down the resources needed for each stage. It could be time in the library; the resource of your working hours; or the use of equipment or room space that needs to be booked in advance.

Procrastination

Some people find that they procrastinate more than they would like. This is a common problem, so it is probably best to be well-prepared to identify it and deal with it if it does start to happen. People procrastinate for various reasons for example:

poor time management

dauted by the scale of the task

negative beliefs

loss of motivation

perfectionism

difficulty concentrating

need to feel under pressure

personal problems

Early identification of the signs of procrastination will give you the best chance of minimising any negative effects. Once you suspect that you are procrastinating, it can be helpful to review what you are expecting of yourself, and check that those expectations are realistic. This is where planning is vital.

Realistic planning

To improve the prospect of completing on time, and avoiding procrastination, you need to:

Your research plan should also include information about what equipment you will need to complete your project, and any travel costs or other expenses that you are likely to incur through the pursuit of your research. You should also think about whether you are dependent on any one else to complete your project, and think about what you are going to do if they are unable to help you.

Once you have created your plan it is a good idea to show it to someone else. Ideally you will be able to show it to a member of academic staff or bring it to the Learning Development, but talking it over with a friend may also help you to spot anything that you have forgotten or anywhere that you have been unrealistic in your planning.

Being organised and methodical while conducting your research

The role of the supervisor

Although a dissertation is an opportunity for you to work independently, you will usually be allocated a member of academic staff as a supervisor. Supervisors are there to help you shape your ideas and give you advice on how to conduct the research for your dissertation. They are not there to teach you the topic you have chosen to investigate: this is your project. They are, however, one of the resources that you can call on during your research.

Academics are busy people, so to get the most out of your supervisor you will need to be organised and to take responsibility for the relationship. It is not your supervisor's job to chase you into completing your dissertation, or to tell you how to manage the different stages of the project. To ensure that you get the most out of your supervisor you need to:

agree a timetable of meetings at the start of your project and stick to it;

make sure that each meeting has a focus e.g. "setting a research problem", "analysing the data";

send something that can form the basis of a discussion about your progress to your supervisor before each meeting. This could include your research plan, early results of your data collection or draft chapters;

turn up on time to each meeting you have arranged. Do not assume that your supervisor is available at all times to see you;

at the end of each supervision agree some action points for you to focus on before the next time you meet; and

keep a record of what you decide in supervision sessions.

If you are not happy with the way you are being supervised, explain why to your supervisor or discuss the issue with your personal tutor.

Undertaking a literature survey

Regardless of whether you have been given a dissertation topic or you have developed your own ideas, you will need to be able to demonstrate the rationale for your research, and to describe how it fits within the wider research context in your area. To support you in doing this you will need to undertake a literature review, which is a review of material that has already been published, either in hard copy or electronically, that may be relevant for your research project. Key tools that are available to help you, include:

the University of Leicester Library Catalogue;

electronic journals available via the library; and

bibliographies in any key texts about your topic.

It is a good idea to make an appointment to see the librarian specialising in your subject. An information librarian should be able to give you advice on your literature search, and on how to manage the information that you generate.

You will probably generate more references than you can read. Use the titles and abstracts to decide whether the reference is worth reading in detail. Be selective by concentrating on references that:

are recommended by your supervisor;

contain a high number of specifically relevant keywords;

are cited in a number of other works; and

are published in the last five years, unless they are key texts in your field.

Once you start reading, ensure that you think about what you are trying to get out of each article or book that you read. Your notes should enable you to write up your literature search without returning to the books you have read. Refer to the guides Effective Note Making, Referencing and Bibliographies, and Avoiding Plagiarism, for further help with note-making.

Collecting data

For most research projects the data collection phase feels like the most important part. However, you should avoid jumping straight into this phase until you have adequately defined your research problem, and the extent and limitations of your research. If you are too hasty you risk collecting data that you will not be able to use.

Consider how you are going to store and retrieve your data. You should set up a system that allows you to:

record data accurately as you collect it;

retrieve data quickly and efficiently;

analyse and compare the data you collect; and

create appropriate outputs for your dissertation e.g. tables and graphs, if appropriate.

There are many systems that support effective data collection and retrieval. These range from card indexes and cross-referenced exercise books, through electronic tools like spreadsheets, databases and bibliographic software, to discipline-specific tools. You should talk about how you plan to store your data with your supervisor, an information librarian, or a study adviser in the Learning Development. As you undertake your research you are likely to come up with lots of ideas. It can be valuable to keep a record of these ideas on index cards, in a dedicated notebook, or in an electronic file. You can refer back to this 'ideas store' when you start to write. They may be useful as ideas in themselves, and may be useful as a record of how your thinking developed through the research process.

Pilot studies

A pilot study involves preliminary data collection, using your planned methods, but with a very small sample. It aims to test out your approach, and identify any details that need to be addressed before the main data collection goes ahead. For example, you could get a small group to fill in your questionnaire, perform a single experiment, or analyse a single novel or document.

When you complete your pilot study you should be cautious about reading too much into the results that you have generated (although these can sometimes be interesting). The real value of your pilot study is what it tells you about your method.

Was it easier or harder than you thought it was going to be?

Did it take longer than you thought it was going to?

Did participants, chemicals, processes behave in the way you expected?

What impact did it have on you as a researcher?

Spend time reflecting on the implications that your pilot study might have for your research project, and make the necessary adjustment to your plan. Even if you do not have the time or opportunity to run a formal pilot study, you should try and reflect on your methods after you have started to generate some data.

Dealing with problems

Once you start to generate data you may find that the research project is not developing as you had hoped. Do not be upset that you have encountered a problem. Research is, by its nature, unpredictable. Analyse the situation. Think about what the problem is and how it arose. Is it possible that going back a few steps may resolve it? Or is it something more fundamental? If so, estimate how significant the problem is to answering your research question, and try to calculate what it will take to resolve the situation. Changing the title is not normally the answer, although modification of some kind may be useful.

If a problem is intractable you should arrange to meet your supervisor as soon as possible. Give him or her a detailed analysis of the problem, and always value their recommendations. The chances are they have been through a similar experience and can give you valuable advice. Never try to ignore a problem, or hope that it will go away. Also don't think that by seeking help you are failing as a researcher.

Finally, it is worth remembering that every problem you encounter, and successfully solve, is potentially useful information in writing up your research. So don't be tempted to skirt around any problems you encountered when you come to write-up. Rather, flag up these problems and show your examiners how you overcame them.

Reporting the research

As you conduct research, you are likely to realise that the topic that you have focused on is more complex than you realised when you first defined your research question. The research is still valid even though you are now aware of the greater size and complexity of the problem. A crucial skill of the researcher is to define clearly the boundaries of their research and to stick to them. You may need to refer to wider concerns; to a related field of literature; or to alternative methodology; but you must not be diverted into spending too much time investigating relevant, related, but distinctly separate fields.

Starting to write up your research can be intimidating, but it is essential that you ensure that you have enough time not only to write up your research, but also to review it critically, then spend time editing and improving it. The following tips should help you to make the transition from research to writing:

In your research plan you need to specify a time when you are going to stop researching and start writing. You should aim to stick to this plan unless you have a very clear reason why you need to continue your research longer.

Take a break from your project. When you return, look dispassionately at what you have already achieved and ask yourself the question: 'Do I need to do more research?'

Speak to your supervisor about your progress. Ask them whether you still need to collect more data.

Remember that you can not achieve everything in your dissertation. A section where you discuss 'Further Work' at the end of your dissertation will show that you are thinking about the implications your work has for the academic community.

The companion study guide Writing a Dissertation focuses on the process of writing up the research from your research project.

Summary

# data[].attributes.attachment_link.title
Planning and conducting a dissertation research project

# data[].attributes.attachment_link.description
This guide addresses the task of planning and conducting a small research project, such as for an undergraduate or masters' level dissertation. It aims to help you develop a clear sense of direction early on in the project, and to support you in organising, planning, and monitoring your project.

# data[].attributes.body
Intrusion Detection Systems for practical project work

# data[].attributes.attachment_link.readable_text
Virus attacks are no longer the only threats to the integrity of your network. Advanced persistent threats have become the new intrusion method that is grabbing the headlines. Under this scenario, hackers gain access to your network, control logs, and manipulate user records to gain entry whenever they want. They can even sell off your internet bandwidth as a cover for other cybercriminals.
>>>Jump to the intrusion detection tools list<<<
Network intrusion detection tools and systems are now essential for network security. Fortunately, these systems are very easy to use and most of the best IDSs on the market are free to use. In this review, you will read about the ten best intrusion detection systems that you can install now to start protecting your network from attack. We cover tools for Windows, Linux, and Mac.

Host Intrusion Detection Systems (HIDS)

Host-based intrusion detection, also known as host intrusion detection systems or host-based IDS, examine events on a computer on your network rather than the traffic that passes around the system. This type of intrusion detection system is abbreviated to HIDS and it mainly operates by looking at data in admin files on the computer that it protects. Those files include log files and config files.

A HIDS will back up your config files so you can restore settings should a malevolent virus loosen the security of your system by changing the setup of the computer. Another key element that you want to guard against is root access on Unix-like platforms or registry alterations on Windows systems. A HIDS won't be able to block these changes, but it should be able to alert you if any such access occurs.

Each host the HIDS monitors must have some software installed on it. You can just get your HIDS to monitor one computer. However, it is more typical to install the HIDS on every device on your network. This is because you don't want to overlook config changes on any piece of equipment. Naturally, if you have more than one HIDS host on your network, you don't want to have to log into each one in order to get feedback. So, a distributed HIDS system needs to include a centralized control module. Look for a system that encrypts communications between host agents and the central monitor.

Network Intrusion Detection Systems (NIDS)

Network-based intrusion detection, also known as a network intrusion detection system or network IDS, examines the traffic on your network. As such, a typical NIDS has to include a packet sniffer in order to gather network traffic for analysis.

The analysis engine of a NIDS is typically rule-based and can be modified by adding your own rules. With many NIDS, the provider of the system, or the user community, will make rules available to you and you can just import those into your implementation. Once you become familiar with the rule syntax of your chosen NIDS, you will be able to create your own rules.

Chaining back to traffic collection, you don't want to dump all of your traffic into files or run the whole lot through a dashboard because you just wouldn't be able to analyze all of that data. So, the rules that drive analysis in a NIDS also create selective data capture. For example, if you have a rule for a type of worrisome HTTP traffic, your NIDS should only pick up and store HTTP packets that display those characteristics.

Typically, a NIDS is installed on a dedicated piece of hardware. High-end paid-for enterprise solutions come as a piece of network kit with the software pre-loaded onto it. However, you don't have to pay out big bucks for the specialist hardware. A NIDS does require a sensor module to pick up traffic, so you may be able to load it onto a LAN analyzer, or you may choose to allocate a computer to run the task. However, make sure the piece of equipment that you choose for the task has enough clock speed to not slow down your network.

HIDS or NIDS?

The short answer is both. A NIDS will give you a lot more monitoring power than a HIDS. You can intercept attacks as they happen with a NIDS, whereas a HIDS only notices anything is wrong once a file or a setting on a device has already changed. However, just because HIDSs don't have as much activity as NIDSs doesn't mean that they are less important.

The fact that the NIDS is usually installed on a stand-alone piece of equipment means that it doesn't drag down the processors of your servers. However, the activity of HIDS is not as aggressive as that of NIDS. A HIDS function can be fulfilled by a lightweight daemon on the computer and shouldn't burn up too much CPU. Neither system generates extra network traffic.

Detection methods: Signature-based or Anomaly-based IDS

Whether you are looking for a host intrusion detection system or a network intrusion detection system, all IDSs use two modes of operation - some may only use one or the other, but most use both.

Signature-based IDS

Anomaly-based IDS

Signature-based IDS

The signature-based method looks at checksums and message authentication. Signature-based detection methods can be applied just as well by NIDS as by HIDS. A HIDS will look at log and config files for any unexpected rewrites, whereas a NIDS will look at the checksums in packets and message authentication integrity of systems such as SHA1.

The NIDS may include a database of signatures that packets known to be sources of malicious activities carry. Fortunately, hackers don't sit at their computers typing like fury in order to crack a password or access the root user. Instead, they use automated procedures supplied by well-known hacker tools. These tools tend to generate the same traffic signatures every time because computer programs repeat the same instructions over and over again rather than introducing random variations.

Anomaly-based IDS

Anomaly-based detection looks for unexpected or unusual patterns of activities. This category can also be implemented by both host and network-based intrusion detection systems. In the case of HIDS, an anomaly might be repeated failed login attempts, or unusual activity on the ports of a device that signify port scanning.

In the case of NIDS, the anomaly approach requires establishing a baseline of behavior to create a standard situation against which ongoing traffic patterns can be compared. A range of traffic patterns are considered acceptable, and when current real-time traffic moves out of that range, an anomaly alert is provoked.

Choosing an IDS method

Sophisticated NIDSs can build up a record of standard behavior and adjust their boundaries as their service life progresses. Overall, both signature and anomaly analysis is much simpler in operation and easier to set up with HIDS software than with NIDS.

Signature-based methods are much faster than anomaly-based detection. A fully comprehensive anomaly engine touches on the methodologies of AI and can cost a lot of money to develop. However, signature-based methods boil down to the comparison of values. Certainly, in the case of HIDS, pattern matching with file versions can be a very straightforward task that anyone could perform themselves using command line utilities with regular expressions. So, they don't cost as much to develop and are more likely to be implemented in free intrusion detection systems.

A comprehensive intrusion detection system needs both signature-based methods and anomaly-based procedures.

Defend the network with an IPS

Now we need to consider intrusion prevention systems (IPSs). IPS software and IDSs are branches of the same technology because you can't have prevention without detection. Another way to express the difference between these two branches of intrusion tools is to call them passive or active. A straightforward intrusion monitoring and alerting system is sometimes called a "passive" IDS. A system that not only spots an intrusion but takes action to remediate any damage and block further intrusion activity from a detected source, is also known as a "reactive" IDS.

Reactive IDSs, or IPSs, usually don't implement solutions directly. Instead, they interact with firewalls and applications by adjusting settings. A reactive HIDS can interact with a number of networking aides to restore settings on a device, such as SNMP or an installed configuration manager. Attacks on the root user, or admin user in Windows, usually aren't dealt with automatically as the blocking of an admin user or changing the system password would result in locking the system administrator out of the network and servers.

Many users of IDSs report a flood of false positives when they first install their defense systems. As IPSs automatically implement defense strategy on detection of an alert condition. Incorrectly calibrated IPSs can cause havoc and bring your legitimate network activity to a standstill.

To minimize the network disruption that can be caused by false positives, you should introduce your intrusion detection and prevention system in stages. Triggers can be tailored and you can combine warning conditions to create custom alerts. The statement of actions that need to be performed on the detection of threats is termed a policy. The interaction of intrusion detection and prevention procedures with firewalls should be particularly fine-tuned to prevent your business's genuine users from being locked out by over-tight policies.

Intrusion detection systems by type and operating system

The producers of IDS software focus on Unix-like operating systems. Some produce their code according to the POSIX standard. In all of these cases, that means that Windows is excluded. As the Mac OS operating systems of Mac OS X and macOS are based on Unix, these operating systems are much better catered to in the IDS world than in other software categories. The table below explains which IDSs are host-based, which are network-based, and which operating systems each can be installed on.

You may read some reviews that claim that Security Onion can be run on Windows. It can if you first install a virtual machine and run it through that. However, for the definitions in this table, we only count software as being compatible with an operating system if it can be installed directly.

Top Intrusion Detection Tools & Software

Intrusion Detection Systems for Unix

To restate the information in the table above into a Unix-specific list, here are the HIDS and NIDS you can use on the Unix platform.

Host intrusion detection systems:

OSSEC

Sagan

AIDE

Samhain

Fail2Ban

Network intrusion detection systems:

Intrusion Detection Systems for Linux

Here are lists of the host intrusion detection systems and network intrusion systems that you can run on the Linux platform.

Host intrusion detection systems:

OSSEC

Sagan

Security Onion

AIDE

Samhain

Fail2Ban

Network intrusion detection systems:

Snort

Bro

Suricata

Sagan

Security Onion

Open WIPS-NG

Intrusion Detection Systems for Windows

Despite the popularity of Windows Server, the developers of intrusion detection systems don't seem to be very interested in producing software for the Windows operating system. Here are the few IDSs that run on Windows.

Host intrusion detection systems:

SolarWinds Log and Event Manager

OSSEC

Network intrusion detection systems:

SolarWinds Log and Event Manager

Snort

Suricata

Intrusion Detection Systems for Mac OS

Mac owners benefit from the fact that Mac OS X and macOS are both based on Unix and so there are far more intrusion detection system options for Mac owners than those who have computers running the Windows operating system.

Host intrusion detection systems:

OSSEC

Sagan

AIDE

Samhain

Fail2Ban

Network intrusion detection systems:

Recommended intrusion detection systems

Here's our list of the 11 Best Intrusion Detection Systems and Tools:

Now you have seen a quick rundown of host-based intrusion detection systems and network-based intrusion detection systems by operating system, in this list, we go deeper into the details of each of the best IDS.

The SolarWinds Log and Event Manager (LEM) runs on Windows Server, but it is able to log messages generated by Unix, Linux, and Mac OS computers as well as Windows PCs.

As a log manager, this is a host-based intrusion detection system because it is concerned with managing files on the system. However, it also manages data collected by Snort, which makes it part of a network-based intrusion detection system.

Snort is a widely-used packet sniffer created by Cisco Systems (see below). It has a specific data format, which other IDS tool producers integrate into their products. This is the case with the SolarWinds Log and Event Manager. Network intrusion detection systems examine traffic data as it circulates on the network. To deploy the NIDS capabilities of the Log and Event Manager, you would need to use Snort as a packet capture tool and funnel captured data through to the Log and Event Manager for analysis. Although LEM acts as a HIDS tool when it deals with log file creation and integrity, it is capable of receiving real-time network data through Snort, which is a NIDS activity.

The SolarWinds product can act as an intrusion prevention system as well because it is able to trigger actions on the detection of intrusion. The package ships with more than 700 event correlation rules, which enables it to spot suspicious activities and automatically implement remediation activities. These actions are called Active Responses.

These Active Responses include:

Incident alerts via SNMP, screen messages, or email

USB device isolation

User account suspension or user expulsion

IP address blocking

Processes killing

System shutdown or restart

Service shutdown

Service triggering

The Snort message processing capabilities of the Log and Event Manager make it a very comprehensive network security tool. Malicious activity can be shut down almost instantly thanks to the tool's ability to combine Snort data with other events on the system. The risk of disrupting the service through the detection of false positives is greatly reduced thanks to the finely-tuned event correlation rules. You can access this network security system on a 30-day free trial.

SolarWinds Log and Event Manager Download 30-day FREE Trial

Snort is the industry leader in NIDS, but it is still free to use. This is one of the few IDSs around that can be installed on Windows. It was created by Cisco. The system can be run in three different modes and can implement defense strategies, so it is an intrusion prevention system as well as an intrusion detection system.

The three modes of Snort are:

Sniffer mode

Packet logger

Intrusion detection

You can use snort just as a packet sniffer without turning on its intrusion detection capabilities. In this mode, you get a live readout of packets passing along the network. In packet logging mode, those packet details are written to a file.

When you access the intrusion detection functions of Snort, you invoke an analysis module that applies a set of rules to the traffic as it passes by. These rules are called "base policies," and if you don't know which rules you need, you can download them from the Snort website. However, once you become confident in the methodologies of Snort, it is possible to write your own. There is a large community base for this IDS and they are very active online on the community pages of the Snort website. You can get tips and help from other users and also download rules that experienced Snort users have developed.

The rules will detect events such as stealth port scans, buffer overflow attacks, CGI attacks, SMB probes, and OS fingerprinting. The detection methods depend on the specific rules being used and they include both signature-based methods and anomaly-based systems.

Snort's fame has attracted followers in the software developer industry. A number of applications that other software houses have created can perform deeper analysis of the data collected by Snort. These include Snorby, BASE, Squil, and Anaval. Those companion applications help you make up for the fact that the interface for Snort isn't very user-friendly.

OSSEC stands for Open Source HIDS Security. It is the leading HIDS available and it is completely free to use. As a host-based intrusion detection system, the program focuses on the log files in the computer where you install it. It monitors the checksum signatures of all your log files to detect possible interference. On Windows, it will keep tabs on any alterations to the registry. On Unix-like systems, it will monitor any attempts to get to the root account. Although OSSEC is an open source project, it is actually owned by Trend Micro, a prominent security software producer.

The main monitoring application can cover one computer or several hosts, consolidating data in one console. Although there is a Windows agent that allows Windows computers to be monitored, the main application can only be installed on a Unix-like system, which means Unix, Linux or Mac OS. There is an interface for OSSEC for the main program, but this is installed separately and is no longer supported. Regular users of OSSEC have discovered other applications that work well as a front-end to the data gathering tool: include Splunk, Kibana, and Graylog.

The log files covered by OSSEC include FTP, mail, and web server data. It also monitors operating system event logs, firewall and antivirus logs and tables, and traffic logs. The behavior of OSSEC is controlled by the policies that you install on it. These can be acquired as add-ons from the large user community that is active for this product. A policy defines an alert condition. Those alerts can be displayed on the console or sent as notifications via email. Trend Micro offers support for OSSEC for a fee.

Suricata is probably the main alternative to Snort. There is a key advantage that Suricata has over Snort, which is that it collects data at the application layer. This overcomes a blindness that Snort has to signatures split over several TCP packets. Suricata waits until all of the data in packets is assembles before it moves information into analysis.

Although the system works at the application layer ,it is able to monitor protocol activity at lower levels, such as IP, TLS, ICMP, TCP, and UDP. It examines real-time traffic for different network applications including FTP, HTTP, and SMB. The monitor doesn't just look at packet structure. It can examine TLS certificates and focus on HTTP requests and DNS calls. A file extraction facility lets you examine and isolate suspicious files with virus infection characteristics.

Suricata is compatible with Snort and you can use the same VRT rules written for that NIDS leader. Those third-party tools, such as Snorby, BASE, Squil, and Anaval that integrate with Snort can also bolt on to Suricata. So, accessing the Snort community for tips and free rules can be a big benefit for Suricata users. A built-in scripting module allows you to combine rules and get a more precise detection profile than Snort can give you. Suricata uses both signature and anomaly-based methods.

Suricata has a clever processing architecture that enables hardware acceleration by using many different processors for simultaneous, multi-threaded activity. It can even run partly on your graphics card. This distribution of tasks keeps load from bearing down on just one host. That's good because one problem with this NIDS is that it is quite heavy on processing. Suricata has a very slick-looking dashboard that incorporates graphics to make analysis and problem recognition a lot easier. Despite this expensive-looking front-end, Suricata is free of charge.

Bro is a free NIDS that goes beyond intrusion detection and can provide you with other network monitoring functions as well. The user community of Bro includes many academic and scientific research institutions.

The Bro intrusion detection function is fulfilled in two phases: traffic logging and analysis. As with Suricata, Bro has a major advantage over Snort in that its analysis operates at the application layer. This gives you visibility across packets to get a broader analysis of network protocol activity.

The analysis module of Bro has two elements that both work on signature analysis and anomaly detection. The first of these analysis tools is the Bro event engine. This tracks for triggering events, such as a new TCP connection or an HTTP request. Each event is logged, so this part of the system is policy-neutral - it just provides a list of events in which analysis may reveal repetition of actions or suspiciously diverse activity generated by the same user account.

The mining of that event data is performed by policy scripts. An alert condition will provoke an action, so Bro is an intrusion prevention system as well as a network traffic analyzer. The policy scripts can be customized but they generally run along a standard framework that involves signature matching, anomaly detection, and connection analysis.

You can track HTTP, DNS, and FTP activity with Bro and also monitor SNMP traffic, enables you to check on device configuration changes and SNMP Trap conditions. Each policy is a set of rules and you are not limited to the number of active policies or the protocol stack layers that you can examine. At lower levels, you can watch out for DDoS syn flood attacks and detect port scanning.

Bro can be installed on Unix, Linux, and Mac OS.

Sagan is a host-based intrusion detection system, so this is an alternative to OSSEC and it is also free to use. Despite being a HIDS, the program is compatible with data gathered by Snort, which is a NIDS system. This compatibility also extends to the other tools that can be used in conjunction with Snort, such as Snorby, BASE, Squil, and Anaval. Data sources from Bro and Suricata can also feed into Sagan. This tool can be installed on Unix, Linux, and Mac OS. Although you can't run Sagan on Windows, you can feed windows event logs into it.

Strictly speaking, Sagan is a log analysis tool. The element that it lacks to make it a stand-alone NIDS is a packet sniffer module. However, on the plus side, this means that Sagan doesn't require dedicated hardware and it has the flexibility to analyze both host logs and network traffic data. This tool would have to be a companion to other data gathering systems in order to create a full intrusion detection system.

Some nice features of Sagan include an IP locator, which enables you to see the geographical location of the IP addresses that are detected as having suspicious activities. This will enable you to aggregate the actions of IP addresses that seem to be working in concert to form an attack. Sagan can distribute its processing over several devices, lightening the load on the CPU of your key server.

This system includes script execution, which means that it will generate alerts and perform actions on the detection of intrusion scenarios. It can interact with firewall tables to implement IP bans in the event of suspicious activity from a specific source. So, this is an intrusion prevention system. The analysis module works with both signature and anomaly detection methodologies.

Sagan doesn't make it onto everyone's list of the best IDSs because it doesn't truly qualify as an IDS, being a log file analyzer. However, its HIDS with a splash of NIDS concept makes it an interesting proposition as a hybrid IDS analysis tool component.

For a blend of IDS solutions, you could try the free Security Onion system. Most of the IDS tools in this list are open source projects. That means that anyone can download the source code and change it. That's exactly what the developer of Security Onion did. He took elements from the source code of Snort, Suricata, OSSEC, and Bro and stitched them together to make this free Linux-based NIDS/HIDS hybrid. Security Onion is written to run on Ubuntu and it also integrates elements from front-end systems and analysis tools including Snorby, Sguil, Squert, Kibana, ELSA, Xplico, and NetworkMiner.

Although Security Onion is classified as a NIDS, it does include HIDS functions as well. It will monitor your log and config files for suspicious activities and check on the checksums of those files for any unexpected changes. One downside of the Security Onion's comprehensive approach to network monitoring is its complexity. It has several different operating structures and there isn't really sufficient learning material online or bundled in to help the network administrator get to grips with the full capabilities of the tool.

Network analysis is conducted by a packet sniffer, which can display passing data on a screen and also write to a file. The analysis engine of Security Onion is where things get complicated because there are so many different tools with different operating procedures that you may well end up ignoring most of them. The interface of Kibana provides the dashboard for Security Onion and it does include some nice graphs and charts to ease status recognition.

Both signature-based and anomaly-based alert rules are included in this system. You get information on device status as well as traffic patterns. All of this could really do with some action automation, which Security Onion lacks.

"Advanced Intrusion Detection Environment" is a lot to write, so the developers of this IDS decided to abbreviate its name to AIDE. This is a free HIDS that focuses on rootkit detection and file signature comparisons for Unix and Unix-like operating systems, so it will work on Mac OS and Linux as well.

If you have considered Tripwire, you would be better off looking at AIDE instead, because this is a free replacement for that handy tool. Tripwire has a free version, but a lot of the key functions that most people need from an IDS are only available with the paid-for Tripwire, so you get a lot more functionality for free with AIDE.

The system compiles a database of admin data from config files when it is first installed. That creates a baseline and then any changes to configurations can be rolled back whenever changes to system settings are detected. The tool includes both signature and anomaly monitoring methods. System checks are issued on demand and do not run continuously, which is a bit of a shortfall with this HIDS. As this is a command line function, though, you can schedule it to run periodically with an operating method, such as cron. If you want near real-time data, you could just schedule it to run very frequently.

AIDE is really just a data comparison tool and it doesn't include any scripting language, you would have to rely on your shell scripting skills to get data searching and rule implementation functions into this HIDS. Maybe AIDE should be considered more as a configuration management tool rather than as an intrusion detection system.

If you have heard about Aircrack-NG, then you might be a little cautious of this network-based IDS because it was developed by the same entrepreneur. Aircrack-NG is a wireless network packet sniffer and password cracker that has become part of every wifi network hacker's toolkit.

In WIPS-NG we see a case of poacher-turned-gamekeeper. This free software is designed to defend wireless networks. Although Aircrack-NG can run on a range of operating systems, Open WIPS-NG only runs on Linux. The name "WIPS" stands for "wireless intrusion prevention system," so this NIDS both detects and blocks intrusion.

The system includes three elements:

There are plans to allow a WIPS-NG installation to monitor multiple sensors. However, at the moment, each installation can only include one sensor. That shouldn't be too much of a problem because you can achieve multiple tasks with just the one sensor. The sensor is a packet sniffer, which also has the ability to manipulate wireless transmissions in mid-flow. So the sensor acts as the transceiver for the system.

The information gathered by the sensor is forwarded to the server, which is where the magic happens. The server program suite contains the analysis engine that will detect intrusion patterns. Intervention policies to block detected intrusions are also produced at the server. The actions required to protect the network are sent as instructions to the sensor.

The interface module of the system is a dashboard that displays events and alerts to the systems administrator. This is also where settings can be tweaked and defensive actions can be adjusted or overridden.

Samhain, produced by Samhain Design Labs in Germany, is a host-based intrusion detection system that is free to use. It can be run on one single computer or on many hosts, offering centralized data gathering on the events detected by the agents running on each machine.

The tasks performed by each agent include file integrity checking, log file monitoring, and port monitoring. The processes look for rootkit viruses, rogue SUIDs (user access rights), and hidden processes. The system applies encryption to communications between agents and a central controller in multi-host implementations. Connections for the delivery of log file data include authentication requirements, which prevent intruders from hijacking or replacing the monitoring process.

The data gathered by Samhain enables analysis of activities on the network and will highlight warning signs of intrusion. However, it will not block intrusion or clear out rogue processes. You will need to keep backups of your configuration files and user identities in order to resolve the problems that the Samhain monitor reveals.

One problem with hacker and virus intrusion is that the intruder will take steps to hide. This includes killing off monitoring processes. Samhain deploys a stealth technology to keep its processes hidden, thus preventing intruders from manipulating or killing the IDS. This stealth method is called "steganography."

Central log files and configuration backups are signed with a PGP key to prevent tampering by intruders.

Samhain is an open source system that can be downloaded for free. It was designed along POSIX guidelines to make it compatible with Unix, Linux, and Mac OS. The central monitor will aggregate data from disparate operating systems.

Fail2Ban is a free host-based intrusion detection system that focuses on detecting worrisome events recorded in log files, such as excessive failed login attempts. The system sets blocks on IP addresses that display suspicious behavior. These bans usually only last a few minutes, but that can be enough to disrupt a standard automated brute force password cracking scenario. This policy can also be effective against DoS attacks. The actual length of the IP address ban can be adjusted by an administrator.

Fail2Ban is actually an intrusion prevention system because it can take action when suspicious activity is detected and doesn't just record and a highlight possible intrusion.

Therefore, the system administrator has to be careful about access policies when setting up the software because a prevention strategy that is too tight could easily lock out bona fide users. A problem with Fail2Ban is that it focuses on repeated actions from one address. This doesn't give it the ability to cope with distributed password cracking campaigns or DDoS attacks.

Fail2Ban is written in Python and it is able to write to system tables to block out suspicious addresses. These automatic lockouts occur in Netfilter, iptables, PF firewall rules, and the hosts.deny table of TCP Wrapper.

The attack monitoring scope of the system is defined by a series of filters that instruct the IPS on which services to monitor. These include Postfix, Apache, Courier Mail Server, Lighttpd, sshd, vsftpd, and qmail. Each filter is combined with an action to perform in the event of an alert condition being detected. The combination of a filter and an action is called a "jail."

This system is written to the POSIX standard, so it can be installed on Unix, Linux, and Mac OS operating systems.

The hardware requirement of network-based intrusion detection systems may put you off and push you towards a host-based system, which is a lot easier to get up and running. However, don't overlook the fact that you don't need specialized hardware for these systems, just a dedicated host.

In truth, you should be looking at getting both a HIDS and a NIDS for your network. This is because you need to watch out for configuration changes and root access on your computers as well as looking at unusual activities in the traffic flows on your network.

The good news is that all of the systems in our list are free of charge or have free trials, so you could try out a few of them. The user community aspect of these systems may draw you towards one in particular if you already have a colleague that has experience with it. The ability to get tips from other network administrators is a definitive draw to these systems and makes them even more appealing than paid-for solutions with professional Help Desk support.

If your company is in a sector that requires security standard compliance, such as a PCI, then you really are going to need an IDS in place. Also, if you hold personal information on members of the public, your data protection procedures need to be up to scratch to prevent your company being sued for data leakage.

Although it probably takes all of your working day just to keep on top of your network admin in tray, don't put off the decision to install an intrusion detection system. Hopefully, this guide has given you a push in the right direction. If you have any recommendations on your favorite IDS and if you have experience with any of the systems mentioned in this guide, leave a note in the comments section below and share your thoughts with the community.

Comparitech networking guides

Other information on network monitoring

Image: VPN & Internet Security by Mike MacKenzie via Flickr. Licensed under CC BY-SA 2.0

# data[].attributes.attachment_link.title
10 top network intrusion detection tools for 2018

# data[].attributes.attachment_link.description
Virus attacks are no longer the only threats to the integrity of your network. Advanced persistent threats have become the new intrusion method that is grabbing the headlines. Under this scenario, hackers gain access to your network, control logs, and manipulate user records to gain entry whenever they want.

# data[].attributes.body
Just an overview, not suitable for literature review

# data[].attributes.attachment_link.readable_text
What is DoS Attack?

DOS is an attack used to deny legitimate users access to a resource such as accessing a website, network, emails, etc. or making it extremely slow. DoS is the acronym for Denial of S ervice. This type of attack is usually implemented by hitting the target resource such as a web server with too many requests at the same time. This results in the server failing to respond to all the requests. The effect of this can either be crashing the servers or slowing them down.

Cutting off some business from the internet can lead to significant loss of business or money. The internet and computer networks power a lot of businesses. Some organizations such as payment gateways, e-commerce sites entirely depend on the internet to do business.

In this tutorial, we will introduce you to what denial of service attack is, how it is performed and how you can protect against such attacks.

Topics covered in this tutorial

Types of Dos Attacks

There are two types of Dos attacks namely;

DoS- this type of attack is performed by a single host

Distributed DoS- this type of attack is performed by a number of compromised machines that all target the same victim. It floods the network with data packets.

How DoS attacks work

Let's look at how DoS attacks are performed and the techniques used. We will look at five common types of attacks.

Ping of Death

The ping command is usually used to test the availability of a network resource. It works by sending small data packets to the network resource. The ping of death takes advantage of this and sends data packets above the maximum limit (65,536 bytes) that TCP/IP allows. TCP/IP fragmentation breaks the packets into small chunks that are sent to the server. Since the sent data packages are larger than what the server can handle, the server can freeze, reboot, or crash.

Smurf

This type of attack uses large amounts of Internet Control Message Protocol (ICMP) ping traffic target at an Internet Broadcast Address. The reply IP address is spoofed to that of the intended victim. All the replies are sent to the victim instead of the IP used for the pings. Since a single Internet Broadcast Address can support a maximum of 255 hosts, a smurf attack amplifies a single ping 255 times. The effect of this is slowing down the network to a point where it is impossible to use it.

Buffer overflow

A buffer is a temporal storage location in RAM that is used to hold data so that the CPU can manipulate it before writing it back to the disc. Buffers have a size limit. This type of attack loads the buffer with more data that it can hold. This causes the buffer to overflow and corrupt the data it holds. An example of a buffer overflow is sending emails with file names that have 256 characters.

Teardrop

This type of attack uses larger data packets. TCP/IP breaks them into fragments that are assembled on the receiving host. The attacker manipulates the packets as they are sent so that they overlap each other. This can cause the intended victim to crash as it tries to re-assemble the packets.

SYN attack

SYN is a short form for Synchronize. This type of attack takes advantage of the three-way handshake to establish communication using TCP. SYN attack works by flooding the victim with incomplete SYN messages. This causes the victim machine to allocate memory resources that are never used and deny access to legitimate users.

DoS attack tools

The following are some of the tools that can be used to perform DoS attacks.

Nemesy- this tool can be used to generate random packets. It works on windows. This tool can be downloaded from http://packetstormsecurity.com/files/25599/nemesy13.zip.html . Due to the nature of the program, if you have an antivirus, it will most likely be detected as a virus.

Land and LaTierra- this tool can be used for IP spoofing and opening TCP connections

Blast- this tool can be downloaded from http://www.opencomm.co.uk/products/blast/features.php

Panther- this tool can be used to flood a victim's network with UDP packets.

Botnets- these are multitudes of compromised computers on the Internet that can be used to perform a distributed denial of service attack.

DoS Protection: Prevent an attack

An organization can adopt the following policy to protect itself against Denial of Service attacks.

Attacks such as SYN flooding take advantage of bugs in the operating system. Installing security patches can help reduce the chances of such attacks.

Intrusion detection systems can also be used to identify and even stop illegal activities

Firewalls can be used to stop simple DoS attacks by blocking all traffic coming from an attacker by identifying his IP.

Routers can be configured via the Access Control List to limit access to the network and drop suspected illegal traffic.

Hacking Activity: Ping of Death

We will assume you are using Windows for this exercise. We will also assume that you have at least two computers that are on the same network. DOS attacks are illegal on networks that you are not authorized to do so. This is why you will need to setup your own network for this exercise.

Open the command prompt on the target computer

Enter the command ipconfig. You will get results similar to the ones shown below

For this example, we are using Mobile Broadband connection details. Take note of the IP address. Note: for this example to be more effective, and you must use a LAN network.

Switch to the computer that you want to use for the attack and open the command prompt

We will ping our victim computer with infinite data packets of 65500

Enter the following command

ping 10.128.131.108 -t |65500

HERE,

"ping" sends the data packets to the victim

"10.128.131.108" is the IP address of the victim

"-t" means the data packets should be sent until the program is stopped

"-l" specifies the data load to be sent to the victim

You will get results similar to the ones shown below

Flooding the target computer with data packets doesn't have much effect on the victim. In order for the attack to be more effective, you should attack the target computer with pings from more than one computer.

The above attack can be used to attacker routers, web servers etc.

If you want to see the effects of the attack on the target computer, you can open the task manager and view the network activities.

Right click on the taskbar

Select start task manager

Click on the network tab

You will get results similar to the following

If the attack is successful, you should be able to see increased network activities.

Hacking Activity: Launch a DOS attack

In this practical scenario, we are going to use Nemesy to generate data packets and flood the target computer, router or server.

As stated above, Nemesy will be detected as an illegal program by your anti-virus. You will have to disable the anti-virus for this exercise.

Enter the target IP address, in this example; we have used the target IP we used in the above example.

HERE,

0 as the number of packets means infinity. You can set it to the desired number if you do not want to send, infinity data packets

The size field specifies the data bytes to be sent and the delay specifies the time interval in milliseconds.

Click on send button

You should be able to see the following results

The title bar will show you the number of packets sent

Click on halt button to stop the program from sending data packets.

You can monitor the task manager of the target computer to see the network activities.

Summary

A denial of service attack's intent is to deny legitimate users access to a resource such as a network, server etc.

There are two types of attacks, denial of service and distributed denial of service.

A denial of service attack can be carried out using SYN Flooding, Ping of Death, Teardrop, Smurf or buffer overflow

Security patches for operating systems, router configuration, firewalls and intrusion detection systems can be used to protect against denial of service attacks.

# data[].attributes.attachment_link.title
DoS (Denial of Service) Attack Tutorial: Ping of Death, DDOS

# data[].attributes.attachment_link.description
DOS is an attack used to deny legitimate users access to a resource such as accessing a website, network, emails, etc. or making it extremely slow. DoS is the acronym for Denial of S ervice. This type of attack is usually implemented by hitting the target resource such as a web server with too many requests at the same time.

# data[].attributes.body
How to write the methodology

# data[].attributes.attachment_link.title
Writing your dissertation methodology | Oxbridge Essays

# data[].attributes.attachment_link.description
Your dissertation methodology provides a detailed account of both how you’ll approach your dissertation and why you’ve decided to approach it in this way.