1.0 INTRODUCTION:

Mobile ad-hoc networks are expected to be widely used in the near future. However, they are vulnerable to various security issues because of their dynamic characteristics. In view of the increasing demand for wireless information and data services, providing faster and reliable mobile access is becoming an important concern [1]. Nowadays, not only mobile phones, but also laptops and PDAs are used by people in their professional and private lives. These devices are used separately, for the most part, that is their applications do not interact. Sometimes, however, a group of mobile devices form a spontaneous, temporary network as they move closer. This allows us to share information in the form of documents, presentations even when we are on the move or in a meeting [2]. This kind of spontaneous, temporary network referred to as mobile ad-hoc networks (MANETs) sometimes just called ad-hoc networks or multi-hop wireless networks [3].

A mobile ad hoc network (MANET) is a spontaneous network that can be established without any fixed infra- structure or a topology. This means that all its nodes behave as routers and take part in its discovery and maintenance of routes, i.e. nodes within each other’s radio range communicate directly via wireless links, while those that are not in each other’s radio range use other nodes as relays. Its routing protocol has to be able to manage with the brand new difficulties that an ad-hoc network creates such as nodes' mobility, limited power supply, quality of service, bandwidth issues, changing topology and security issues. These challenges set brand new requirements on MANET routing protocols and makes them more vulnerable to attacks [2].

Active Attack is an attack when an attacker node has to bear some energy costs in order to perform the threat. Nodes that perform active attacks with the aim of causing harm to other nodes by causing network outages are considered as malicious. Passive Attacks are mainly with the purpose of saving energy selfishly. Nodes that cause passive attacks with the aim of saving battery life for their own communications are considered to be selfish.

Various types of attacks in MANETs are: Modification, Impersonation, Fabrication, Eavesdropping, Replay, Denial of Service, Malicious Software, Lack of Cooperation, Denial of Service attack, and distributed denial of service attack. A number of proposals have been given by different researchers to handle these attacks but none crossed the benchmark because of dynamic characteristics of the MANET. A perfect solution needs to be proposed to handle the attacks and prevent the sensitive data of the user from mishandling. The most ad-hoc routing protocols are vulnerable to two categories, called external attacks and internal attacks. Internal attacks are initiated and executed by authorized node in the network, whereas external attacks are performed by the node that they are not authorized to participate in the network. Ad-hoc networks have a wide array of military and commercial applications. They are ideal in situations where installing an infrastructure network is impossible or when the purpose of the network is too transient or even because the previous infrastructure net- work was destroyed. Because of its ad-hoc infrastructure, decentralized and dynamic topology, loopholes such as limited bandwidth, limited memory and limited battery power, it is very hard to achieve security. There are many solutions exist, which cope with against loopholes and provide security up to a certain level in the wired network, but these solutions are not always suitable for wireless environment. Therefore, ad-hoc network has its own issues and challenge over security, which cannot be tackled by the available wired security mechanism.

In MANETs, all the participating nodes are involved in the routing process. Since conventional, routing protocols are designed for predefined infrastructure networks, which cannot be used in mobile ad-hoc networks, so the new classes of routing protocol, i.e. ad-hoc routing protocols were designed to accomplish the requirement of less infrastructure ad-hoc network. In comparison to be guided and unguided media, most of the traditional applications do not provide user level security schemes based on the fact that physical network wiring provides some level of security. The routing protocol sets the up- per limit to security in any packet network. If routing is misdirected, the entire network will be paralyzed. This problem makes ad-hoc networks more complex as the routing usually needs to trust on the trustworthiness of all nodes that are participating in the routing process [3].

The work by Spamhaus’s believed to have launched the massive DDoS, attack to bring down to bring down the anti-spam group. The attackers sent a series of data requests to DNS server, which help to direct web traffic around the world. After receiving legitimate requests (as these servers are accessed by authorized users), the servers responded by sending the required data to Spamhaus, which could not deal with the information that suddenly arrived. The attack was so large that it began clogging up the DNS servers, which in turn slowed down the Internet worldwide. The congestion was so heavy that it over- whelmed the DNS routers [4]. A flood of the request to view a site at the same time will exceed its capacity-stopping it from loading. Spamhaus greater capacity turning to CloudFlare, spread traffic over larger bandwidth. However, the attackers began targeting their attacks, so they would be concentrated. Hence, the connection slowed down. Recent wireless research indicates that the wireless MANET presents a larger security problem than conventional wired and wireless networks. Distributed Denial of Service (DDoS) attacks has also become a problem for users of computer systems connected to the Internet. A DDoS attack is a distributed, large-scale attempt by malicious users to flood the victim network with an enormous number of packets. This exhausts the victim net- work of resources such as bandwidth, computing power, etc. The victim is unable to provide services to its legitimate clients and network performance is greatly deteriorated [5]. Khan et al. [6] and Zhou et al. [9] give overview of challenges of DoS attack on MANET. Bin et al. [7] demonstrated how Distributed DoS (DDoS) attacks can be detected at an early stage. Chen et al. [8] explained Statefull DDoS attacks and targeted filtering. Siris et al. [10] and Abraham et al. [11] have proposed a method of defence against DDoS attack by using provider based deterministic packet marking and IP spoofing defence. Here, we are discussing two types of DDoS attacks i.e. Malicious Packet Dropping based DDoS attack and flooding Based DDoS attack [16]. The Malicious Packet Dropping based DDoS attack has the aim of attacking the victim node in order to drop some or all of the data packets sent to it for further forwarding even when no congestion occurs. The second type of DDoS attack is based on a huge volume of attack traffic, which is known as a Flooding-based DDoS attack. A flooding-based DDoS attack attempts to congest the victim's network bandwidth with real-looking but unwanted IP data. As a result, legitimate IP packets cannot reach the victim due to a lack of bandwidth resource. In this paper, we compare two DDoS based attacks and propose a technique to prevent Flooding based DDoS attack.

The rest of the paper is organized as follows: Section 2 describes related work; Section 3 presents Overview of DDoS attacks; Section 4 discusses the Overview of DDoS attack mechanisms in MANET; Section 5 describes the proposed prevention method blocking IP broadcast method; Section 6 presents the experimental setup to measure network performance; Section 7 discusses the result and Section 8 Concludes the paper and gives the future work.

2.0 RELATED WORK

Lu Han [12] describes that the wireless ad-hoc networks were first unfolded in 1990s. Mobile ad-hoc networks have been widely researched for many years. Mobile ad hoc networks are collection of two or more devices equipped with wireless communications and networking capability The Wireless ad hoc Networks do not have a gateway rather every node can act as the gateway. Although, lots of research is done in this field, but the question is often raised, whether the architecture of mobile ad-hoc networks is a fundamental flawed architecture.

Antonio Challita, Mona El Hassan, Sabine Maalouf and Adel Zouheiry [13] describe different types of DDoS attacks, present recent DDoS defense methods as published in technical papers, and propose a novel approach to counter DDoS. Based on common defense principles and taking into account the different types of DDoS attacks, this paper survey defense methods and classify them according to several criteria. This paper proposes a simple-to-integrate DDoS victim based defense method, Packet Funneling, which aims at mitigating an attack’s effect on the victim. In this approach, heavy traffic is funnelled before being passed to its destination node, thus preventing congestion at the nodes access link and keeping the node on-line. This method is simple to integrate, requires no collaboration between nodes, introduces no overhead, and adds slight delays only in case of heavy network loads. The proposed packet funneling approach promises to be a suitable means of coping with DDoS traffic, with easy integration at minimal cost

In Framework for Statistical Filtering against DDoS Attacks in MANETs Hwee-Xian Tan and Winston K. G. Seah [14] describes that A DDoS attack is a distributed, large-scale attempt by malicious users to flood the victim network with an enormous number of packets. This exhausts the victim network of resources such as bandwidth, computing power, etc. The victim is unable to provide services to its legitimate clients and network performance is greatly deteriorated. There are many proposed methods in the literature which aim to alleviate this problem; such as hop-count filtering, rate-limiting and statistical filtering. However, most of these solutions are meant for the wired Internet, and there is little research efforts on mechanisms against DDoS attacks in wireless networks such as MANETs. This paper gives information about the vulnerability of MANETs to DDoS attacks and provide an overview of statistical filtering, which is commonly used as a security mechanism against DDoS attacks in wired networks and then propose a framework for statistical filtering in MANETs to combat DDoS attacks. This paper also simulates some DDoS attacks in MANETs without any filtering mechanisms to explore and understand the effects of such attacks on the performance of the network.

In Defeating Distributed Denial of Service Attacks Xianjun Geng and Andrew B. Whinston [15] describes that the notorious, crippling attack on e-commerce top companies in February 2000 and the recurring evidence of active network scanning a sign of attackers looking for network weaknesses all over the Internet are harbingers of future Distributed Denial of Service (DDoS) attacks. They signify the continued dissemination of the evil daemon programs that are likely to lead to repeated DDoS attacks in the foreseeable future. This paper gives information about network weaknesses that DDoS attacks exploit the technological futility of addressing the problem solely at the local level, potential global solutions, and why global solutions require an economic incentive framework.

On the effectiveness of DDoS Attacks on Statistical Filtering Qiming Li, Ee-Chien Chang and Mun Choon Chan [17], describes that Distributed Denial of Service (DDoS) attacks pose a serious threat to service availability of the victim network by severely degrading its performance. There has been significant interest in the use of statistical-based filtering to defend against and mitigate the effect of DDoS attacks. Under this approach, packet statistics are monitored to classify normal and abnormal behaviour. Under attack, packets that are classified as abnormal are dropped by the filter that guards the victim network. This paper gives the effectiveness of DDoS attacks on such statistical-based filtering in a general context where the attackers are “smart”. We first give an optimal policy for the filter when the statistical behaviours of both the attackers and the filter are static. Next, this paper considers cases where both the attacker and the filter can dynamically change their behavior, possibly depending on the perceived behavior of the other party. This paper observes that while an adaptive filter can effectively defend against a static attacker, the filter can perform much worse if the attacker is more dynamic than perceived.

Kamanshis Biswas [18] mentioned that Mobile Ad Hoc Network (MANET) was a collection of communicating devices or nodes that wish to communicate without any fixed infrastructure. The nodes in MANET themselves are responsible for dynamically finding out other nodes in the network to communicate. Although an ad-hoc network is used for commercial uses due to their certain unique characteristics, but the main challenge is the vulnerability to security attacks. A number of challenges like dynamic network topology, stringent resource constraints, shared wireless medium, open peer-to-peer net-work architecture, etc., are posed in MANET. As MANET is widely spread for the property of its Capability in forming temporary network without any fixed infrastructure or centralized topology, security challenges have become a leading concern to provide secure communication.

Andrim Piskozub [19] gives principal types of DoS attacks, which flood victim’s communication channel band- width, is carried out their analysis and are offered methods of protection from these attacks. The DDoS attacks are considerably more effective than their DoS counter parts because they allow performing such attacks simultaneously from several sites that make this attack more efficient and complicate searches of an attacker. The attacker uses the client program, which, in turn, interacts with the handler program. The handler sends commands to the agents, which perform actual DoS attacks against an indicated system-victim. This paper also describes various countermeasures that should be taken to prevent the net- work from DDoS attack.

Xianjun Geng [20] describe that the notorious, crippling attack on e-commerce’s top companies in February 2000 and the recurring evidence of active network scanning, a sign of attackers looking for network weaknesses all over the Internet, are harbingers of future Distributed Denial of Service (DDoS) attacks. They signify the continued dissemination of the evil daemon programs that are likely to lead to repeated DDoS attacks in the foreseeable future. This paper gives information about the weaknesses in the network that DDoS attacks exploit the technological futility of addressing the problem solely at the local level.

Vicky Laurens et al [21], describe that due to financial losses caused by Distributed Denial of Service (DDoS) attacks; most defense mechanisms have been deployed at the network where the target server is located. This paper believes that this paradigm should change in order to tackle the DDoS threat in its basis: thwart agent machine's participation in DDoS attacks. Paper consists of developing an agent to monitor the packet traffic rate (outgoing packets/incoming packets). The deployment is based upon characterizing TCP connections; normal TCP connections can be characterized by the ratio of the sent packets to the received packets from a given destination. The result shows that the traffic ratio values usually give larger values at the beginning of the run when there are not enough packets to make a decision that whether or not the traffic is legitimate. A low value for threshold allows for faster detection of attack, but also increases the false-positives.

Stephen M. Specht [2] describes that Distributed Denial of Service (DDoS) attacks has become a large problem for the systems connected to the Internet. DDoS attackers take control over secondary victim systems and use them to launch a coordinated large-scale attack against primary victim systems. As a result of fresh counter measures that are developed to prevent or mitigate DDoS attacks, attackers are constantly developing brand new methods to cheat on these unused countermeasures. This paper also gives us information about DDoS attack models and proposed taxonomies to characterize the DDoS attacks, the software attacking tools used, and the possible countermeasures those are available. The taxonomy shows the similarities and patterns in different DDoS attacks, including new derivative attacks. It is essential, that as the Internet and Internet usage expand, more comprehensive solutions and countermeasures to DDoS attacks be developed, verified, and implemented more effectively and precisely. Thus, this paper describes that DDoS attacks make a networked system or service unavailable to legitimate users. These attacks are an annoyance at a minimum, or can be seriously damaging if a critical system is the primary victim. Loss of network resources causes economic loss, work delays, and loss of communication between network users. Solutions must be developed to prevent these DDoS attacks.

Qiming Li [17] mentions that Distributed Denial of Service (DDoS) attacks posed a serious threat to service availability of the victim network by severely degrading its performance. There has been significant interest in the use of statistical-based filtering to defend against and mitigate the effect of DDoS attacks. Under this approach, packet census is monitored to classify normal and unusual behavior. Under attack, packets that are classified as unusual are dropped by the filter that guards the victim network. This paper gives the effectiveness of DDoS attacks on such statistical-based filtering in a general context where the attackers are smart. They first give an optimal policy for the filter when the statistical behaviors of both the attackers and the filter are static. Next, this paper considers cases where both the attacker and the filter can dynamically change their behavior, possibly depending on the perceived behavior of the other party.

Antonio Challita [13] describes different types of DDoS attacks, present recent DDoS defense methods and proposed a unique approach to handle DDoS attack. Based on common defense principles and taking into account a number of DDoS attacks, the author finds out many defense methods and categorizes them according to a number of criteria. This paper proposes a simple-to integrate DDoS victim based defense method, Packet Funneling, whose main aim is to mitigate the effect of attack on the victim. In this approach, massive traffic is checked before being passed to its destination node, thus preventing congestion in the network. This method is simple to integrate, requires no association between nodes, causes no overhead, and adds delays only in case of massive network loads. The proposed packet funnelling approach promises to be a suitable means of coping with DDoS traffic, with easy integration at lesser cost.

Malicious flooding attacks are the lethal attacks on mobile ad-hoc networks. These attacks can severely occlude an entire network. To defend against these at- tacks, the authors propose a novel defense mechanism in mobile ad-hoc networks. The proposed scheme increases the number of legitimate packet processing at each node and thus improves the end-to-end packet delivery ratio.

From the above literature survey, it is being concluded that the most of the works carried out in DDoS defense has concentrated either individually on Prevention or Detection. So there is no technique where integration of these approaches is available. So a technique is proposed that can prevent a specific kind of DDoS attack i.e. flood attack which Disable IP Broadcast and using NS-2 Simulator the experimental setup parameters shows that the proposed prevention technique is much efficient than the existing techniques to prevent against the DDoS attacks.

3.0 OVERVIEW OF DDoS ATTACKS

A DDoS (Distributed Denial-Of-Service) attack is a distributed, large-scale attempt by malicious users to flood the victim network with an enormous number of packets. This exhausts the victim network of resources such as bandwidth, computing power, etc. The victim is unable to provide services to its legitimate clients and network performance is greatly deteriorated. The distributed format adds the “many to one” dimension that makes these attacks more difficult to prevent. A distributed denial of service attack is composed of four elements, as shown in Figure 1. First, it involves a victim, i.e., the target host that has been chosen to receive the brunt of the attack. Second, it involves the presence of the attack daemon agents. These are agent programs that actually conduct the attack on the target victim. Attack daemons are usually deployed in host computers. These daemons affect both the target and the host computers. The task of deploying these attack daemons requires the attacker to gain access and infiltrate the host computers. The third component of a distributed denial of service attack is the control master program. Its task is to coordinate the attack. Finally, there is the real attacker, the mastermind behind the attack. By using a control master program, the real attacker can stay behind the scenes of the attack. The following steps involved during a distributed attack:

1. The real attacker sends an “execute” message to the control master program.

2. The control master program receives the “execute” message and propagates the command to the attack daemons under its control.

3. Upon receiving the attack command, the attack daemons begin the attack on the victim.

A distributed denial of service attack is composed of four elements. First, it involves a victim, i.e., the target host who has been chosen to receive the brunt of the attack. Second, it involves the presence of the attack daemon agents. These are agent programs that actually conduct the attack on the target victim. Attack agents are usually installed on host computers. These attacker agents or the secondary victims affect both the target and the host computers [22-25]. The task of deploying these attack daemons requires the attacker to gain access and infiltrate the host computers. The third component of a distributed denial of service attack is the control master program.

Its task is to coordinate the attack. Finally, there is the actual attacker, the mastermind behind the attack.

By using a control master program, the actual attacker can stay behind the scene of the attack. The DDoS attack components and procedures are shown in Figure 1. The follo wing steps take place during a distributed attack [2, 19]: The real attacker sends an ‘execute’ message to the control master program. The control master program receives the ‘execute’ message and propagates the command to the attack daemons

under its control. Upon receiving the attack command, the agent machines begin the attack on the victim.

3.1. Distributed Cooperative Architecture of DDoS Attacks

Before real attack traffic reaches the victim; the attacker must communicate with all its DDoS agents. Therefore, there must be control channels present in between the agent machines and the attacker machine. This cooperation between the two requires all agents to send traffic based on the commands received from the attacker. The attack network consists of the three components: attacker, agents, and control channels. In attack, networks are divided into three types: the agent-handle model, the Internet Relay Chat (IRC) based model and the reflector model [25, 26].

The agent-handler model consists of three components: attacker, handlers, and agents. Figure 2 illustrates the typical architecture of the agent handler model. The main attacker sends control messages to the previously compromised agents through a number of handlers, guiding them to produce unwanted traffic to send it to the victim [2]. The only difference between the architecture of IRC- based model, and the agent-handler model is in the former case. An IRC communication channel is used to connect the main attacker to agent machines [27], which is shown in Figure 3.

In the attack network architecture of the reflector model, the reflector layer creates a major difference from the basic DDoS attack architecture. In the request messages, the agents change the source address field in the IP header to the victim’s address and thus replace the real agents' addresses. Then, the reflectors will in turn generate response messages to the victim. As a result, the flooding traffic that finally reaches the victim computer or the victim network is not from a few hundred agents, but from a million reflectors. An exceedingly diffused reflector based DDoS attack raises the bar for tracing out the real attacker by hiding the attacker behind a large number of reflectors [28,29].

3.2. DDoS Attack Taxonomy

There is a wide variety of DDoS attacks [2]. There are two types of DDoS attacks, they are: Active and passive attack. Packet dropping is a type of passive attack in which node drops some or all of data packets sent to it for further forwarding even when no congestion occurs. There are two main classes of DDoS attacks: bandwidth depletion and resource depletion attacks. The classification of various DDoS attacks is shown in the Figure 4.

3.2. DDoS Attack Taxonomy

Figure 1 DDoS Attack Components

Figure 2 Typical DDoS Architecture (The Agent Handler Model)

Figure 3 Architecture of IRC based DDoS attack

3.2.1. Bandwidth Depletion Attacks

A Bandwidth Depletion Attack is designed to flood the victim network with unwanted traffic that prevents legitimate traffic from reaching the primary victim. Bandwidth depletion attacks can be characterized as flood attacks and amplification attacks [30-32].

i.Flood Attack

In a flood attack, zombies send a large volume of traffic to a victim's system, to congest the victim systems network bandwidth with IP traffic. The victim systems slow down, crashes, or suffer from saturated network bandwidth, thereby preventing access by an authorized user. Flood attacks can be launched using both UDP (User Datagram Protocol) and ICMP (Internet Control Message Protocol) packets [30].

In a UDP Flood attack, a large number of UDP packets are sent to either random or specified ports on the victim system. The victim system tries to process the incoming data to determine which applications have re- quested data. If the victim system is not having any applications on the targeted port, it will send an ICMP packet to the sending system indicating a ‘destination port unreachable’ message [33].

Often, the attacking DDoS tool will also spoof the source IP address of the attacking packets. This helps the secondary victims in hiding their identity since return packets from the victim system are not sent back to the zombies, but are sent back to the spoofed addresses. UDP flood attacks may also fill the bandwidth of connections located on the victim system.

An ICMP flood attack is initiated when the zombies send a huge number of ICMP_ECHO_REPLY packets (“ping”) to the victim system. These packets flag the victim system to reply to this message, and the combination of traffic saturates the bandwidth of the victim’s network connection. During this attack, the source IP address of the ICMP packet may also be spoofed. [31,33]

ii. Amplification Attacks

In amplification attack the attacker or the zombies send messages to a broadcast IP address, using this to cause all systems in the subnet reached by the broadcast address to send a reply to the victim system. The broadcast IP address feature is found on most routers; when a sending system specifies a broadcast IP address as the destination address, the routers replicate to send the broadcast message directly, or use the agents to send the broadcast message to increase the volume of attacking traffic. If the attacker decides to send the broadcasting message directly, this attack helps the attacker with the ability to use the systems within the broadcast network as zombies without any need to install any agent software [2]. A DDoS Smurf attack is a type of an amplification attack where the attacker sends packets to a network amplifier, with the return address changed to the victim’s IP address.

3.2.2. Resource Depletion Attacks

A Resource Depletion Attack is an attack that is designed to tie up the resources of a victim's system making the victim unable to process legitimate requests for service. DDoS resource depletion attacks involve the attacker sending packets that misuse network protocol communications or are malformed. Network resources are tied up so that none are left for legitimate users [34, 35].

a) Protocol exploits Attacks

We give two examples, one misusing the TCP SYN (Transfer Control Protocol Synchronize) protocol, and the other misusing the PUSH + ACK protocol.

In a DDoS TCP SYN attack, the attacker gives instructions the zombies to send tons of TCP SYN requests to a victim server to tie up the server’s processor re- sources, and hence prevent the server from responding to the requests from legitimate users. The TCP SYN attack exploits the three-way handshake between the sending machine and the receiving machine by sending a huge number of TCP SYN packets to the victim system with changed source IP addresses, so the victim system responds to a non requesting system with the ACK + SYN. When a large volume of SYN requests is being processed by a server and none of the ACK + SYN responses are returned. The server eventually runs out of the computing resources such as the processor and memory resources, and is unable to respond to legitimate users [36].

In a PUSH + ACK attack, the attacking agents send TCP packets with the PUSH and ACK bits set to one. These trigger in the TCP packet header instruct the victim system to unload all data in the TCP buffer and send an acknowledgement message when complete. If this process is repeated with a number of agent machines, the receiving system cannot process the large volume of in- coming packets, and the victim system will eventually crash.

b) Malformed Packet Attacks

A malformed packet attack is an attack where the attacker instructs the zombies to send incorrectly formed IP packets to the victim system in order to crash it. There are at least two types of malformed packet attacks [2, 37].

In an IP address attack, the packet contains the same source and destination IP addresses. This can confuse the victim system and can cause it to crash. In an IP packet option's attack, a malformed packet may randomize the optional fields within an IP packet and set all quality of service bits to one so that the victim system must use additional processing time to analyze the traffic. If this attack is multiplied, it can exhaust the processing ability of the victim system. [2]

4.0 OVERVIEW OF DDoS ATTACK MECHANISMS IN MOBILE AD-HOC NETWORK (MANET)

4.1 DDoS Attack Mechanisms

As one of the major security problems in the current Internet, a denial-of-service (DoS) attack always attempts to prevent the victim from serving legitimate users. A distributed denial-of-service (DDoS) attack is a DoS attack which relies on multiple compromised hosts in the network to attack the victim. There are two types of DDoS attacks. The First type of DDoS attack aims at attacking the victim node to drop some or all the data packets for further forwarding even when there is no congestion in the network, is known as Malicious Packet Dropping-based DDoS attack [30]. The second type of DDoS attack is based on a huge volume of attack traffic, which is known as a Flooding-based DDoS attack [31]. A flooding-based DDoS attack tries to clog the victim’s network bandwidth and other resources with real-looking but unwanted IP data. As a result of which, the legitimate IP packets cannot reach their destination node.

To amplify the effects and hide real attackers, DDoS attacks can be run in two different distributed and parallel ways. In the first one, the attacker compromises a number of agents and manipulates the agents to send attack traffic to the victim node. The second method makes it even more difficult to determine the attack sources because it uses reflectors. For example, a Web server can be reflector because it will return an HTTP response packet after receiving an HTTP request packet. The attacker sends request packets to servers and fakes victim’s address as the source address. Therefore, the servers will send back the response packets to the real victim. If the number of reflectors is large enough, the victim network will suffer exceptional traffic congestion [32].

4.2 Issues in DDoS Attacks

DDoS attack is an attempt to make a computer resource inaccessible to its legitimate users.

i.The bandwidth of the Internet and an LAN may be consumed unwontedly by DDoS, by which not only the intended computer, but also the entire network suffers.

ii.Slow network performance (opening files or accessing web sites) due to DDoS attacks.

iii.Unavailability and inability to access a particular web site due to DDoS attacks.

iv.Gradual increase in the number of fake emails received due to DDoS attacks.

4.3 Security issues in MANET

We know that a Mobile Ad Hoc Network (MANET) is a collection of communication devices or nodes that wish to communicate without any fixed infrastructure and predetermined organization of available links. The nodes in MANET themselves are responsible for dynamically discovering other nodes to communicate. Now-a-days, Mobile ad hoc network (MANET) is one of the recent active fields and has received marvelous attention because of their self-configuration and self-maintenance capabilities. While early research effort assumed a friendly and cooperative environment and focused on problems such as wireless channel access and multi-hop routing, security has become a primary concern in order to provide protected communication between nodes in a potentially hostile environment. Recent wireless research indicates that the wireless MANET presents a larger security problem than conventional wired and wireless networks.

A mobile ad-hoc network (MANET) consists of a number of mobile hosts to carry out its basic functions like packet forwarding, routing, and service discovery without the help of an established infrastructure. Each node of an ad-hoc network depends on another node in for- warding a packet to its destination, because of the limited range of each mobile host’s wireless transmissions. An ad-hoc network uses no centralized administration. This ensures that the network will not stop its functioning just because one of the mobile nodes moves out of the range of the others. Because of the limited transmitter range of the nodes, multiple hops need to cooperate to reach other nodes. Every node in an ad-hoc network must be willing to forward packets to other nodes. Thus, every node acts both as a host and as a router. The topology of ad-hoc networks varies with time as nodes move in and out of the network. This topological instability requires a routing protocol to run on each node to create and maintain routes between the nodes [33].

Mobile Ad-hoc Networks’ Usages: Wireless ad-hoc networks are mainly used in areas where a wired network infrastructure cannot fit in due to reasons such as cost or convenience. It can be very quickly deployed to support emergency requirements, connectivity on the go, short- term needs, and coverage in undeveloped areas. Any day-to-day application such as electronic email and file transfer can be considered to be easily deployable within an ad-hoc network environment.

In addition to this, there is no need to focus on the wide range of warlike applications possible with ad-hoc networks. Even the technology was initially developed for the warlike applications. In such situations, the ad-hoc networks having self-organizing capability can be efficiently used where other technologies either fail or cannot be deployed efficiently. Some well-known ad-hoc network applications are:

Collaborative Work: For some business environments, the need for collaborative computing is sometimes more important outside office environments than inside. Moreover, it is often the case where people really need to have meetings to cooperate and exchange information on a project.

Crisis-Management Applications: These arise as a result of natural disasters where the entire communications infrastructure is disordered and restoring communications quickly is essential. By using ad-hoc networks, it becomes easy and quick to establish a communication channel than required for wired communications.

Personal Area Networking and Bluetooth: A personal area network (PAN) is a short-range, localized net- work where nodes are usually associated with some- one. These nodes could be attached to a pulse watch, belt, and so on. In such scenarios, mobility is only a major consideration when interaction among several PANs is the main issue.

For analyzing the security of wireless mobile ad-hoc networks, we need certain parameters. The basic parameters for a secure system are:

1. Availability

2. Confidentiality

3. Authentication

4. Integrity

5. Non-repudiation

6. Scalability

4.4 Challenges in MANET’S

MANETs face challenges in secure communication. For example the resource constraints on nodes in ad hoc networks limit the cryptographic measures that are used for secure messages. Thus it is susceptible to link attacks ranging from passive eavesdropping to active impersonation, message replay and message distortion. Mobile nodes without adequate protection are easy to compromise. An attacker can listen, modify and attempt to masquerade all the traffic on the wireless communication channel as one of the legitimate node in the network. Static configuration may not be adequate for the dynamically changing topology in terms of security solution. Various attacks like DoS (Denial of Service) can easily be launched and flood the network with spurious routing messages through a malicious node that gives incorrect updating information by pretending to be a legitimate change of routing information. Lack of cooperation and constrained capability is common in wireless MANET which makes anomalies hard to distinguish from normalcy. In general, the wireless MANET is particularly vulnerable due to its fundamental characteristics of open medium, dynamic topology, and absence of central authorities, distribution cooperation and constrained capability.

4.5 MANET Usage and Characteristics

Dynamic topologies: Nodes are free to move anywhere in the network. Thus, the network topology changes randomly and rapidly at unpredictable times, which is the main characteristic of an MANET.

Bandwidth-constrained variable capacity links: Wireless links will continue to have considerably lower capacity than their hardwired counterparts. In addition, the actual throughput of wireless communications, after calculating for the effects of multiple accesses, multipath routing, noise, and interference conditions, is lesser than a radio’s maximum transmission rate.

Energy-constrained operation: The nodes in an MANET may depend on batteries or other exhaustible means for their energy. For these nodes, an important optimization criteria system design may be energy saving.

Security: Mobile wireless networks are highly prone to physical security threats because of its hop by hop routing, multipath routing and dynamically changing topology. Therefore, an increase in the possibility of different attacks should be carefully considered.

4.6 Security attacks in MANET

The security attacks in MANETs can be categorized as active attacks and passive attacks. Active attack is an attack when misbehaving node has to bear some energy costs in order to perform the threat. On the other hand, passive attacks are mainly due to lack of cooperation with the purpose of saving energy selfishly. Nodes that perform active attacks with the aim of damaging other nodes by causing network outage are considered as malicious while nodes that make passive attacks with the aim of saving battery life for their own communications are considered to be selfish. Various types of attacks in MANETs are: Modification, Impersonation, Fabrication, Eavesdropping, Replay, Denial of Service, Malicious Software and Lack of Cooperation. Denial of Service attack is described below. Network Protocol Stack Based Attack Classification Attacks could also be classified according to the target layer in the protocol stack Security is an important issue for ad-hoc networks, especially for the more security sensitive applications used in military and critical networks.

An ad-hoc network can be considered secure if it holds the following attributes: 1. Availability: It ensures that the network manages to provide all services despite denial of service attacks. A denial of service attack can be launched at any layer of an ad-hoc network. On the physical and media access control layer a malicious user can employ jamming in order to interfere with signals in the physical layer. On the network layer, a malicious user can disrupt the normal operation of the routing table in various ways that are presented in a following section. Lastly, on the higher layer, a malicious user can bring down high-level services such as the key management service.

2. Confidentiality: It ensures that certain information is never disclosed to unauthorized users. This attribute is mostly desired when transmitting sensitive information such as military and tactical data. Routing information must also be confidential in some cases when the user’s location must be kept secret.

3. Integrity: Guarantees that the message that is transmitted reaches its destination without being changed or corrupted in any way. Message corruption can be caused by either a malicious attack on the network or because of radio propagation failure.

4. Authentication: It enables a node to be sure of the identity of the peer with which it communicates. When there is no authentication scheme, a node can masquerade as some other node and gain unauthorized access to resources or sensitive information.

5. Non-repudiation: It ensures that the originator of a message cannot refuse to send this message. This attribute is useful when trying to detect isolated compromised nodes.

4.7 Overview of MANET Routing Protocols

The routing protocols in ad-hoc networks may be categorized as proactive routing protocols, reactive routing protocols, and hybrid routing protocols [35]. Proactive Routing Protocols are those protocols, in which the routes are maintained to all the nodes, including those nodes to which packets are not sent. An example of proactive routing protocols in ad-hoc networks is Optimized Link State Routing Protocol (OLSR). Reactive Routing Protocols are those protocols in which the route between the two nodes is constructed only when the communication occurs between the two nodes. Such type of routing protocols is Ad hoc On Demand Distance Vector Routing Protocol (AODV) and Dynamic Source Routing Protocol (DSR) [36]. Hybrid Routing Protocols are those protocols in which the combined approach of proactive routing and reactive routing are used for the route generation between the nodes. The Zone Routing Protocol (ZRP) is such a hybrid reactive/proactive routing protocols.

4.7.1. Degrade the Performance in Lifetime of MANET

The following metrics can be used to evaluate the performance of flooding attack:

1. Packet loss rate: The ratio of the number of packets dropped by the nodes divided by the number of packets originated by the application layer continuous bit rate (CBR) sources. The packet loss ratio is important as it describes the loss rate that can be seen by the transport protocols, which in turn affects the maxi- mum throughput that the network can support. The metric characterizes both the completeness and correctness of the routing protocol.

2. Average delay: Average of delay incurred by all the packets, which are successfully transmitted.

3. Throughput: Average number of packets per second Χ packet size.

4. Average number of hops: complete length of all routes divided by the total number of routes.

4.8 Various Defense Mechanisms

The different defense mechanisms for DDoS attacks are classified into two categories: local and global. As the name suggests, local solutions can be implemented on the victim computer or its local network without an outsider’s cooperation. Global solutions, by their very nature, require the cooperation of several Internet subnets, which typically cross company boundaries.

4.8.1 Local Solutions

Protection for individual computers falls into three areas:

1. Local Filtering

The timeworn short-term solution is to try to stop the infiltrating IP packets on the local router by installing a filter to detect them. The stumbling block to his solution is that if an attack jams the victim’s local network with enough traffic, it also overwhelms the local router, overloading the filtering software and rendering it inoperable.

2. Changing IPs

A Band-Aid solution to a DDoS attack is to change the victim computer’s IP address, thereby invalidating the old address. This action still leaves the computer vulnerable because the attacker can launch the attack at the new IP address. This option is practical because the current type of DDoS attack is based on IP addresses. System administrators must make a series of changes to domain name service entries, routing table entries, and so on to lead traffic to the new IP address. Once the IP change which takes some time is completed, all Internet routers will have been informed, and edge routers will drop the attacking packets.

3. Creating Client Bottlenecks

The objective behind this approach is to create bottleneck processes on the zombie computers, limiting their attacking ability. Examples of this approach include RSA Security Corp. Client Puzzles: RSA‟s Client Puzzles algorithm requires the attacking computer to correctly solve a small puzzle before establishing a connection. Solving the puzzle consumes some computational power, limiting the attacker in the number of connection requests it can make at the same time. Turing test: Software implementing this approach requires the attacking computer to answer a random question before establishing the connection. The question should be easy for humans to answer but not computers for example, “Which film won the Oscar for best picture in 2000?”

4.8.2 Global Solutions

Clearly, as DDoS attacks target the deficiencies of the Internet as a whole, local solutions to the problem become futile. Global solutions are better from a technological standpoint. The real question is whether there is a global incentive to implement them.

1. Improving the Security of the Entire Internet: Improving the security of all computers linked to the Internet would prevent attackers from finding enough vulnerable computers to break into and plant daemon programs that would turn them into zombies.

2. Using Globally Coordinated Filters: The strategy here is to prevent the accumulation of a critical mass of attacking packets in time. Once filters are installed throughout the Internet, a victim can send information that it has detected an attack, and the filters can stop attacking packets earlier along the attacking path, before they aggregate to lethal proportions. This method is effective even if the attacker has already seized enough zombie computers to pose a threat.

3. Tracing the Source IP Address: The goal of this approach is to trace the intruders‟ path back to the zombie computers and stop their attacks or, even better, to find the original attacker and take legal actions. If tracing is done promptly enough, it can help to abort the DDoS attack. Catching the attacker would deter repeat attacks. However, two attacker techniques hinder tracing:

i)IP spoofing that uses forged source IP addresses, and

ii)The hierarchical attacking structure that detaches the control traffic from the attacking traffic, effectively hiding attackers even if the zombie computers are identified.

4.9 Implementation and Detection of DDOS Attack Mechanisms in MANET

4.9.1 Packet Dropping Attack

Here, a new attack, the Ad Hoc Packet Dropping Attack is presented which results in denial of service when used against all previously on-demand ad hoc network routing protocols. In this attack, the attacker makes some nodes malicious, and the malicious nodes drops some or all data packets sent to it for further forwarding even when no congestion occurs [20]. Code for implementing Ad Hoc Packet Dropping attack is shown in Figure 4.

If((((node-> nodeAddr) % 8)==0) && (node-nodeAddr <= 100))

{

Return;

}

Figure 4 Packet Dropping Based DDoS attack

This code is placed in different functions of aodv.pc file. Code shown for packet dropping makes node 0, 8, 16, 24, etc. as malicious nodes. These nodes drop some or all data packets transmitted to it for further forwarding.

Unconditional Packet Dropping: It is technique to detect packet dropping attack in which we monitor the statistics Forward Percentage (FP) over a sufficiently long time period T [19].

FP_m = Packets actually forwarded / Packets to be forwarded

FP determines the ratio of forwarded packets over the packets that are transmitted from M to m and that m should forward. If the denominator is not zero and FP_i = 0, the attack is detected as Unconditional Packet dropping and m is identified as the attacker. Here, M represents the monitoring node and m the monitored node. Suppose we are sending packets from node 8 to node 9. If packets to be forwarded by node 8 are 53 and packets received by node 9 is 0 which is the packets actually forwarded by node 8. Here denominator is not zero but FP_i = 0. Hence attack detected is unconditional packet dropping and node 8 is malicious node.

4.9.2 Flooding Attack

Another type of DDoS attack is based on a huge volume of attack traffic, which is known as a Flooding-based DDoS attack. A flooding-based DDoS attack attempts to congest the victim's network bandwidth with real-looking but unwanted IP data. As a result, legitimate IP packets cannot reach the victim due to a lack of bandwidth resource. Here, we introduce a new attack in the mobile ad hoc network, which is called the Ad Hoc Flooding Attack.

If((((node -> nodeAddr) %8)==0) && (node-nodeAddr <= 100))

{

Return;

}

Figure 5 Flooding Based DDoS attack

The attack acts as an effective Denial of Service attack against all currently proposed on demand ad hoc network routing protocols, including the secure protocols. Thus, existing on-demand routing protocols, such as Ad hoc On Demand Vector (AODV) cannot be immune from the Ad Hoc Flooding Attack. Code for implementing Ad Hoc Flooding attack is shown in Figure 5. This code is placed in different functions of aodv.pc file. Code shown for flooding makes node 0, 8, 16, 24, etc. as attack nodes. These nodes send out mass RREQ packets all over the network so that the other nodes cannot build paths with each other.

Malicious Flooding on SpecificTtarget: It is technique to detect flood attack in which monitor the total number of #T ([m], [d]) over a period of time T for every destination d [19]. If it is larger than threshold MaxCount, the attack is a Malicious Flooding. Where # ([s],[d]) is the number of packets received on the monitored node (m) which is originated from s and destined to d.

5.0 EXISTING AND PROPOSED PREVENTION METHODS

5.1 By calling Handle RREQ and Retry RREQ Functions Another solution to prevent Flooding Based DDoS attack is by calling Handle RREQ and Retry RREQ functions. Flood attack occurs because of initiating various RREQs on a particular node. Because of various RREQs that node is unable to handle more RREQ and becomes malicious node. When this node comes in the path of other nodes does not forward packets and busy in handling RREQ. In order to prevent network from this attack, we can call these functions i.e. Handle RREQ and Retry RREQ. Handle RREQ function helps in handling various RREQ which comes on a particular node and mitigate flood attack. Similarly, Retry RREQ function tries to find another path for forwarding packets from source to destination, this path may be larger from the path which is through malicious node but we get the path and packets are reached from source to destination. Both of these existing techniques only mitigate the effect of Flooding Based DDoS does not prevent it completely.

5.2 Proposed Prevention Method For Blocking IP Broadcasts

Blocking IP Broadcasts: A broadcast is a data packet that is destined for multiple hosts. Broadcasts can occur at the data link layer and the network layer. Data-link broadcasts are sent to all hosts attached to a particular physical network. Network layer broadcasts are sent to all hosts attached to a particular logical network. The Transmission Control Protocol/Internet Protocol (TCP/IP) supports the following types of broadcast packets:

All ones: By setting the broadcast address to all ones (255.255.255.255), all hosts on the network receive the broadcast.

Network: By setting the broadcast address to a specific network number in the network portion of the IP address and setting all ones in the host portion of the broadcast address, all hosts on the specified network receive the broadcast. For example, when a broadcast packet is sent with the broadcast address of 131.108.255.255, all hosts on network number 131.108 receive the broadcast.

Subnet: By setting the broadcast address to a specific network number and a specific subnet number, all hosts on the specified subnet receive the broadcast. For example, when a broadcast packet is set with the broadcast address of 131.108.3.255, all hosts on subnet 3 of network 131.108 receive the broadcast.

Because broadcasts are recognized by all hosts, a significant goal of router configuration is to control unnecessary proliferation of broadcast packets. Cisco routers support two kinds of broadcasts: directed and flooded. A directed broadcast is a packet sent to a specific network or series of networks, whereas a flooded broadcast is a packet sent to every network. In IP internetworks, most broadcasts take the form of User Datagram Protocol (UDP) broadcasts. Consider the example of flooded broadcast which cause DDoS attack. The Smurf attack, which is made possible mostly because of badly configured network devices that respond to ICMP echoes sent to broadcast addresses. The attacker sends a large amount of ICMP traffic to a broadcast address and uses a victim’s IP address as the source IP so the replies from all the devices that respond to the broadcast address will flood the victim. The nasty part of this attack is that the attacker can use a low-bandwidth connection to kill high-bandwidth connections. The amount of traffic sent by the attacker is multiplied by a factor equal to the number of hosts behind the router that reply to the ICMP echo packets. The diagram in Figure 3 depicts a Smurf attack in progress. The attacker sends a stream of ICMP echo packets to the router at 128Kbps. The attacker modifies the packets by changing the source IP to the IP address of the victim’s computer so replies to the echo packets will be sent to that address. The destination address of the packets is a broadcast address of the so-called bounce site, in this case 129.63.255.255. If the router is configured to forward these broadcasts to hosts on the other side of the router (by forwarding layer 3 broadcasts to the layer 2 broadcast address FF:FF:FF:FF:FF:FF) all these host will reply. In the above example that would mean 630Kbps (5 x 128Kbps) of ICMP replies will be sent to the victim’s system, which would effectively disable its 512Kbps connection. Besides the target system, the intermediate router is also a victim, and thus also the hosts in the bounce site. A similar attack that uses UDP echo packets instead of ICMP echo packets is called a Fraggle attack.

From above example it is clear that IP broadcast cause the flood on the victim node. By blocking IP Broadcasts, host computers can no longer be used as amplifiers in ICMP Flood and Smurf attacks. However, to defend against this attack, all neighboring networks need to block IP broadcasts.

Advantages of the Proposed Method

· The proposed method incurs no extra overhead, as it makes minimal modifications to the existing data structures and functions related to blacklisting a node in the existing version of pure AODV.

· The proposed method is more efficient in terms of its resultant routes established, resource reservations and its computational complexity.

· If more than one malicious node collaborate, they too will be restricted and isolated by their neighbors, since they monitor and exercise control over forwarding RREQs by nodes. Thus the proposed method successfully prevents DDoS attacks.

6.0 EXPERIMENTAL SETUP AND PERFORMANCE METRICS OF PROPOSED PREVENTION METHOD

Metrics of Proposed Prevention Method

In this section we describe the parameters used in the simulations. The performance simulation environment used is based on NS-2, a network simulator that provides support for simulating multi-hop wireless networks. Experimental Setup and Performance Metrics are shown in Table 1.

Table 1 General Parameters for Experimental Setup

Sl.No.	Parameter	Value	Description
1	Number of Nodes	0-75	Network Nodes
2	Terrain Range	(1200,1200)	X,Y dimension of motion in m
3	Bandwidth	2 Mbps	Bandwidth of nodes
4	Simulation Time	0-20 Second’s	Simulation Duration
5	Placement of Nodes	Uniform	Node placement Policy
6	Mobility	Random	Randomly change the direction
7	Mobility Time	0-20 m/s	Mobility of Nodes
8	Traffic Model	CBR	Constant bit rate protocol
9	MAC Protocol	CSMA	MAC Protocol being Used
10	Routing Protocol	AODV MODIFIED	Routing protocol being Used

The following performance metrics are compared.

1. Packet Delivery Ratio (PDR): It is the ratio of the number of packets actually delivered without duplicates to the destinations versus the number of data packets supposed to be received. This number represents the effectiveness and throughput of a protocol in delivering data to the intended receivers within the network. Number of successfully delivered legitimate packets as a ratio of number of generated legitimate packets.

PDR = Total Number of packets Sent / Total Number of packets Received

2. Number of Collisions: In a network, when two or more nodes attempt to transmit a packet across the network at the same time, a packet collision occurs. When a packet collision occurs, the packets are either discarded or sent back to their originating stations and then retransmitted in a timed sequence to avoid further collision. Packet collisions can result in the loss of packet integrity or can impede the performance of a network. This metric is used to measure such collisions in the network. Using the NS-2 simulator,

the effect of DDoS attacks is measured with respect to different number of attackers.

Table 2 Effect on PDR of Existing & Proposed Prevention Method with varying number of attackers

No.of. Attackers	Packet Delivery Ratio (PDR)
No.of. Attackers	Without Attack	Flooding Based DDoS Attack	Existing Prevention Technique	Proposed Prevention Technique
2	0.926	0.32	0.57	0.89
3	0.926	0.31	0.55	0.86
4	0.926	0.22	0.47	0.79
5	0.926	0.20	0.45	0.74
6	0.926	0.17	0.44	0.69
7	0.926	0.15	0.42	0.63
8	0.926	0.12	0.39	0.61

Table 3 Effect on Number of Collisions of Existing and Proposed Prevention Method with varying number of attackers

No.of Attackers	Number of Collisions
No.of Attackers	Without Attack	Flooding Based DDoS Attack	Existing Prevention Technique	Proposed Prevention Technique
2	10	8543	7055	3755
3	10	8571	7091	3867
4	10	8685	7175	3987
5	10	8741	7233	4070
6	10	8756	7315	4115
7	10	8897	7400	4260
8	10	8918	7535	4315

Figure 6 Effect on PDR of Proposed Prevention Method with varying number of attackers

7. RESULTS AND DISCUSSION:

7.1 Effect of Proposed Prevention method on PDR with Different Number of Attackers

Table 2 and Figure 6 shows the effect of existing and proposed prevention technique on PDR with different number of attackers. Existing Prevention Technique uses the function Handle RREQ & Retry RREQ to prevent flood based DDoS attack. The figure 4 shows that proposed prevention technique (By Blocking IP Broadcast) mitigate the effect of flooding based DDoS attack with larger extent. By using this method PDR increases up to 22.31% as compared to the PDR of existing prevention technique and 51.23% as compared to flooding based attack.

7.2 Effect of Proposed Prevention Method on Number of Collisions with Different Number of Attackers

Table 3 and Figure 7 shows the effect of proposed prevention method on Number of Collisions with different number of attackers and it also shows comparison with the existing prevention scheme. This figure shows that proposed prevention technique (By disabling IP Broadcast) mitigate the effect of flooding based DDoS attack with larger extent. By using this technique number of collisions decreases up to 55.8% as compared to the collisions of existing prevention scheme and 46.4% as compared to flood based DDoS attack.

Figure 7 Effect on Number of Collisions of Proposed Prevention Method with varying number of attackers

8.0 CONCLUSION:

Mobile ad-hoc network is an infrastructure less network due to its capability of operating without the support of any fixed infrastructure. Security plays a vital role in MANET due to its applications like battlefield or disaster-recovery networks. MANETs are more vulnerable compared to wired networks due to the lack of a trusted centralized authority and limited resources. There is an urgent need to develop a scheme to handle DDoS attack in the mobile ad-hoc network. In this paper we have discussed the various the attack mechanisms and problems due to DDoS attack, also how MANET can be affected by these attacks. In this paper the implementation of DDoS attack on network and blocking IP broadcast method is discussed to prevent flooding based DDoS attack effectively. It was found that flooding based DDoS attack have greater impact on network performance. By implementing IP broadcast blocking method it was found that proposed prevention method is much better than existing techniques in terms of Packet delivery ratio (PDR) which becomes double and number of collisions reduced to half with respect to different number of attackers.

9.0ACKNOWLEDGEMENT:

We are grateful to our colleagues and friends who helped in this research paper.

10.0 REFERENCES:

1 C. S. R. Murthy and B. S. Manoj, “Ad-Hoc Wireless Net- works Architectures and Protocols,” Prentice Hall Communications Engineering and Emerging Technologies Series, Pearson Education, Upper Saddle River, 2004.

2 Stephen M. Specht and Ruby B. Lee; Distributed Denial of Service: Taxonomies of Attacks, Tools, and Countermeasures; Proceedings of the 17th International Conference on Parallel and Distributed Computing Systems, 2004 International Workshop on Security in Parallel and Distributed Systems, pp. 543-550; September 2004.

3 Kamanshis Biswas and Md. Liakat Ali; Security Threats in Mobile Ad Hoc Network; Master Thesis; Thesis no: MCS- 2007:07; March 22, 2007.

4 Yogesh Chaba, Yudhvir Singh, Preeti Aneja, “Performance Analysis of Disable IP Broadcast Technique for Prevention of Flooding-Based DDoS Attack in MANET” JOURNAL OF NETWORKS, VOL. 4, NO. 3, MAY 2009 ACADEMY PUBLISHER.

5 Felix Lau, Stuart H. Rubin, Michael H. Smith and Ljiljana TrajkoviC; Distributed Denial of Service Attacks; pp 2275- 2280/2004 IEEE.

6 Shafiullah Khan et al, “Denial of Service Attacks and Challenges in Broadband Wireless Networks,” International Journal of Computer Science and Network Security, Vol. 8, No. 7, pp. 1-6, July 2008.

7 Xiao Bin et al, “A novel approach to detecting DDoS Attacks at an Early Stage,” The Journal of Supercomputing, Springer, Volume 36, Number 3, June 2006 , pp. 235-248(14).

8 Shigang Chen et al, “Stateful DDoS attacks and targeted filtering,” Journal of Network and Computer Applications, Volume 30, Issue 3, August 2007, pp. 823-840.

9 Xiaobo Zhou et al, “Distributed denial-of-service and intrusion detection,” Journal of Network and Computer Applications, Volume 30, Issue 3, August 2007, pp. 819- 822.

10 Vasilios A. Siris et al, “Provider-based deterministic packet marking against distributed DoS attacks,” Journal of Network and Computer Applications, Volume 30, Issue 3, August 2007, pp. 858-876.

11 Yaar Abraham et al "StackPi: New Packet Marking and Filtering Mechanisms for DDoS and IP Spoofing Defense," IEEE Journal on Selected Areas in Comunications 24, no. 10 (October 2006): 1853-1863.

12 B. Han, H. H. Fu, L. Lin and W. Jia, “Efficient Construction of Connected Dominating Set in Wireless Ad Hoc Networks,” IEEE International Conference on Mobile Ad-Hoc and Sensor Systems, Fort Lauderdale, 25-27 October 2004, pp. 570-572,

13 Antonio Challita, Mona El Hassan, Sabine Maalouf and Adel Zouheiry; A Survey of DDoS Defense Mechanisms; Department of Electrical and Computer Engineering American University of Beirut; {asc04,mhe03,sem05,atz00}@aub.edu.lb.

14 Hwee-Xian Tan and Winston K. G. Seah; Framework for Statistical Filtering Against DDOS Attacks in MANETs; Proceedings of the Second International Conference on Embedded Software and Systems; 2005 IEEE.

15 X. J. Geng and A. B. Whinston; “Defeating Distributed Denial of Service Attacks,” IT Professional, Vol. 2, No. 4, 2000, pp. 36-41. doi:10.1109/6294.869381

16 Karthikeyan Thyagarajan and Arunkumar Thangavelu. An integrated defense approach for distributed denial of service attacks in mobile ad-hoc network. International Journal of Applied Engineering Research. Volume 11, Issue 7, 1 May 2016, Pages 4898-4910

17 Q. Li, E-C. Chang and M. C. Chan; On the Effectiveness of DDoS Attacks on Statistical Filtering; Proceedings of the 24th Annual Conference of the IEEE Communications Society (INFOCOM 2005), Miami; Mar 13-17, 2005.

18 K. Biswas and Md. Liaqat Ali, “Security Threats in Mo- bile Ad-Hoc Network,” Master Thesis, Blekinge Institute of Technology, Blekinge, 2007.

19 A. Piskozub, “Denial of Service and Distributed Denial of Service Attacks,” Proceedings of the International Conference on Modern Problems of Radio Engineering, Tele- communications and Computer Science, Lviv-Slavsko, 18-23 February 2002, pp. 303-304.[20] Xianjun Geng and Andrew B. Whinston; Defeating Distributed Denial of Service Attacks; February 2000.

20 V. Laurens, “Detecting DDoS attack traffic at the Agent Machines,” Canadian Conference on Electrical and Computer Engineering, CCECE’06, Ottawa, 7-10 May 2006, pp. 2369-2372.

21 P. Joshi, “Security Issues in Routing Protocols in Manets at Network Layer,” Procedia Computer Science, Vol. 3 2011, pp. 954-960. doi:10.1016/j.procs.2010.12.156

22 K. S. Madhusudhananaga Kumar and G. Aghila, “A Survey on Black Hole Attacks on AODV Protocol in MANET,” International Journal of Computer Applications, Vol. 34, No. 5, 2011, pp. 23-30.

23 E. Alomari, S. Manickam, B. B. Gupta, S. Karuppayah and R. Alfaris, “Botnet-based Distributed Denial of Service (DDoS) Attacks on Web Servers: Classification and Art,” International Journal of Computer Applications, Vol. 49, No. 7, 2012, pp. 24-32.

24 B. B. Gupta, M. Misra and R. C. Joshi, “FVBA: A Combined Statistical Approach for Low Rate Degrading and High Bandwidth Disruptive DDoS Attacks Detection in ISP Domain,” Proceedings of 16th IEEE International Conference on Networks (ICON-2008), New Delhi, 12-14 December 2008, pp. 1-4. doi:10.1109/ICON.2008.4772654

25 A. Srivastava, B. B. Gupta, A. Tyagi, A. Sharma and A. Mishra, “A Recent Survey on DDoS Attacks and Defense Mechanisms,” Proceedings of the First International Conference on Parallel, Distributed Computing Technologies and Applications (PDCTA-2011), Tirunelveli, 23-25 September 2011, pp. 570-580.

26 B. B. Gupta, R. C. Joshi and M. Misra, “ANN Based Scheme to Predict Number of Zombies Involved in a DDoS Attack,” International Journal of Network Security (IJNS), Vol. 14, No. 1, 2012, pp. 36-45.

27 V. Paxson, “An Analysis of Using Reflectors for Distributed Denial-of-Service Attacks,” ACM SIGCOMM Computer Communication Review, Vol. 31, No. 3, 2001, pp. 38-47.

28 R. Guo, G. R. Chang, R. D. Hou, Y. H. Qin, B. J. Sun, A. Liu, Y. Jia and D. Peng, “Research on Counter Band- width Depletion DDoS Attacks Based on Genetic Algorithm,” Third International Conference on Natural Computation, ICNC 2007, Haikou, 24-27 August 2007, pp. 155-159,.

29 H.-J. Kim, R. B. Chitti and J. S. Song, “Handling Malicious Flooding Attacks through Enhancement of Packet Processing Technique in Mobile Ad Hoc Networks,” Journal of Information Processing Systems, Vol. 7, No. 1, 2011, pp. 137-150.

30 U. D. Khartad and R. K. Krishna, “Route Request Flooding Attack Using Trust Based Security Scheme in Manet,” International Journal of Smart Sensors and Ad Hoc Networks (IJSSAN), Vol. 1, No. 4, 2012, p. 27.

31 P. J. Criscuolo, “Distributed Denial of Service Trinoo, Tribe Flood Network, Tribe Flood Network 2000, and Stacheldraht, CIAC-2319,” Department of Energy Computer Incident Advisory Capability (CIAC), UCRL- ID-136939, Rev.1, Lawrence Livermore National Laboratory, Livermore, 2000.

32 S. Bellovin, M. Leech and T. Taylor, “ICMP trace back messages,” Internet Draft: draft-ietf-itrace-01.txt, Work in Progress, 2001.

33 H. X. Tan, “Framework for Statistical Filtering against DDoS Attacks in MANETs,” Second International Conference on Embedded Software and Systems, Xi’an, 16-18 December 2005, 8 pp.

34 A. Mishra, B. B. Gupta and R. C. Joshi, “A Comparative Study of Distributed Denial of Service Attacks, Intrusion Tolerance and Mitigation Techniques,” European Intelligence and Security Informatics Conference, EISIC 2011, 12-14 September 2011, pp. 286, 289.

35 Y. Chaba, Y. Singh and P. Aneja, “Performance Analysis of Disable IP Broadcast Technique for Prevention of Flooding-Based DDoS Attack in MANET,” Journal of Networks, Vol. 4, No. 3, 2009, pp. 178-183.

36 S. A. Arunmozhi and Y. Venkataramani, “DDoS Attack and Defense Scheme in Wireless Ad Hoc Networks,” International Journal of Network Security & Its Applications, Vol. 3, No. 3, 2011, 6 pp.