A Simulation Platform of DDoS Attack Based on Network Processor

Due to the rapid spread of botnets distributed denial of service attacks have become more and more frequent and fatal. Many researches have been done in the virtual environment to detect and defend such attacks. But a data flow is essentially needed to verify these researches in a real environment. This paper proposes a simulation platform of distributed denial of service attacks based on network processor. The fractal Brownian motion model is introduced to generate attack flow with the characteristic of self-similarity. A transmission control mechanism based on micro-engine is presented to reduce the error of output data flow¿s Hurst parameter. Experiment results show that the model can generate a high speed self-similar attack flow with controllable Hurst parameter, and different kinds of traffic in the flow can be accurately transmitted as configured.

1. Introduction

Researches of DDoS attacks started since its birth. These researches provide methods to detect DDoS attacks used by firewall or network-based intrusion detection systems (NIDS), so simulating the flow of DDoS attack is essentially needed for studying or testing network devices in real environment. Developing the specific software [1] or using the existing simulation software like OPNET [2], NS2 [3] can help to build a virtual environment. Although high speed rate of data flow can be simulated in such way, it is possible that the simulation situation may be different from the real circumstance. While using large-scale network test equipment, such as SmartBits, is able to generate real attack flow. However, there are some inherent defects of these devices: highly specialized, complexly configured, unfriendly using, what's more important, most researchers cannot afford the high expense.