6FloodDetector: An IPv6 Flooding Behaviors Detection Technology Based on Eigenvalues and Thresholds

With the rapid deployment and application of IPv6, IPv6 network security incidents and threats are on the rise. Flooding is one of many serious security threats, which makes the victims losing their normal service abilities by sending a large number of malicious packets. While the IPv6 protocol is much more secure than the IPv4 protocol, there are still effective flooding attacks. Therefore, how to detect flooding attacks in IPv6 networks has become an urgent problem. Currently, IPv6 flooding attack detection tools include Suricata, 6shield and others, but only a small number of flooding attacks can be detected. Based on the analysis of 12 flooding attack behaviors in the THC-IPv6 toolkit, an IPv6 flooding behaviors detection technology based on eigenvalues and thresholds is proposed and a corresponding tool 6FloodDetector is designed. When tested in the IPv6 network environment, the 6FloodDetector tool is able to detect all 12 types of flooding attacks in the THC-IPv6 toolkit, while only 3 types can be detected by the 6shield tool.