IP spoofing detection using Hop Count and Round Trip Time profiling.

Abstract

With the widespread usage of the Internet, more and more cyber-attacks are being performed. Many of these attacks utilize IP Spoofing. This thesis describes IP Spoofing attacks and the proposed methods currently available to detect or prevent them. In addition, it presents a statistical analysis of Hop Count and Round Trip Time parameters used in our proposed IP Spoofing detection algorithms. Finally, this thesis proposes two algorithms which are inspired by the Hop Count Filtering technique. The first algorithm changes the learning phase of Hop Count Filtering (HCF) to include all the possible available HC values. The second algorithm is more stringent method that utilizes the Round Trip Time parameter. Compared to the original HCF method and its variants, both of our proposed methods increase the true positive rate by at least 9percent and consequently increase the overall accuracy of the Intrusion Detection System by at least 9percent. Our proposed methods perform in general better than HCF method and its variants.