effectiveness of built-in security protection of microsoft’s windows server 2003 against tcp syn based ddos attacks内置安全保护的有效性基于微软的windows server 2003对tcp syn ddos攻击.pdfVIP

Journal of Information Security, 2011, 2, 131-138 doi:10.4236/jis.2011.23013 Published Online July 2011 (http://www.SciRP.org/journal/jis) Effectiveness of Built-in Security Protection of Microsoft’s Windows Server 2003 against TCP SYN Based DDoS Attacks Hari Krishna Vellalacheruvu, Sanjeev Kumar Networking Security Research Lab, Department of Electrical and Computer Engineering, The University of Texas-Pan American, Edinburg, USA E-mail : sjk@ Received December 15, 2010; revised June 15, 2011; accepted July 11, 2011 Abstract Recent DDoS attacks against several web sites operated by SONY Playstation caused wide spread outage for several days, and loss of user account information. DDoS attacks by WikiLeaks supporters against VISA, MasterCard, and Paypal servers made headline news globally. These DDoS attack floods are known to crash, or reduce the performance of web based applications, and reduce the number of legitimate client connec- tions/sec. TCP SYN flood is one of the most common DDoS attack, and latest operating systems have some form of protection against this attack to prevent the attack in reducing the performance of web applications, and user connections. In this paper, we evaluated the performance of the TCP-SYN attack protection pro- vided in Microsoft’s windows server 2003. It is found that the SYN attack protection provided by the server is effective in preventing attacks only at lower loads of SYN attack traffic, however this built-in protection is found to be not effective against high intensity of SYN attack traffic. Measurement results in this paper can help network operators understand the effectiveness of built-in protection mechanism that exists in millions of Windows server 2003 against one of