DDoS Attacks on Cloud Computing and IoT Devices: Strategies for Mitigation

This study has the goal of developing security model that detected and prevented the risks of Distributed Denial of Service (DDoS) attacks in cloud computing systems and IoT devices which are gravely potent and on the increase today, especially with the rapid growth of internet during the last one and a half decades. This is more prevalent because of the several benefits that an organization enjoys after adopting cloud computing and Internet of Things (IoT). However, the harm that may result after a DDoS attack on a cloud computing infrastructure or service and IoT devices can be very huge, and all efforts must be made to secure it. Therefore, the traditional security mechanism cannot satisfy the security requirements of cloud computing and IoT. While several models exist on tackling this menace which operate on a particular layer (mostly layer 3) of the Open System Interconnection (OSI), we have developed a cloud-based hybrid defense and detection mechanism to prevent DDoS attacks in cloud computing environment and IoT that operates in layers 3 (network), 4 (transport) and 7 (application) of the OSI model. This was done using two approaches: analyzing Transmission Control Protocol/Internet Protocol (TCP/IP) header features of incoming packets in cloud computing environment in order to detect and classify spoofed IP address during DDoS attack via a custom-made Web Application Firewall (WAF); and the integration of the cloud resources with Cloudflare. In the first instance, TCP syn flood attacks were targeted to a particular webserver on port 80 through an attacking lab machine. This machine did not have this custom-made WAF (prevention/detection mechanism) against these attacks. There was 100% packet loss as no replies were received, overwhelming the system. The result shows that a total of 1,625,192 packets were transmitted in a short period which were captured and analyzed via Wireshark. Several TCP errors were observed over a very short time interval which indicated successful DDoS attack effectively crashing the system. The result varied when the custom-made WAF was put in place, and the attacking lab machine launched a TCP syn flood attack against the web server on port http port 80. A total of 2,353,585 packets were transmitted in a short period which were captured and analyzed using Wireshark and contained less TCP errors indicating successful mitigation of DDoS attacks. When the resources were hosted online and integrated with Cloudflare, integrity checks were successful before the resources were loaded, indicating complete mitigation of attacks. In the end, an enhanced, cloud-based, hybrid (WAF + Cloudflare) security model that prevented the risks of DDoS attacks on cloud computing and IoT devices was designed and implemented. The methodology adopted for this research work is Open Source Security Testing Methodology Manual (OSSTMM) and programming language used is batch script. The model will be useful in education, healthcare, ecommerce, financial, political/electoral, web hosting providers/ISPs offices, homes and online gaming sites. However, these advancements also make IoT and cloud applications vulnerable to a variety of security threats. To broaden the scope of this research, it is recommended to extend the study to include Man-in-the-Middle (MitM) attacks and routing attacks targeting IoT devices and cloud applications.