TCP FIN flood attack pattern recognition on internet of things with rule based signature analysis

• Main Authors: Stiawan, Deris, Wahyudi, Dimas, Heryanto, Ahmad, Samsuryadi, Samsuryadi, Idris, Mohd. Yazid, Muchtar, Farkhana, Alzahrani, Mohammed Abdullah, Budiarto, Rahmat
• Format: Article
• Language: English
• Published: Kassel University Press GmbH 2019
• Subjects: QA75 Electronic computers. Computer science
• Online Access: http://eprints.utm.my/id/eprint/88122/1/MohdYazidIdris2019_TCPFINFloodAttackPatternRecognition.pdf; http://eprints.utm.my/id/eprint/88122/; http://dx.doi.org/10.3991/ijoe.v15i07.9848

Focus of this research is Transmission Control Protocol (TCP) FIN flood attack pattern recognition in Internet of Things network using rule based signature analysis method. Dataset is created using three traffic scenarios: normal, attack and normal-attack. The process of identification and recognition of TCP FIN flood attack pattern is done by observing and analyzing packet's attributes from raw data (pcap format) through a feature extraction and feature selection processes. Further experiments were conducted using Snort as intrusion detection system (IDS). The evaluation results of the rate of confusion matrix detection against the Snort as IDS show the average percentage of the precision level.