IP Spoofing Detection Approach(ISDA) for Network Intrusion Detection System

A new approach for detecting spoofed IP level, called IP spoofing detection approach (ISDA), is proposed. The purpose of this approach is maximally to keep effective parts and remove forged parts of source IP addresses under flooding attacks and dynamically configure flow aggregation scheme for flow-based network intrusion detection to build the most effective intrusion detection approach. Our work concentrates on developing an overall framework, which includes building flow aggregation schemes for flow-based network intrusion detection system (FNIDS), detecting IP address spoofing level and using fuzzy logic method automatically to activate the most appropriate flow aggregation scheme. Finally, the performance of applying our proposed architecture against flooding DDOS attacks is evaluated by using DARPA 98 data. Results show the significant improvement for FNIDS after applying the IP address spoofing detection algorithms.