Cyber Research Proposal

‘
Cyber Research Proposal
Deonte Allen
American Military University
INTL 647: Cyber Intelligence
White paper
July 5, 2021
Cyber Research Proposal
Introduction 
Statement Of The Problem 
More sophisticated DDoS attacks and improving DDoS security, mitigation, and detection strategies are necessary to secure the data, networks, servers, and systems.
The distributed denial-of-service (DDoS) is a denial-of-service (DoS) attack that disrupts the normal network traffic where many computers launch repeated attacks. The DDoS is on a larger scale than the DoS, and there are flooding techniques where there are coordinated attacks through botnets. The botnets are connected computers that are infected and simultaneously focus on a specific target. In many cases, this is done involuntarily, and even computer users may not know there are zombie computers used for denial-of-service attacks. Besides attacks through a botnet, the other way to launch DDoS attacks is through a group of hackers that provide links that allow people to collaborate in attacking websites or systems. A DDoS occurs when their attacks are from different points simultaneously, unlike the DoS attacks.
Research Question 
* The research question of this proposal is: What interventions are adequate to prevent and protects against DDoS attacks?
Background 
The denial of service attacks focus on sending and requesting a lot of data to a server on a network, and this slows down or prevents servers from working as they are unable to respond to data requests. Users can no longer access services from specific web pages as the networks and servers are overwhelmed. The DDoS attacks require coordinated efforts. Even if some services may still be available, the likelihood of severely disrupting services combined with the growing risk of ransomware is a concern.
More sophisticated DDoS attacks than ever before, and it is more challenging to protect against these types of attacks. Even when firms do not suffer financial loss, there is also reputational damage. DDoS attacks are a cause of concern, but there has been growing interest and research on methods to detect DDoS attacks(s) accurately. Improving network security is essential to protect data, information, network, and system integrity where threats are absent. To ensure there is a secure system, authorized users should be concerned about confidentiality, integrity, and availability of the assets and information.
 Purpose statement
* To evaluate strategies to prevent, protect and detect DDoS attacks.
Theoretical Framework
Cohen and Felson (1979) proposed the Routine Activities Theory (RAT) that explains there are three elements of a crime where there is a motivated offender, suitable target, or victim in an environment lacking a capable guardian to prevent the crime (Hsieh and Wang, 2018, p.335). RAT has been chiefly used to study cyber victimization and is helpful to understand the risks of cybercrime and factors that protect against cyber crimes and attacks. Different factors determine an individual or organization is vulnerable to cybercrime and attacks. The theory is predictive as it indicates where and when a crime is most likely to occur. In addition, there are differences in exposure, vulnerabilities, and risks to DDoS attacks. The RAT framework could explain cybersecurity gaps even as the theory has focused chiefly on cyber victimization in research on cybercrime. However, the framework does not focus on an attacker's motivation but rather on the crime or attack (Hsieh and Wang, 2018, p. 3350).
DDoS attacks disrupt services for legitimate users and overwhelm the network resources making it more challenging to access services. The DDoS attacks are based on exploiting vulnerabilities where and there is a large-scale launch of attacks. Attackers and hackers target the layers of network infrastructure, and they launch application-layer attacks, protocol attacks, and volume-based attacks. 
Application Layer Attacks
The application layer attack - This attack method undermines the application layer and causes the service to stop operational. Attackers exploit the design deficiencies in the protocols of this layer, design flaws, or implementation of the applications. Application layer attacks may appear as innocuous requests and are particularly destructive as it takes time to detect the types of DDoS attacks. The requests per second (RPS) indicates the extent of the attack, but some DDoS attacks have combined application-layer attacks with the other types o of DDoS attacks.
 Protocol Attacks
The protocol attacks approach focuses on the weaknesses in a protocol by exploiting the server resources of the server or load balancers and firewalls. This type of attack is measured packets per second (PPS). Among the example of protocol attacks are:
* TCP Fragmentation Attacks - The attacker overwhelms and targets the network's TCP / IP reassembly mechanisms, disrupting the target's ability to gather fragmented data packets. The network packets received by the network cannot be organized or processed, then overwhelm the system.
* SYN Floodatatcks: This type of DDoS attack where the attacker initiates connections to a server in rapid success...