Um mecanismo contra ataques do tipo SYN Flood para firewalls baseados no framework netfilter

Abstract

Denial-of-Service (DoS) attacks represent a significant threat to the availability of network security devices, such as firewalls, which become frequent targets due to their central role in protecting networks and services. Among these attacks, the SYN Flood stands out, exploiting a limitation in the Transmission Control Protocol (TCP) connection management by maintaining a large number of partially established connections, leading to the exhaustion of system resources. This type of attack particularly affects firewalls based on netfilter (a Linux kernel subsystem responsible for packet filtering and manipulation). This research aims to develop a mechanism for detecting and containing SYN Floods targeting netfilter-based firewalls. The proposed mechanism comprises three stages: (i) the formulation of a mathematical model to define a threshold for classifying suspicious SYN packets; (ii) the implementation of a tool to detect attacks and (iii) the development of a mathematical model to estimate the hardware resources (CPU and memory) required for the tool to support different traffic volumes. The tool, named SYN Flood Interceptor for Netfilter (SFINX), was implemented in the C language, in a GNU/Linux environment, as a Loadable Kernel Module (LKM), and validated in a simulated test environment using Graphical Network Simulator 3 (GNS3). Two test scenarios were created to evaluate SFINX, namely: (i) DoS Flood: denial-of-service attack with the sending of SYN packets at a constant rate, without variation in the number of packets per second; (ii) Controlled DoS Flood: denial-of-service attack with explicit control of the packet sending rate per second. The simulation results demonstrated that the mechanism was effective in containing SYN Flood attacks, maintaining firewall availability even under a constant transmission rate exceeding 160,000 SYN packets per second, in an environment with limited hardware resources (3 GB of RAM and a 2 GHz CPU). Furthermore, the tool demonstrated resilience to available hardware resources, allowing, based on mathematical modeling, a preliminary estimate of the necessary computational capacity according to the intensity of SYN traffic. For example, to filter a volume of 1,000 Mbps, approximately 3.28 GB of RAM and a 2.48 GHz processor are required.