A modeling and simulation framework for the analysis of offensive and defensive strategies in computer networks

This article proposes a simulation framework for a flexible evaluation of security strategies against denial-of-service (DoS) attacks in computer networks. The focus is on the SynFlood attack, a specific type of DoS that is one of the most common yet least understood threats in the field of IT security. The SynFlood attack exploits the connection-oriented functionality of the Transmission Control Protocol (TCP) to overwhelm the server with massive requests and prevent it from providing services to legitimate clients. The proposed framework aims to support network administrators in their efforts to design and evaluate the performance of new defense strategies against emerging SynFlood attack approaches. By combining the expressive power and friendliness of a visual modeling language with the robustness of a universal simulation language and its implemented infrastructure, such a framework favors communication between network experts and simulation experts, and allows them to focus on the specification of their strategies without the need to engage in cumbersome implementation efforts.