World is changing very fast and technology is not behind. Everyday something new is created and deployed, and all of this is done over the Internet. In this era, organizations want more work to be done with least price possible and are ready to use information for competitive advantage. Furthermore, other important factors like globalization, aging data centre, storage growth, application explosion, cost of ownership and acquisition has lead organization to move towards cloud computing. Cloud computing is basically the collection of services hosted over the Internet in the virtual environment. Therefore, user can use resources according to their demand and only pay for them, as the demand increases or decreases these resources can be increased or released accordingly. As popularity of cloud is increasing so are the threats related to it. One such attack which is performed on cloud i.e. the DDoS attack is addressed in detail in this paper. DDoS attack or Distributed Denial of service attack [2, 20] is one of the most common attacks nowadays, as it is very easy to carry out using some simple scripts or tools which are freely available online. In DDoS attack an attacker creates some zombie machines or bots by infecting machines over the Internet. Then these compromised machines are used to perform attack on victim. When traffic from so many machines are directed toward a single victim, victim’s resources like bandwidth, CPU, memory etc starts getting exhausted and its services are no longer available to serve requests from legitimate users. This whole network of bots is called botnet, in botnets the bots may be controlled centrally by a C&C server or P2P. The commands are sent to bot systems directly by attackers or handlers which are again compromised machines over the Internet. This paper mainly discusses the DDoS attack on cloud environment. When DDoS attack occurs in cloud environment, it exhausts all the resources of the VM and overburdens the system; cloud can handle this situation by allocating more resources to this VM to accumulate all the requests made to it. This allocation of more resources can go on to an extent where either cloud provider runs out of resources to allocate or the owner of VM cannot pay for usage of these resources anymore. Furthermore, to deal with this issue limit may be imposed on connection time or bandwidth but this would just make the idea of cloud computing disappear. Hence, a better approach is required to prevent cloud environment from this attack. Therefore, fog computing can be used to provides protection. Fog computing [3] also referred as “edge computing” is a decentralized computing infrastructure where edge devices like routers, switches etc provides storage, computation, control, communication, management and measurement. It places some of the transactions and resources at the edge to reduce the need of going to cloud. Fog reduces the need for bandwidth by using distributed strategy which results in lower cost and improved efficiency.

Preventing network attacks is one of the most difficult tasks in the field of information systems protection. Most modern systems have a distributed structure, their architecture is based on the use of network technologies. And ensuring the operability of such systems depends on the ability to resist malicious acts that are aimed at disrupting the work of both the network itself and the information system functioning within its framework. One of the most dangerous types of criminal activities on the Internet are the so-called DDoS-attacks. The methods used by criminals are constantly evolving and improving, from single attempts they go to corporate development. At the same time, modern systems for detecting intrusions and attacks are far from perfect and insufficiently effective from the point of view of security decisions. Therefore, the methods of work in this direction are necessary and relevant.

II. DESCRIPTION OF THE PROBLEM

Over the past few months, we have witnessed the emergence of a new attack model, rapidly gaining popularity among hackers. She was given the title “Pulsovaya Wave”. Such a hacker attack, conducted on the computer system, is characterized primarily by short, repetitive, at regular intervals, pulses whose peak power can reach 350 Gbit/s. This attack is illustrated in Fig. 1 [1]. Such an attack can last a very long time. Pulse Wave attack has a number of advantages. First, so attackers can attack multiple targets at once. When the impulse stops, and a short lull sets in, the botnet does not stand idle, but attacks another target. Secondly, such attacks are extremely inconvenient for standard DDoS protection systems , which are based on hybrid protection techniques, that is, the first defense line is hardware on-premise products, and the second layer of protection is cloud solutions. The fact is that each impulse disconnects the equipment of the target company. To restore performance after one peak, this attack takes several minutes, but the first pulse is followed by the second, third and so on. This allows the attacker to stretch the DDoS attack for a long time and interferes with the correct operation of the security solutions. Thus, the hardware solution have neither the time nor the bandwidth to request aid cloud and server “crashes”.

III. MODELING ATTACK

For the study of DDoS-attacks “Pulse Wave” protection and development has created a model of the network consisting of a server, the user, the attacker and the gateway router. The server is located in the Net 2 has a static IP = 10.0.0.1 and is responsible for processing requests and come for logging information about them. The server is written in language python using the framework flask. Users and Attackers are on the second network Net 1. Their IP are generated randomly from the address pool 11.0.0.0/24 . Also there is A router connecting these two networks and performing the function of a firewall. The scheme of the network model is shown in Fig. 2.

In VANET, the reliability of vehicular nodes quantifies their co-operation that ensures thedegree the participation with which they forward packets for the sake of their neighbours due to the devoid of a centralized control point for communication[1]. But the extent of collaboration rendered by the vehicular nodes for forwarding packets significant decreases in the presence of malicious activity like DDoS attacks as they intentionally or unintentionally use the resources and degrade the performance of the network for the reason to remainactive in the network without a genuine cause[2-4].The presence of DDoS attacks potentially reduces the rate of packet delivery and throughput inspite of incurring a greater level of delay, control overhead and total overhead. From the past decade, a significant number of mitigation algorithms were proposed for handling DDOs attacks through the integration of meta-heuristic stochastic optimization algorithms that includes Particle swarm optimization(CA-PSO), Ant Colony Optimization(CA-ACO),Genetic algorithm and Artificial Bee Colony Algorithms(ABCA). These meta-heuristic stochastic optimization algorithms are mainly proposed for improving the global search ability for identifying and assessing quality solutions at an optimal rate [5-7]. Further meta-heuristic stochastic optimization algorithms are utilized for the following reasons[8-10] viz., i)It is suitable for resolving any issues that could be derived in a finite dimensional space for identifying an optimal solution,ii) They are experimentally proved and confirmed to be highly suitable for approximation of solution than the heuristic stochastic optimization algorithms in most real time complex environments, iii) They possess a maximum search potential that makes it highly suitable for its applicability in VANET and iv) They are proved to exhibit an higher level of precison when enhanced and integrated for maximizing the exploration extent. In this paper, Cellular Automata-based Improved Ant Colony-based Optimization Algorithm (CA-IACOA) is proposed for eliminating the concept of stagnation that exists in the traditional Ant Colony-based OptimizationAlgorithm(CA-ACO). CA-IACOA used for mitigation assures an effective and efficient global search space for identifying and replacing the DDoS compromised node with optimally elected vehicular node. The traditional CA-ACO algorithm for DDoS mitigation is improved in the following dimensions viz., i) the movements of ants are modified based on dynamic movement probability rule, ii) the pheromone updating rules are improved based on pheromone intensity constant, iii) a pheromone adaptive adjustment strategy is incorporated for modifying the non-uniform distribution of pheromone to unform distribution of pheromone and iv) Dynamic evaporation factor strategy is used for increasing the search potential that in turn enhances the rate of convergence to a considerable level.

Internet of Things (IoT) is becoming more popular, and it can be seen in the home, vehicles and wearable devices. IoT involves a large number of interconnected devices, including household appliances, public facilities, wearable equipment, medical equipment, unmanned aerial vehicles, and interconnected vehicles as well as other applications that require networking [1]–[4]. In the next decade, tens of billions of devices with a variety of vulnerabilities will be connected to IoT. These networking devices have no user interface, no security protocol, and no computing and storage capacity to enable firewalls and diagnostic tools; moreover, they cannot directly connect to the Internet via WiFi. These vulnerabilities represent temptation not only for organizations that want to collect data to achieve intelligent management and digital evidence but also for those who want to disseminate DDoS attacks or other malicious intrusions. Once a DDoS attack is successful, it may threaten the safety of human life and even directly or indirectly cause death and destruction. In recent years, many examples have shown that IoT is vulnerable to viruses [5], [6]. Recent DDoS attacks have revealed that loopholes are ubiquitous in IoT, which is still in the initial stage. Without security precautions, the vast majority of IoT devices may unknowingly become accomplices to DDoS attacks. The software-defined anything (SDx) paradigm addresses the above mentioned problems. SDx includes softwaredefined radio (SDR), software-defined networking (SDN), software-defined data centers (SDDC), software-defined infrastructure (SDI),and the software-defined world (SDW). SDN is undoubtedly the most recognized technology, and its core technology is the separation of the control plane and data plane in the network. It realizes flexible control of network traffic and provides a good platform for the innovation of core networks and applications. For example, Huo et al. [7] and Zhang et al. [8] focused on SDN for next-generation green wireless networks and future 5G wireless networks. Recently, we analyzed computational diversity in emerging networking paradigms, e.g., SDN, cloud radio access networks (C-RAN), and mobile cloud computing (MCC) [9], and proposed a boxcovering-based routing algorithm for large-scale SDNs [10]. Recent studies indicate that SDN support for IoT is achieved through centralized control, abstraction of network devices and flexible, dynamic and automated reconfiguration of networks. The integration of SDN and IoT is a potentially feasible solution to strengthen the management and control capabilities of the IoT network [11]. For instance, the software-defined Internet of Things (SD-IoT) is favored in [12] and [13]. Liu et al. [14] proposed an SD-IoT architecture for smart urban sensing. Xiong et al. [11] proposed an SDN architecture for IoT and investigated the resource allocation problem in the proposed SD-IoT network. Kuang et al. [15] developed a transition tensor model for routing path recommendation by applying SDN technology to IoT for device management.

The denial of services attacks are generally described as actions where legitimate users or Institutions are dispossessed of certain services (network connectivity, web or e-mail). The distributed denial of services attacks are mainly used for flooding a particular server with huge useless information. The botnets are the major vectors to be taken into consideration to divert the DDoS attacks. There are more than 50% colleges attacked by cyber-attacks in one year, such as viruses/worms/trojans/malware, unauthorized access or DDoS. Those attacks may cause crash of campus network (system or device), network access interruption, service system and terminal system destruction, and illegal access, extremely affecting normal operation of campus network. The main goal is to perpetrate damage on the victim. Frequently the ulterior motives are personal reasons (a significant number of DDoS attacks are effected against home computers, presumably for purposes of revenge), or prestige (successful attacks on popular Web servers gain the respect of the hacker community). However, some DDoS attacks are performed for material gain (damaging a competitor’s resources or blackmailing companies) or for political reasons (a country at war could perpetrate attacks against its enemy’s critical resources, potentially enlisting a significant portion of the entire country’s computing power for this action). In some cases, the true victim of the attack might not be the actual target of the attack packets, but others who rely on the target’s correct operation [1]. The idea behind a DOS or DDoS attack is simple – it’s to take down the server. Normally attacks such as these are done to major sites as we pointed out earlier in this article, because they are high profile and affect a large amount of customers. There are different ways this can be done but they all do the same thing. DDoS threat attacks the following services [2]: • Network Bandwidth. • Server memory. • CPU usage. • Database space. • Hard disk Space. Our approach is to develop an improved algorithm by considering previously defined methodologies of snort IDS tool by adding a new approach in snort detection engine to identify the DoS and DDOS attacks. This engine filters all the files and loads the attacked or infected files into its loader by “.conf” file command. With the help of this, an efficient detection can be done. However, security, accuracy and reliability will be the main concern during the detection process. The main objective of the study is to analyze the problems, prospective and opportunities of various aspects in IDS Snort.