Distributed Denial of Service (DDoS) detection by traffic pattern analysis
| Autor: | Wanlei Zhou, S. Kami Makki, Theerasak Thapngam, Shui Yu |
|---|---|
| Rok vydání: | 2012 |
| Předmět: |
Computer Networks and Communications
Computer science Network packet business.industry ComputerSystemsOrganization_COMPUTER-COMMUNICATIONNETWORKS Application layer DDoS attack Botnet Denial-of-service attack Airfield traffic pattern Flash crowd Anomaly detection business Trinoo Software Computer network |
| Zdroj: | Peer-to-Peer Networking and Applications. 7:346-358 |
| ISSN: | 1936-6450 1936-6442 |
| Popis: | In this paper, we propose a behavior-based detection that can discriminate Distributed Denial of Service (DDoS) attack traffic from legitimated traffic regardless to various types of the attack packets and methods. Current DDoS attacks are carried out by attack tools, worms and botnets using different packet-transmission rates and packet forms to beat defense systems. These various attack strategies lead to defense systems requiring various detection methods in order to identify the attacks. Moreover, DDoS attacks can craft the traffics like flash crowd events and fly under the radar through the victim. We notice that DDoS attacks have features of repeatable patterns which are different from legitimate flash crowd traffics. In this paper, we propose a comparable detection methods based on the Pearson’s correlation coefficient. Our methods can extract the repeatable features from the packet arrivals in the DDoS traffics but not in flash crowd traffics. The extensive simulations were tested for the optimization of the detection methods. We then performed experiments with several datasets and our results affirm that the proposed methods can differentiate DDoS attacks from legitimate traffics. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|
Full text from SpringerLink