Detection System of HTTP DDoS Attacks in a Cloud Environment Based on Information Theoretic Entropy and Random Forest
| Autor: | Karim Afdel, Mohamed Idhammad, Mustapha Belouch |
|---|---|
| Rok vydání: | 2018 |
| Předmět: |
Web server
Hypertext Transfer Protocol Article Subject Computer Networks and Communications Computer science computer.internet_protocol Denial-of-service attack Cloud computing 02 engineering and technology computer.software_genre Sliding window protocol lcsh:Technology (General) Header 0202 electrical engineering electronic engineering information engineering lcsh:Science (General) business.industry 020206 networking & telecommunications Ensemble learning Random forest lcsh:T1-995 020201 artificial intelligence & image processing Data mining business computer lcsh:Q1-390 Information Systems |
| Zdroj: | Security and Communication Networks, Vol 2018 (2018) |
| ISSN: | 1939-0122 1939-0114 |
| DOI: | 10.1155/2018/1263123 |
| Popis: | Cloud Computing services are often delivered through HTTP protocol. This facilitates access to services and reduces costs for both providers and end-users. However, this increases the vulnerabilities of the Cloud services face to HTTP DDoS attacks. HTTP request methods are often used to address web servers’ vulnerabilities and create multiple scenarios of HTTP DDoS attack such as Low and Slow or Flooding attacks. Existing HTTP DDoS detection systems are challenged by the big amounts of network traffic generated by these attacks, low detection accuracy, and high false positive rates. In this paper we present a detection system of HTTP DDoS attacks in a Cloud environment based on Information Theoretic Entropy and Random Forest ensemble learning algorithm. A time-based sliding window algorithm is used to estimate the entropy of the network header features of the incoming network traffic. When the estimated entropy exceeds its normal range the preprocessing and the classification tasks are triggered. To assess the proposed approach various experiments were performed on the CIDDS-001 public dataset. The proposed approach achieves satisfactory results with an accuracy of 99.54%, a FPR of 0.4%, and a running time of 18.5s. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|
Plný text