Distributed Denial of Service DDoS detection by

Authors: Theerasak Thapngam Shui Yu Wanlei Zhou S Kami Makki

Publish Date: 2012/10/25

Volume: 7, Issue: 4, Pages: 346-358

PDF Link

Abstract

In this paper we propose a behaviorbased detection that can discriminate Distributed Denial of Service DDoS attack traffic from legitimated traffic regardless to various types of the attack packets and methods Current DDoS attacks are carried out by attack tools worms and botnets using different packettransmission rates and packet forms to beat defense systems These various attack strategies lead to defense systems requiring various detection methods in order to identify the attacks Moreover DDoS attacks can craft the traffics like flash crowd events and fly under the radar through the victim We notice that DDoS attacks have features of repeatable patterns which are different from legitimate flash crowd traffics In this paper we propose a comparable detection methods based on the Pearson’s correlation coefficient Our methods can extract the repeatable features from the packet arrivals in the DDoS traffics but not in flash crowd traffics The extensive simulations were tested for the optimization of the detection methods We then performed experiments with several datasets and our results affirm that the proposed methods can differentiate DDoS attacks from legitimate traffics

Keywords: