Detecting DDoS Attacks Using Dispersible Traffic Matrix and Weighted Moving Average

Authors:
Tae Hwan Kim;Dong Seong Kim;Sang Min Lee;Jong Sou Park
Affiliations:
Dept. of Computer Engineering, Korea Aerospace University, Seoul, South Korea;Dept. of Electrical and Computer Engineering, Duke University, Durham, USA;Dept. of Computer Engineering, Korea Aerospace University, Seoul, South Korea;Dept. of Computer Engineering, Korea Aerospace University, Seoul, South Korea
Venue:
ISA '09 Proceedings of the 3rd International Conference and Workshops on Advances in Information Security and Assurance
Year:
2009

Citing 5
Cited 1

On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internets

Proceedings of the 2001 conference on Applications, technologies, architectures, and protocols for computer communications
Attacking DDoS at the Source

ICNP '02 Proceedings of the 10th IEEE International Conference on Network Protocols
A taxonomy of DDoS attack and DDoS defense mechanisms

ACM SIGCOMM Computer Communication Review
MULTOPS: a data-structure for bandwidth attack detection

SSYM'01 Proceedings of the 10th conference on USENIX Security Symposium - Volume 10
DDoS attack detection method using cluster analysis

Expert Systems with Applications: An International Journal

Detection of DDoS attacks using optimized traffic matrix

Computers & Mathematics with Applications

Quantified Score

Hi-index	0.00

Visualization

Abstract

Distributed Denial of Service (DDoS) attacks have become significant threats on Internet according to the development of network infrastructure and recent communication technology. There are various types of DDoS attacks with different characteristics. These differences have made very difficult to detect such attacks. Furthermore, the sophisticated the evolution of DDoS attacks techniques and the enhanced scale of Botnet encourage attackers to launch DDoS attacks. The IP spoofing technique also makes difficult detect and traceback of DDoS attacks. In this paper, we propose a new detection model for spoofed DDoS attacks using dispersible traffic matrix and weighted moving average. This proposed detection model can not only visualize network traffic streams but also describe the dispersibility characteristics of DDoS attacks such as intensity, duration and rate of DDoS traffic. We carry out experiments on both DARPA 2000 dataset and real data in our network testbed environments so as to validate the feasibility of our approach. Our approach demonstrates that it effectively detects the DDoS attacks in the early stage and in very short time, even though DDoS attacks' streams are low. Also, the proposed detection model shows a good performance in terms of detection accuracy, speed, and false alarms.