DDoS Attack Detection Algorithm Using IP Address Features

Authors:
Jieren Cheng;Jianping Yin;Yun Liu;Zhiping Cai;Min Li
Affiliations:
School of Computer, National University of Defense Technology, Changsha, China 410073 and Department of mathematics, Xiangnan University, Chenzhou, China 423000;School of Computer, National University of Defense Technology, Changsha, China 410073;School of Computer, National University of Defense Technology, Changsha, China 410073;School of Computer, National University of Defense Technology, Changsha, China 410073;School of Computer, National University of Defense Technology, Changsha, China 410073
Venue:
FAW '09 Proceedings of the 3d International Workshop on Frontiers in Algorithmics
Year:
2009

Citing 8
Cited 0

A Tutorial on Support Vector Machines for Pattern Recognition

Data Mining and Knowledge Discovery
Diagnosing network-wide traffic anomalies

Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications
Mining anomalies using traffic feature distributions

Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications
MULTOPS: a data-structure for bandwidth attack detection

SSYM'01 Proceedings of the 10th conference on USENIX Security Symposium - Volume 10
Robust and efficient detection of DDoS attacks for large-scale internet

Computer Networks: The International Journal of Computer and Telecommunications Networking
DDoS attack detection method using cluster analysis

Expert Systems with Applications: An International Journal
Compiling network traffic into rules using soft computing methods for the detection of flooding attacks

Applied Soft Computing
Network intrusion and fault detection: a statistical anomaly approach

IEEE Communications Magazine

Quantified Score

Hi-index	0.00

Visualization

Abstract

Distributed denial of service (DDoS) attack is one of the major threats to the current Internet. After analyzing the characteristics of DDoS attacks and the existing Algorithms to detect DDoS attacks, this paper proposes a novel detecting algorithm for DDoS attacks based on IP address features value (IAFV). IAFV is designed to reflect the essential DDoS attacks characteristics, such as the abrupt traffic change, flow dissymmetry, distributed source IP addresses and concentrated target IP addresses. IAFV time series can be used to characterize the essential change features of network flows. Furthermore, a trained support vector machine (SVM) classifier is applied to identify the DDoS attacks. The experimental results on the MIT data set show that our algorithm can detect DDoS attacks accurately and reduce the false alarm rate drastically.