Detection & study of DDoS attacks via entropy in data network models

Authors:
Anna T. Lawniczak;Bruno N. Di Stefano;Hao Wu
Affiliations:
The Fields Institute and Dept. Mathematics & Statistics, University of Guelph, Guelph, Ontario, Canada;Nuptek Systems Ltd., Toronto, Ontario, Canada;University of Guelph
Venue:
CISDA'09 Proceedings of the Second IEEE international conference on Computational intelligence for security and defense applications
Year:
2009

Citing 6
Cited 1

Communication Networks: Fundamental Concepts and Key Architectures

Communication Networks: Fundamental Concepts and Key Architectures
Netzwerk: Migration of a Packet-Switching Network Simulation Environment from MS Windows PC to Linux PC and to HPC

HPCS '05 Proceedings of the 19th International Symposium on High Performance Computing Systems and Applications
Monitoring the Macroscopic Effect of DDoS Flooding Attacks

IEEE Transactions on Dependable and Secure Computing
Detecting anomalies in network traffic using maximum entropy estimation

IMC '05 Proceedings of the 5th ACM SIGCOMM conference on Internet Measurement
DDoS attack detection algorithms based on entropy computing

ICICS'07 Proceedings of the 9th international conference on Information and communications security
Controlled Chaos [Internet Security]

IEEE Spectrum

Impact of coupling of distributed denial of service attack with routing on throughput of packet switching network

ACRI'10 Proceedings of the 9th international conference on Cellular automata for research and industry

Quantified Score

Hi-index	0.00

Visualization

Abstract

We detect & study packet traffic anomalies similar to DDoS attacks using information entropy. We perform network-wide monitoring of information entropy of packet traffic at a small number of selected routers. Our method is based on the fact that DDoS attacks change the "natural" order and randomness of packet traffic passing through monitored routers when an attack is taking place in the network. Through this change we detect the start of the attack and study its evolution. We conduct this study for packet-switching networks using static and dynamic routing.