Probability principle of a reliable approach to detect signs of DDOS flood attacks

Authors:
Ming Li;Jingao Liu;Dongyang Long
Affiliations:
School of Information Science & Technology, East China Normal University, Shanghai, P.R. China;School of Information Science & Technology, East China Normal University, Shanghai, P.R. China;Department of Computer Science, Zhongshan University, Guangzhou, P.R. China
Venue:
PDCAT'04 Proceedings of the 5th international conference on Parallel and Distributed Computing: applications and Technologies
Year:
2004

Citing 7
Cited 2

A practical guide to heavy tails: statistical techniques and applications

A practical guide to heavy tails: statistical techniques and applications
Traffic analysis: protocols, attacks, design issues, and open problems

International workshop on Designing privacy enhancing technologies: design issues in anonymity and unobservability
Intrusion Detection

Intrusion Detection
Random Data: Analysis and Measurement Procedures

Random Data: Analysis and Measurement Procedures
Denial-of-Service Attacks Rip the Internet

Computer
Intrusion detection: a brief history and overview

Computer
Traffic models in broadband networks

IEEE Communications Magazine

A comprehensive taxonomy of DDOS attacks and defense mechanism applying in a smart classification

WSEAS Transactions on Computers
Derivations of error bound on recording traffic time series with long-range dependence

ICIC'05 Proceedings of the 2005 international conference on Advances in Intelligent Computing - Volume Part I

Quantified Score

Hi-index	0.00

Visualization

Abstract

Attentions are increasingly paid to reliable detection of intrusions as can be seen from [1, 2]. As a matter of fact, the challenge is to develop a system that detects close to 100 percent of attacks with minimal false positives. We are still far from achieving this goal [1, p. 28]. In this regard, our early work discusses a reliable approach regarding detection of signs of distributed denial-of-service (DDOS) attacks [3], where arrival time series of a protected site is specifically featured by autocorrelation function. As a supplementary to [3], this article specifically focuses on abstractly discussing probability principle involved in [3] such that the present probability principle of detection is flexible in practical applications. In addition to this, the selection of a threshold for a given detection probability is also given.