Characterizing DDoS attack distributions from emulation based experiments on DETER testbed
ADCONS'11 Proceedings of the 2011 international conference on Advanced Computing, Networking and Security
| Hi-index | 0.01 |
Measurements on a high-performance Ethernet areshown to match well a truncated Cauchy probability distribution,with a much better fit over smaller file/request sizesthan the commonly used Pareto distribution. We observeself similar characteristics in the traffic at both file serversand at a CPU server elsewhere in the network, which targets,predominantly, file and web servers. This suggestspropagation of self similarity. A simulation model of a singleserver with Poisson arrivals and Cauchy service demandsyields a departure process that follows a power lawand matches closely the observed traffic. This suggests alink between file/request size distribution and self similarityin traffic, leading to the possibility of using conventionalqueueing network performance models with processor sharingqueueing discipline. This idea is further supported by anadditional simulation experiment and suitable models areproposed.