No abstract

The threat of Distributed Denial of Service (DDoS) has become a major issue in network security and is difficult to detect because all DDoS traffics have normal packet characteristics. Various detection and defense algorithms have been studied. One of them is an entropy-based intrusion detection approach that is a powerful and simple way to identify abnormal conditions from network channels. However, the burden of computing information entropy values from heavy flow still exists.To reduce the computing time, we have developed a DDoS detection scheme using a compression entropy method. It allows us to significantly reduce the computation time for calculating information entropy. However, our experiment suggests that the compression entropy approach tends to be too sensitive to verify real network attacks and produces many false negatives. In this paper, we propose a fast entropy scheme that can overcome the issue of false negatives and will not increase the computational time. Our simulation shows that the fast entropy computing method not only reduced computational time by more than 90% compared to conventional entropy, but also increased the detection accuracy compared to conventional and compression entropy approaches.

The requirements of grand challenge problems and the deployment of gigabit networks makes the network computing framework an attractive and cost effective computing environment with which t o interconnect geographically distributed processing and storage resources. Our project, Virtual Distributed Computing Environment ( V D C E ) , provides a problem-solving environment f o r high-performance distributed computing over wide area networks. V D C E delivers well-defined library functions that relieve end-users of tedious task implementations and also support reusability. I n this paper we present the conceptual design of V D C E software architecture, which is defined in three modules: a) the Application Editor, a user-friendly application development environment that generates the Application Flow Graph ( A F G ) of an application; b) the A pplication Scheduler, which provides an efficient task-toresource mapping of AFG; and c ) the V D C E Runtime System, which is responsible for running and managing application execution and monitoring the VDCE resources. I n t r o d u c t i o nGrand challenge problems have computational and storage resource requirements that are beyond the capacities of a single computing environment. Addition-*This research is supported by Rome Lab contract number F30602-95-C-0104. ally, emerging network technologies such as fiber-optic transmission facilities and the Asynchronous Transfer Mode (ATM) enable data to be transferred at the rate of a gigabit per second (Gbps). A high-speed network of geographically distributed heterogeneous resources represents a cost-effective, network-based computing environment for solving large-scale problems addressed by grand and national challenges. New software development models and problem solving environments are being developed to utilize efficiently the network computing environment.The software development process of parallel and distributed applications can be broadly described in terms of three phases: a) application development and specification, b) application scheduling and resource configuration, and c) application execution and runtime. Most of the related work so far has focused only on one or two of these phases; only a very few projects have completely addressed all phases of software development.The first phase, i.e, parallel and distributed application development and specification phase, overwhelms most users because of the difficulty of expressing communication and synchronization among computations 131. Some text-based parallel programming environments support the data-parallel paradigm, which requires advanced compilation techniques and compilers. Most of the other environments require explicit insertion of communication and synchronization primitives within the programs, which makes programs difficult to understand. Over the last few years a number 40

No abstract

Recently, the threat of DDoS (Distributed Denial-of-Service) attacks is growing continuously and acquiring attacking tools via Internet is getting easy. One of the researches introduced a fast method to detect attacks using modified information entropy (so called Fast Entropy). Fast Entropy shows the significant reduce of computational time compared to conventional entropy computation while it maintains detection accuracy. However, Fast Entropy needs the manual threshold settings during detection process which is not realistic in real detection facility. We introduce adaptive detector with dynamic detection window size and adaptive threshold shifting using Fast Entropy, called AFEA (Adaptive DDoS attack detection using Fast Entropy Approach). Our adaptive DDoS detector successfully demonstrates that its performance of the DDoS detection can be enhanced by the best result of Fast Entropy detection scheme without manual threshold setting and system training while it maintains the same computational time of Fast Entropy detection scheme. In addition, we found that Dynamic AFEA can enhance detection level more than fixed (non-dynamic) one when it is equipped with Fast Entropy.