A Lightweight Detection Using Bloom Filter against Flooding DDoS Attack

Abstract

The flooding DDoS attack is a serious problem these days. In order to detect the flooding DDoS attack, the survival approaches and the mitigation approaches have been investigated. Since the survival approach occurs the burden on the victims, the mitigation approach is mainly studied. As for the mitigation approaches, to detect the flooding DDoS attack, the conventional schemes using the bloom filter, machine learning, and pattern analyzation have been investigated. However, those schemes are not effective to ensure the high accuracy (ACC), the high true positive rate (TPR), and the low false positive rate (FPR). In addition, the data size and calculation time are high. Moreover, the performance is not effective from the fluctuant attack packet per second (pps). In order to effectively detect the flooding DDoS attack, we propose the lightweight detection using bloom filter against flooding DDoS attack. To detect the flooding DDoS attack and ensure the high accuracy, the high true positive rate, and the low false positive rate, the dec-all (decrement-all) operation and the checkpoint are flexibly changed from the fluctuant pps in the bloom filter. Since we only consider the IP address, all kinds of flooding attacks can be detected without the blacklist and whitelist. Moreover, there is no complexity to recognize the attack. By the computer simulation with the datasets, we show our scheme achieves an accuracy of 97.5%. True positive rate and false positive rate show 97.8% and 6.3%, respectively. The data size for processing is much small as 280bytes. Furthermore, our scheme can detect the flooding DDoS attack at once in 11.1sec calculation time.

Distributed Denial of Service (DDoS) Mitigation Using Blockchain—A Comprehensive Insight

“…A 1.7 TBps attack was reported later following the attack on GitHub [13]. Some established banks were severely affected by a peak 160 Gbps and 32 million packets per second DDoS attack in April 2019 [14]. Monetary losses of about $491 billion were reported in 2014 alone [11].…”

“…It is predicted that DDoS attacks will double from 7.9 million in 2018 to 15.4 million by 2023 [16]. These numbers, attack traffic and timings clearly indicate the threat severity of DDoS attacks [14].…”