Detect and identify DDoS attacks from flash crowd based on self-similarity and Renyi entropy

Yan, Ruoyu; Xu, Guoyu; Qin, XueJing

doi:10.1109/cac.2017.8244075

Cited by 7 publications

(5 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The following attacks have been considered: SYN Flood, Smurf, and UDP Flood. Use of Hurst coefficient and Rényi entropy has been investigated in Reference 13. Self‐similarity is checked using the Hurst coefficient to detect the onset of a network anomaly (DoS attack or flash crowd event).…”

Section: The Related Workmentioning

confidence: 99%

On the use of generalized entropy formulas in detection of denial‐of‐service attacks

Basicevic

Blazic²,

Ocovaj

2020

Security and Privacy

View full text Add to dashboard Cite

In an earlier journal paper, we have presented the results of a comparison of the performance of five entropy‐based denial‐of‐service detectors (Shannon, Rényi, Tsallis, Bhatia‐Singh, and Ubriaco). The dataset used in that evaluation was generated using simulation. The best performance in terms of detection rate showed Rényi and Bhatia‐Singh detectors. In terms of the detection delay, the best detector was Ubriaco. In this paper, we decided to repeat the evaluation, but this time using a dataset generated using emulation. In this evaluation, the Tsallis entropy‐based detector showed the best performance, followed by the Bhatia‐Singh detector. It can be concluded that both evaluations show the advantage of the detectors based on generalized entropies, compared to the Shannon‐based one, and that Bhatia‐Singh detector in both evaluations performed very well. Another conclusion is that in terms of the detection rate, the flow size distribution outperforms the source port distribution, but in terms of the detection delay, the situation is the opposite.

show abstract

Section: The Related Workmentioning

confidence: 99%

On the use of generalized entropy formulas in detection of denial‐of‐service attacks

Basicevic

Blazic²,

Ocovaj

2020

Security and Privacy

View full text Add to dashboard Cite

show abstract

“…The authors of the article [21] used an autoregressive system for estimating the variance of the Hurst coefficient to detect changes in the flow. The use of self-similarity and Renyi entropy can be found in [22]. Fractal analysis is closely related to self-similarity; its application to detect attacks can be found in [23].…”

Section: Related Workmentioning

confidence: 99%

Machine Recognition of DDoS Attacks Using Statistical Parameters

Smiesko,

Segec,

Kontsek

2023

Mathematics

View full text Add to dashboard Cite

As part of the research in the recently ended project SANET II, we were trying to create a new machine-learning system without a teacher. This system was designed to recognize DDoS attacks in real time, based on adaptation to real-time arbitrary traffic and with the ability to be embedded into the hardware implementation of network probes. The reason for considering this goal was our hands-on experience with the high-speed SANET network, which interconnects Slovak universities and high schools and also provides a connection to the Internet. Similar to any other public-facing infrastructure, it is often the target of DDoS attacks. In this article, we are extending our previous research, mainly by dealing with the use of various statistical parameters for DDoS attack detection. We tested the coefficients of Variation, Kurtosis, Skewness, Autoregression, Correlation, Hurst exponent, and Kullback–Leibler Divergence estimates on traffic captures of different types of DDoS attacks. For early machine recognition of the attack, we have proposed several detection functions that use the response of the investigated statistical parameters to the start of a DDoS attack. The proposed detection methods are easily implementable for monitoring actual IP traffic.

show abstract

“…The authors of [16] used an autoregressive system for estimating the variance of the Hurst coefficient for the purpose of detecting changes in the flow. The research in [17] used self-similarity and Renyi entropy. The application of fractal analysis to detect attacks can be found in [18].…”

Section: Related Workmentioning

confidence: 99%

One-Parameter Statistical Methods to Recognize DDoS Attacks

et al. 2022

View full text Add to dashboard Cite

Within our academic high-speed network infrastructure which is used for connecting all universities and high schools in our country to the Internet, there are thousands of cybersecurity attacks occurring every day. That is why, within our SANET II project, an effort has been made to create a self-learning system without a teacher, which would be able to quickly adapt to arbitrary traffic and recognize DDoS attacks on time, even in high-speed networks, with a potential simple implementation into a hardware probe. In the article, we deal with the Hurst and autoregression coefficients and the coefficient of variation. We test the coefficients on simulated data and on real records of attacks. For early machine recognition of the attack, we propose the so-called predicting σ-tunnel. The obtained results can lead to the investigation of other prediction methods that would improve the early recognition of an attack.

show abstract

Detect and identify DDoS attacks from flash crowd based on self-similarity and Renyi entropy

Cited by 7 publications

References 12 publications

On the use of generalized entropy formulas in detection of denial‐of‐service attacks

On the use of generalized entropy formulas in detection of denial‐of‐service attacks

Machine Recognition of DDoS Attacks Using Statistical Parameters

One-Parameter Statistical Methods to Recognize DDoS Attacks

Contact Info

Product

Resources

About