Detection of anomalous packet traffic via entropy

Abstract

We study if information entropy of packet traffic passing through selected set of routers may detect anomalous packet traffic (e.g., distributed denial-of-service (DDoS) attacks) in a packet switching network (PSN) model. Given a certain PSN model setup (i.e., topology, routing algorithm, and source load value) a "natural" entropy profile of normal packet traffic monitored at selected routers characterizes normal operation of PSN model. When entropy of packet traffic deviates significantly from this "natural" profile it means that some anomaly in packet traffic emerges. Our simulations of ping DDoS attacks show that after start of attacks the entropy of packet traffics monitored networkwide at relatively small sets of routers may significantly drop and that it is easier to detect these drops if static routing is used instead of dynamic routing. Thus, for detection of DDoS attacks and other anomalous packet traffic information entropy of packet traffic monitored network-wide at properly selected routers can be a useful tool.Index Terms -distributed denial of service attack, detection, packet switching network, entropy

A Novel Protective Framework for Defeating HTTP‐Based Denial of Service and Distributed Denial of Service Attacks

“…FAEB scheme does so periodically based on the adopted time in the module's configuration by calculating entropy of overall requests through the following formulas [50–55]: $\begin{array}{c}\text{entropy}=\text{Pi}\hspace{0.17em}\ast {\log }_{\mathrm{2}}\text{Pi},\\ \text{Pi}=\frac{\text{uri}\_\text{counts}}{\text{total}\_\text{counts}}.\end{array}$ …”

A DoS Detection Method Based on Composition Self-Similarity

“…In other words, the statistically self-similar models in these papers only focus on the changes of traffic value not considering the impact of distributional aspects of packet (called packet composition). Intuitively, DoS attacks are purposely created by humans they must affect the natural "structure and randomness" of packet under normal conditions [9]. Jiangtao Shi [10] controlled the number of packets with statistically self-similar model, however, the generation of IP address and Port is based on probabilities.…”

“…Second, unusual distributions reveal valuable information about the structure of anomalies. Current research in the traffic composition mainly relies on the theory of entropy [9][11] [12][13] by which network anomalies can be detected. However, the flaw of entropy methodology is that it can only reflect the overall trend of traffic and not sensitive to the dynamics of traffic specific composition.…”