Detection of Application Layer DDoS Attack Based on SIS Epidemic Model

Abstract

Distrusted Denial of Service attack (DDoS) is one of the major threats to network security. The HTTP flooding attack is the hardest type of DDoS attacks to detect since the malicious packets are hidden in a huge amount of normal traffic. In this work, we introduce a new detection scheme for HTTP flooding attack by using Susceptible-Infective-Susceptible (SIS) model of an infectious disease which used in dynamic systems. During any time interval, the server can measure various values of attributes for its users like number of total connections, number of open connections and number of closed connections. These values can be used to detect any abnormal behavior or infected connections in a server by mapping this attributes with SIS model. Thus we can get suspected and infected connections during every time interval. Extensive trace driven simulation has been conducted to demonstrate the efficiency of the proposed scheme in terms of its detection rate and probability of false positive. INDEX TERMS Intrusion detection, DDoS attack, HTTP protocol, SIS epidemic model.

VIQS Epidemic Modeling of Distributed Denial-of-Service Attacks in Software-Defined Networking

“…Many approaches have been applied to mitigate DDoS attacks including entropy mechanism ( [8], [9], [10] and [11]), blockchain method ( [12], [13], [14] and [15]), machine learning approach ( [16], [17], [18] and [19]), statistical technique ( [20], [21] and [22]) and epidemic approach [23], [24], [25], [26], [27], [28], [29] and [30]). Though, each of these approaches has contributed to some extents to the mitigation of DDoS attacks in networks.…”

“…Therefore, several existing works have considered the epidemic approach in tackling the spread of attacks in a network environment such as SIS (susceptible, infected, susceptible), SEIRS (susceptible, exposed, infected, recovered, susceptible) and SEIR (susceptible, exposed, infected, recovered) epidemic models. The surveys [24] and [25] employed a SIS epidemic model to analyse the spread of malware in networks. The SIS has been considered to be the simplest of the epidemic models.…”