Detection of spoofed and non-spoofed DDoS attacks and discriminating them from flash crowds

Abstract

Distributed computing technology is widely used by Internet-based business applications. Supply chain management (SCM), customer relationship management (CRM), e-Commerce, and banking are some of the applications employing distributed computing. These applications are the main target to massive attacks known as distributed denial-of-service (DDoS) that cause a denial of service or degradation of services being rendered. The servers that provide reliable services to genuine users in a distributed environment are victims of such attacks that flood fake requests that appear genuine. Flash crowd, on the other hand, is the huge amount of traffic caused by certain flash events (FEs) that mimics DDoS attacks. Detection of DDoS attacks in the wake of flash crowds is a challenging problem to be addressed. The existing solutions are generally meant for either flash crowds or DDoS attacks and more research is needed to have a comprehensive approach for catering to the needs of detection of spoofed and non-spoofed variants of DDoS attacks. This paper proposes a methodology that can detect aforementioned DDoS attacks and differentiate them from flash crowds. NS-2 simulations are carried out on Ubuntu platform for validating the effectiveness of the proposed methodology.

A robust intelligent zero-day cyber-attack detection technique

“…Some genuine events also behave like a variant of DoS/ DDoS ZAs. These events are known as flash events [51]. Due to these events, the traffic load on a server suddenly increases.…”

“…The ticket booking load on railway server in some festive season are also the example of flash events. To avoid such an ambiguous case, plenty of work exists specifically to detect whether the network traffic is due to a flash event or not [51]. If that is the case, the detector module will allow the traffic to pass through.…”

“…If that is the case, the detector module will allow the traffic to pass through. In this paper, it is assumed that a flash event is already a detector which is implemented separately using existing methods [51][52][53][54][55]. It is placed in the network to detect whether traffic load is due to a flash event or HVA.…”

“…This module first checks any incoming traffic is a flash event or not. If it finds any flash event on the network, network load sharing or other techniques [51][52][53][54][55] is triggered to prevent the network failure. Otherwise, the traffic is sent to the detection module for any ZA detection.…”

Cybersecurity: trends, issues, and challenges

“…Finally, the paper "Detection of Spoofed and Non-Spoofed DDoS Attacks and Discriminating them from Flash Crowds" by Gera Jaideep and Bhanu Prakash Battula [6] focuses on introducing a novel methodology that is able to detect different types of DDoS attacks. Moreover, the proposed solution is able to differentiate such attacks from the benign flash crowd effect (which currently is perceived as a very challenging task).…”