Distinguishing flooding distributed denial of service from flash crowds using four data mining approaches

Abstract

Flooding Distributed Denial of Service (DDoS) attacks can cause significant damage to Internet. These attacks have many similarities to Flash Crowds (FCs) and are always difficult to distinguish. To solve this issue, this paper first divides existing methods into two categories to clarify existing researches. Moreover, after conducting an extensive analysis, a new feature set is concluded to profile DDoS and FC. Along with this feature set, this paper proposes a new method that employs Data Mining approaches to discriminate between DDoS attacks and FCs. Experiments are conducted to evaluate the proposed method based on two realworld datasets. The results demonstrate that the proposed method could achieve a high accuracy (more than 98%). Additionally, compared with a traditional entropy method, the proposed method still demonstrates better performance.

Security Data Collection and Data Analytics in the Internet: A Survey

“…The traffic of DDoS flooding attacks launched by a Botnet is quite different from flow crowds. Kong et al [56] identified some statistical features to discriminate DDoS flooding attacks from flash crowds, such as the number of unique source addresses in each interval, the number of increased source addresses in adjacent interval, the average of the number of packets sent by source addresses in each interval, and the standard of the number of packets sent by source addresses in each interval. With these features, traffic is classified by employing some supervised methods.…”

“…in statistical methods is quite necessary [45-48, 51, 52]. Machine learning-based detection methods often select some important characteristics of traffic features that can reflect that the traffic is generated by a botnet, to classify attack traffic [53][54][55][56][57][59][60][61][62].…”