Entity-based Parameterization for Distinguishing Distributed Denial of Service from Flash Events

Abstract

In a perfect condition, there are only normal network traffic and sometimes flash event traffics due to some eye-catching or heartbreaking events. Nevertheless, both events carry legitimate requests and contents to the server. Flash event traffic can be massive and damaging to the availability of the server. However, it can easily be remedied by hardware solutions such as adding extra processing power and memory devices and software solution such as load balancing. In contrast, a collection of illegal traffic requests produced during distributed denial of service (DDoS) attack tries to cause damage to the server and thus is considered as dangerous where prevention, detection and reaction are imminent in case of occurrence. In this paper, the detection of attacks by distinguishing it from legal traffic is of our main concern. Initially, we categorize the parameters involved in the attacks in relation to their entities. Further, we examine different concepts and techniques from information theory and image processing domain that takes the aforementioned parameters as input and in turn decides whether an attack has occurred. In addition to that, we also pointed out the advantages for each technique, as well as any possible weakness for possible future works.

Bibliometric Analysis of Higher Education Restructuring

“…The Silhoutte value (Chen, 2006), which provides information about the homogeneity of the structure of the clusters, is characterized as "excellent" in the range of 0.71-1 (Mamat et al, 2018). In this context, when the Silhoutte values for the clusters in Table 1 are examined, it is seen that all values are higher than 0.7.…”

Implementing Flash Event Discrimination in IP Traceback using Shark Smell Optimisation Algorithm

“…to deduce if they are from the same node or different nodes [10]. There are usually more packets per IP address in the DoS traffic than what may occur in the case of flash event traffic but their patterns are very similar as shown by [9] illustration.…”