Fast Detection of Ddos Attacks Using Non-Adaptive Group Testing

Abstract

Network security has become more important role today to personal users and organizations. Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) attacks are serious problem in network. The major challenges in design of an efficient algorithm in data stream are one-pass over the input, poly-log space, poly-log update time and poly-log reporting time. In this paper, we use strongly explicit construction d-disjunct matrices in Non-adaptive group testing (NAGT) to adapt these requirements and propose a solution for fast detecting DoS and DDoS attacks based on NAGT approach.

Development of a system for the detection of cyber attacks based on the clustering and formation of reference deviations of attributes

“…As a criterion of the optimization of parameters, during ASR learning, we used statistical parameters (information measures) for the variants of solutions with two alternatives [18,25,26] for a modified entropic indicator, as well as the Kullback-Leibler divergence (for three hypotheses) [27]. Table 1 Stages of splitting FS into clusters…”

Fast detecting Hot-IPs in high speed networks

“…Detecting risks at an area can help to warn the others early. In the work of Chinh et al [6][7], they can quickly detect Hot-IPs in network using Non-adaptive Group testing method. This approach can be applied in some applications in data stream, such as: detecting DDoS attackers, Internet worms and networking anomalies.…”

“…We can generate -disjunct d matrices as defined in Section II and support the number of hosts as much as we want. In our experiments, we used 3 matrices which were generated from 8 [7,3 We tested many cases with different hosts sending packets at the same time, and the results are described in Table 1 (we ignore time to capture packets, we only count the time to decode captured packets).…”

A Review on Hot-IP Finding Methods and Its Application in Early DDoS Target Detection

“…IP addresses with a high occurrence frequency in the IP packet stream are called Hot-IPs. Therefore, the problem of target detection of DDoS attacks or the detection of network worm sources can be solved by monitoring the IP packet stream transferred through the network to find Hot-IPs [1][2][3].…”

“…Huynh et al [1,2] proposed to use the non-adaptive Group Testing method for fast finding of Hot-IPs in the IP packet stream and to apply the results in the detection of DDoS attacks and network worm spreading sources. Since the computational complexity of the Group Testing method (O(tN), where N is the number of unique IP addresses and t is the number of tests) is relatively high, it is not efficient for the processing of the IP packet stream in heavy traffic [1].…”