Proactively Detecting Distributed Denial of Service Attacks Using Source IP Address Monitoring

Peng, Tao; Leckie, Christopher; Ramamohanarao, Kotagiri

doi:10.1007/978-3-540-24693-0_63

Cited by 130 publications

(74 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…There is a possibility that the abovementioned assumptions will not always be true and, if not, the performance of the anomaly detection algorithm will be jeopardized; for example, DoS attack traffic instances do not follow these assumptions [11]. As DoS attacks are not significantly different from normal traffic and also occur in a similar fashion, their behaviors lead to the following assumption.…”

Section: Motivationmentioning

confidence: 99%

See 1 more Smart Citation

Novel Approach for Network Traffic Pattern Analysis using Clustering-based Collective Anomaly Detection

Ahmed

Mahmood

2015

Ann. Data. Sci.

View full text Add to dashboard Cite

There is increasing interest in the data mining and network management communities in improving existing techniques for the prompt analysis of underlying traffic patterns. Anomaly detection is one such technique for detecting abnormalities in many different domains, such as computer network intrusion, gene expression analysis, financial fraud detection and many more. Clustering is a useful unsupervised method for both identifying underlying patterns in data and anomaly detection. However, existing clustering-based techniques have high false alarm rates and consider only individual data instances for anomaly detection. Interestingly, there are traffic flows which seem legitimate but are targeted at disrupting a normal computing environment, such as the Denial of Service (DoS) attack. The presence of such anomalous data instances explains the poor performances of existing clustering-based anomaly detection techniques. In this paper, we formulate the problem of detecting DoS attacks as a collective anomaly which is a pattern in the data when a group of similar data instances behave anomalously with respect to the entire dataset. We propose a framework for collective anomaly detection using a partitional clustering technique to detect anomalies based on an empirical analysis of an attack's characteristics. We validate our approach by comparing its results with those from existing techniques using benchmark datasets.

show abstract

Section: Motivationmentioning

confidence: 99%

“…We measured the accuracy of our approach using the standard confusion metrics true positive (TP), false positive (FP), true negative (TN) and false negative (FN) computed using equation (11).…”

Section: Accuracymentioning

confidence: 99%

Novel Approach for Network Traffic Pattern Analysis using Clustering-based Collective Anomaly Detection

Ahmed

Mahmood

2015

Ann. Data. Sci.

View full text Add to dashboard Cite

show abstract

“…Peng [3] detected attacks by monitoring the number of new source IP addresses in a given time period based on the observation [2] that the majority of the source IP addresses of incoming packets are new to the victim during attacks but appeared before in flash crowds. Sun [4] proposed a detection method based on FCD (Flow Connection Density).…”

Section: Introductionmentioning

confidence: 99%

Anomaly Detection for DDoS Attacks Based on Gini Coefficient

Liu¹,

Jiang²,

Huang³

2013

Proceedings of the 2013 International Conference on Advanced ICT

View full text Add to dashboard Cite

Distributed Denial-of-Service (DDoS) attacks present a very serious threat to the stability of the Internet. In this paper, an anomaly detection method for DDoS attacks based on Gini coefficient is proposed. First, Gini coefficient is introduced to measure the inequalities of packet attribution (IP addresses and ports) distributions during attacks. Then, an improved TCM-KNN algorithm is applied to identify attacks by classifying the Gini coefficient samples extracted from realtime network traffic. The experimental results demonstrate that the proposed method can effectively distinguish DDoS attacks from normal traffic, and has higher detection ratio and lower false alarm ratio than similar detection methods.

show abstract

“…For example, Peng et al [10] proposed to use the number of new source IP addresses as a feature to detect DDoS attacks, under the assumption that source addresses of IP packets observed at an edge router were relatively static in normal conditions than those during DDoS attacks. The paper further pointed out that the feature could differentiate DDoS attacks from the flash crowd, which represents the situation when many legitimate users start to access one service at the same time, e.g., when many people watch a live sports broadcast over the Internet at the same time.…”

Section: Introductionmentioning

confidence: 99%

“…Therefore, the feature of the number of new source IP addresses improves those DDoS detection schemes that rely on traffic rate only. However, Peng et al [10] focused on detection of DDoS attacks. It did not mention other types of network anomalies.…”

Section: Introductionmentioning

confidence: 99%

An efficient data structure for network anomaly detection

Fan

et al. 2008

Security Comm Networks

View full text Add to dashboard Cite

Abstract-Despite the rapid advance in networking technologies, detection of network anomalies at high-speed switches/routers is still far from maturity. To push the frontier, two major technologies need to be addressed. The first one is efficient feature-extraction algorithms/hardware that can match a line rate in the order of Gb/s; the second one is fast and effective anomaly detection schemes. In this paper, we focus on design of efficient data structure and algorithms for feature extraction. Specifically, we propose a novel data structure that extracts socalled two-directional (2D) matching features, which are shown to be effective indicators of network anomalies. Our key idea is to use a Bloom filter array to trade off a small amount of accuracy in feature extraction, for much less space and time complexity, so that our data structure can catch up with a line rate in the order of Gb/s. Different from the existing work, our data structure has the following properties: 1) dynamic Bloom filter, 2) combination of a sliding window with Bloom filter, and 3) using an insertion-removal pair to enhance Bloom filter with a removal operation. Our analysis and simulation demonstrate that the proposed data structure has a better space/time tradeoff than conventional algorithms. For example, for a fixed time complexity, the conventional algorithm (i.e., hash table [1]-[8]) requires a memory of 1.01G bits while our data structure requires a memory of only 62.9M bits, at the cost of losing 1% accuracy in feature extraction.

show abstract

Proactively Detecting Distributed Denial of Service Attacks Using Source IP Address Monitoring

Cited by 130 publications

References 7 publications

Novel Approach for Network Traffic Pattern Analysis using Clustering-based Collective Anomaly Detection

Novel Approach for Network Traffic Pattern Analysis using Clustering-based Collective Anomaly Detection

Anomaly Detection for DDoS Attacks Based on Gini Coefficient

An efficient data structure for network anomaly detection

Contact Info

Product

Resources

About