Systematic review of aspects of DDoS attacks detection

Bravo, Silvia; Mauricio, David

doi:10.11591/ijeecs.v14.i1.pp155-168

Cited by 10 publications

(8 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Network behavior-based detection techniques are presented in [18], where the investigation of a large amount of normal traffic and amount of malicious traffic is provided. In [19,20] the systematic review of aspects of DDoS attacks detection and new frameworks are investigated.…”

Section: Methodsmentioning

confidence: 99%

Detection of the botnets’ low-rate DDoS attacks based on self-similarity

Lysenko¹,

Bobrovnikova²,

Matiukh³

et al. 2020

IJECE

View full text Add to dashboard Cite

An article presents the approach for the botnets’ low-rate a DDoS-attacks detection based on the botnet’s behavior in the network. Detection process involves the analysis of the network traffic, generated by the botnets’ low-rate DDoS attack. Proposed technique is the part of botnets detection system – BotGRABBER system. The novelty of the paper is that the low-rate DDoS-attacks detection involves not only the network features, inherent to the botnets, but also network traffic self-similarity analysis, which is defined with the use of Hurst coefficient. Detection process consists of the knowledge formation based on the features that may indicate low-rate DDoS attack performed by a botnet; network monitoring, which analyzes information obtained from the network and making conclusion about possible DDoS attack in the network; and the appliance of the security scenario for the corporate area network’s infrastructure in the situation of low-rate attacks.

show abstract

Section: Methodsmentioning

confidence: 99%

Detection of the botnets’ low-rate DDoS attacks based on self-similarity

Lysenko¹,

Bobrovnikova²,

Matiukh³

et al. 2020

IJECE

View full text Add to dashboard Cite

show abstract

“…The study has unique features relevant to the systematic review process. The work in [27] is a systematic review of aspects of distributed denial of service attacks (DDoS). The paper conducted the review using the topics of technique, variable, tools, deployment location and point in time.…”

Section: Related Workmentioning

confidence: 99%

A systematic mapping study of performance analysis and modelling of cloud systems and applications

Odun-Ayo

Williams

Odusami

et al. 2021

IJECE

View full text Add to dashboard Cite

Cloud computing is a paradigm that uses utility-driven models in providing dynamic services to clients at all levels. Performance analysis and modelling is essential because of service level agreement guarantees. Studies on performance analysis and modelling are increasing in a productive manner on the cloud landscape on issues like virtual machines and data storage. The objective of this study is to conduct a systematic mapping study of performance analysis and modelling of cloud systems and applications. A systematic mapping study is useful in visualization and summarizing the research carried in an area of interest. The systematic study provided an overview of studies on this subject by using a structure, based on categorization. The results are presented in terms of research such as evaluation and solution, and contribution such as tools and method utilized. The results showed that there were more discussions on optimization in relation to tool, method and process with 6.42%, 14.29% and 7.62% respectively. In addition, analysis based on designs in terms of model had 14.29% and publication relating to optimization in terms of evaluation research had 9.77%, validation 7.52%, experience 3.01%, and solution 10.51%. Research gaps were identified and should motivate researchers in pursuing further research directions

show abstract

“…Conficker use NBNS (NetBIOS Name Service or netbios-ns) protocol to propagate itself into network [24]. Filtering NBNS protocol in Wireshark will show the information carry out by the NBNS protocol.…”

Section: Netbios Attackmentioning

confidence: 99%

“…Botnets are regularly used to mount DDoS attacks in the Internet. Systematic review on aspects of DDoS detection is conducted and it was found that each technique used for the detection of attacks exploits certain characteristics of the network traffic, user requests and explicit tools [24,25] proposed a technique for the forensics of UDP flood attack that capable to identify the source of UDP flooding bot attack. The UDP flood attack sends an enormous number of UDP packets to any randomly selected ports of a server to block other authentic traffic to the network port.…”

Section: Udp Flood and Dns Amplification Attackmentioning

confidence: 99%

Characterising and detection of botnet in P2P network for UDP protocol

Safar

Abdullah

Kamaludin

et al. 2020

IJEECS

View full text Add to dashboard Cite

Developments in computer networking have raised concerns of the associated Botnets threat to the Internet security. Botnet is an inter-connected computers or nodes that infected with malicious software and being controlled as a group without any permission of the computer’s owner. This paper explores how network traffic characterising can be used for identification of botnet at local networks. To analyse the characteristic, behaviour or pattern of the botnet in the network traffic, a proper network analysing tools is needed. Several network analysis tools available today are used for the analysis process of the network traffic. In the analysis phase, the botnet detection strategy based on the signature and DNS anomaly approach are selected to identify the behaviour and the characteristic of the botnet. In anomaly approach most of the behavioural and characteristic identification of the botnet is done by comparing between the normal and anomalous traffic. The main focus of the network analysis is studied on UDP protocol network traffic. Based on the analysis of the network traffic, the following anomalies are identified, anomalous DNS packet request, the NetBIOS attack, anomalous DNS MX query, DNS amplification attack and UDP flood attack. This study, identify significant Botnet characteristic in local network traffic for UDP network as additional approach for Botnet detection mechanism.

show abstract

Systematic review of aspects of DDoS attacks detection

Cited by 10 publications

References 11 publications

Detection of the botnets’ low-rate DDoS attacks based on self-similarity

Detection of the botnets’ low-rate DDoS attacks based on self-similarity

A systematic mapping study of performance analysis and modelling of cloud systems and applications

Characterising and detection of botnet in P2P network for UDP protocol

Contact Info

Product

Resources

About