Identifying LDoS attack traffic based on wavelet energy spectrum and combined neural network. (12th October 2017)

• Record Type: Journal Article
• Authors: Yue, Meng; Liu, Liang; Wu, Zhijun; Wang, Minxiao
• Is Part Of: International journal of communication systems. Volume 31:Number 2(2018)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2017-10-12
• Subjects: combined neural network -- low‐rate denial of service -- multifractal -- signature detection -- wavelet energy spectrum; Telecommunication systems -- Periodicals; 621.382
• DOI: 10.1002/dac.3449
• Languages: English
• ISSNs: 1074-5351

Abstract

Summary: As a special type of denial of service (DoS) attacks, the TCP‐targeted low‐rate denial of service (LDoS) attacks have the characteristics of low average rate and strong concealment, so it is difficult to identify such attack traffic. As multifractal characteristics exist in network traffic, a new identification approach based on wavelet transform and combined neural network is proposed to classify normal network traffic and LDoS attack traffic. Wavelet energy spectrum coefficients extracted from the sampled traffic are used for multifractal analysis of traffic over different time scale. The combined neural network is designed to classify these multiscale spectrum coefficients that show different multifractal characteristics belonging to normal network traffic and LDoS attack traffic. Test results of test‐bed experiments indicate that the proposed approach can identify LDoS attack traffic accurately. Abstract : In this paper, we find that the analysis of multifractal characteristics based on wavelet energy spectrum is available as a discriminator of LDoS attack traffic profiles. By using combined neural network for classification of the binary logarithm of energy spectrum coefficients that are deduced from the measured traffic, the proposed approach is able to identify LDoS attack traffic effectively. In particular, it achieves the best performance when using the 15 wavelet energy spectrum coefficients as the feature vectors.