A change-point DDoS attack detection method based on half interaction anomaly degree. (2017)

• Record Type: Journal Article
• Authors: Cheng, Jieren; Tang, Xiangyan; Yin, Jianping
• Is Part Of: International journal of autonomous and adaptive communications systems. Volume 10:Number 1(2017)
• Page Start: 38
• Page End: 54
• Publication Date: 2017
• Subjects: denial of service -- DDoS attacks -- distributed DOS -- abnormal flows -- attack flows -- attack detection -- anomaly detection -- intrusion detection -- information security -- network security -- time series -- change point -- cumulative sum -- CUSUM -- feature extraction; Adaptive computing systems -- Periodicals; Wireless communication systems -- Periodicals; Computer networks -- Periodicals; 004.6
• Languages: English
• ISSNs: 1754-8632

Abstract

We propose a change-point DDoS attack detection method based on half interaction anomaly degree. For large-scale DDoS attacks, some key routing devices will route a large volume of converged DDoS attack flows, and at the same time, the normal traffic routed by those devices is also large. As a result, the current methods will be largely affected by large volume of normal flows, which will lead to high false positive rate and false negative rate. This paper proposes the concept of IP flow address half interaction anomaly degree (HIAD). We extract HIAD from abnormal flows in the network, then transform the HIAD time series into CSTS by an improved cumulative sum (CUSUM) algorithm, and propose a CSTS-based DDoS attack detection (CDAD) method. Experiments show that the CDAD method can extract features of DDoS attack flows from abnormal flows and recognise the DDoS attack rapidly and effectively.