DDoS detection and traceback with decision tree and grey relational analysis. (14th March 2011)

• Record Type: Journal Article
• Authors: Wu, Yi-Chi; Tseng, Huei-Ru; Yang, Wuu; Jan, Rong-Hong
• Is Part Of: International journal of ad hoc and ubiquitous computing. Volume 7:Number 2(2011)
• Page Start: 121
• Page End: 136
• Publication Date: 2011-03-14
• Subjects: DDoS detection -- distributed DoS -- DoS attacks -- denial of service -- attacker traceback -- decision tree -- grey relational analysis -- GRA -- attacker locations -- traffic low pattern matching; Ubiquitous computing -- Periodicals; Embedded computer systems -- Periodicals; Electronic data processing -- Distributed processing -- Periodicals; Wireless communication systems -- Periodicals; Computer architecture -- Periodicals; 004.2
• Languages: English
• ISSNs: 1743-8225

Abstract

In Distributed Denial-of-Service (DDoS) Attack, an attacker breaks into many innocent computers (called zombies). Then, the attacker sends a large number of packets from zombies to a server, to prevent the server from conducting normal business operations. We design a DDoS-detection system based on a decision-tree technique and, after detecting an attack, to trace back to the attacker's locations with a traffic-flow pattern-matching technique. Our system could detect DDoS attacks with the false positive ratio about 1.2-2.4%, false negative ratio about 2-10%, and find the attack paths in traceback with the false negative rate 8-12% and false positive rate 12-14%.