Mathematical modelling of DDoS attack and detection using correlation. Issue 3 (1st October 2017)

• Record Type: Journal Article
• Authors: Johnson Singh, Khundrakpam; De, Tanmay
• Is Part Of: Journal of cyber security technology. Volume 1:Issue 3/4(2017)
• Page Start: 175
• Page End: 186
• Publication Date: 2017-10-01
• Subjects: DDoS attack -- bandwidth -- buffer size -- SOM -- correlation -- normal probability distribution; Computer security -- Periodicals; Data encryption (Computer science) -- Periodicals; 005.805
• DOI: 10.1080/23742917.2017.1384213
• Languages: English
• ISSNs: 2374-2917

Abstract

ABSTRACT: Distributed denial of service attack (DDoS) is one of the top-rated cyber threats currently. It runs down the victim server resources such as bandwidth and buffer size by obstructing the server to provide resources to legitimate clients. In this article, we propose a mathematical model of DDoS attack; we discuss its relation to the features such as inter-arrival time or rate of arrival of the attacking clients accessing the server. We further analyse the attack model in context to exhausting bandwidth and buffer size of the victim server. The proposed method uses an unsupervised learning method, self-organising map, to form the clusters of identical features. Lastly, the article applies mathematical correlation and the normal probability distribution on the clusters and analyses their behaviours to detect a DDoS attack. The article uses the CAIDA 2007 data set for analysing and confirmation of the proposed model.