A practical approach to detection of distributed denial-of-service attacks using a hybrid detection method

被引：32

作者：

Bojovic, P. D. ^{[1
]}

Basicevic, I. ^{[2
]}

Ocovaj, S. ^{[3
]}

Popovic, M. ^{[2
]}

机构：

[1] Univ Union Belgrade, Sch Comp, 6-6 Knez Mihailova, Belgrade, Serbia

[2] Univ Novi Sad, Fac Tech Sci, 6 Trg Dositeja, Novi Sad, Serbia

[3] RT RK Inst Comp Based Syst, 23a Narodnog Fronta, Novi Sad, Serbia

来源：

COMPUTERS & ELECTRICAL ENGINEERING | 2019年 / 73卷

关键词：

Network security; Denial of service attack; Exponential weighted moving average; CUSUM; Packet entropy; DDOS ATTACKS; ENTROPY;

D O I：

10.1016/j.compeleceng.2018.11.004

中图分类号：

TP3 [计算技术、计算机技术];

学科分类号：

0812 ;

摘要：

This paper presents a hybrid method for the detection of distributed denial-of-service (DDoS) attacks that combines feature-based and volume-based detection. Our approach is based on an exponential moving average algorithm for decision-making, applied to both entropy and packet number time series. The approach has been tested by performing a controlled DDoS experiment in a real academic network. The network setup and test scenarios including both high-rate and low-rate attacks are described in the paper. The performance of the proposed method is compared to the performance of two methods that are already known in the literature. One is based on the counting of SYN packets and is used for detection of SYN flood attacks, while the other is based on a CUSUM algorithm applied to the entropy time series. The results show the advantage of our approach compared to methods that are based on either entropy or number of packets only. (C) 2018 Elsevier Ltd. All rights reserved.

引用

页码：84 / 96

页数：13

共 19 条

[1] Use of Tsallis entropy in detection of SYN flood DoS attacks [J].

Basicevic, Ilija ;

Ocovaj, Stanislav ;

Popovic, Miroslav .

SECURITY AND COMMUNICATION NETWORKS, 2015, 8 (18) :3634-3640

[2] Evaluation of entropy-based detection of outbound denial-of-service attacks in edge networks [J].

Basicevic, Ilija ;

Ocovaj, Stanislav ;

Popovic, Miroslav .

SECURITY AND COMMUNICATION NETWORKS, 2015, 8 (05) :837-844

[3] An Entropy-Based Network Anomaly Detection Method [J].

Berezinski, Przemyslaw ;

Jasiul, Bartosz ;

Szpyrka, Marcin .

ENTROPY, 2015, 17 (04) :2367-2408

[4]

Bojovic P.D, 2017, MENDELEY DATA V2, DOI [10.17632/psjxnzsxyx.2, DOI 10.17632/PSJXNZSXYX.2]

[5] A comprehensive study of queue management as a DoS counter-measure [J].

Boteanu, Daniel ;

Fernandez, Jose M. .

INTERNATIONAL JOURNAL OF INFORMATION SECURITY, 2013, 12 (05) :347-382

[6] Understanding DDoS Attack & Its Effect In Cloud Environment [J].

Deshmukh, Rashmi V. ;

Devadkar, Kailas K. .

PROCEEDINGS OF 4TH INTERNATIONAL CONFERENCE ON ADVANCES IN COMPUTING, COMMUNICATION AND CONTROL(ICAC3'15), 2015, 49 :202-210

[7] DDoS attacks and defense mechanisms: classification and state-of-the-art [J].

Douligeris, C ;

Mitrokotsa, A .

COMPUTER NETWORKS, 2004, 44 (05) :643-666

[8]

Eddy W, RFC4987 TCP SYN FLOO

[9]

Klinker F., 2011, Mathematische Semesterberichte, V58, P97, DOI [10.1007/ s00591-010-0080-8, 10.1007/s00591-010-0080-8]

[10]

Lau F, 2000, IEEE SYS MAN CYBERN, P2275, DOI 10.1109/ICSMC.2000.886455

← 1 2 →