DDoS Flood Attack Detection Based On Fractal Parameters

被引：0

作者：

Xia, Zhengmin ^{[1
]}

Lu, Songnian ^{[2
]}

Li, Jianhua ^{[2
]}

机构：

[1] Shanghai Jiao Tong Univ, Dept Elect Engn, Shanghai 200030, Peoples R China

[2] Shanghai Jiao Tong Univ, Sch Informat Secur Engn, Dept Elect Engn, Shanghai, Peoples R China

来源：

2012 INTERNATIONAL CONFERENCE ON WIRELESS COMMUNICATIONS, NETWORKING AND MOBILE COMPUTING (WICOM) | 2012年

基金：

国家高技术研究发展计划(863计划);

关键词：

network security; DDoS flood attack; statistical anomaly detection; change point detection;

D O I：

暂无

中图分类号：

TP [自动化技术、计算机技术];

学科分类号：

0812 ;

摘要：

Distributed denial-of-service (DDoS) flood attack is one of the most popular techniques taken by the hackers to threaten the availability and stability of the Internet. To ensure network usability and reliability, accurate detection of this kind of attack is critical. In this paper, we propose a statistical DDoS flood attack detection method by passively monitoring the abrupt change of network traffic fractal parameters: fractal dimension D and Hurst parameter H. Specifically, we use an autoregressive system to estimate the parameters D and H of normal traffic which are slow changing. If the actual parameters D and H vary significantly from the estimation ones, we assume DDoS flood attack happens. Meanwhile, we propose a maximum likelihood estimate-based detection method to determine the change point of parameters D and H that indicate the occurrence of DDoS flood attack. The test results based on the DARPA intrusion detection evaluation data sets show that both the parameters D and H can indicate the DDoS flood attack effectively.

引用

页数：5