Use of Tsallis entropy in detection of SYN flood DoS attacks

被引：16

作者：

Basicevic, Ilija ^{[1
]}

Ocovaj, Stanislav ^{[1
]}

Popovic, Miroslav ^{[1
]}

机构：

[1] Univ Novi Sad, Fac Tech Sci, Novi Sad 21000, Serbia

来源：

SECURITY AND COMMUNICATION NETWORKS | 2015年 / 8卷 / 18期

关键词：

network security; denial-of-service attacks; Tsallis entropy; anomaly detection; SYN flood attack; SERVICE ATTACKS;

D O I：

10.1002/sec.1286

中图分类号：

TP [自动化技术、计算机技术];

学科分类号：

0812 ;

摘要：

In this paper, we present results of application of Tsallis entropy in detection of denial of service attacks. Two detectors, one based on Tsallis and the other one based on Shannon's entropy, have been applied in several attack simulations, and their properties have been compared. The simulated attack is Synchronize packet (SYN) flood. A simple packet distribution, that is, entropy of source addresses are considered. In both cases, cumulative sum control chart algorithm is used for change point detection. Properties of two detectors that are compared are detection delay and rate of true and false positives. The results show that Tsallis entropy-based detector can outperform (with respect to false positive rate) Shannon-based one but that requires careful tuning of Tsallis Q parameter that depends on characteristics of network traffic. The detection delay of two detectors is approximately the same. Copyright (C) 2015 John Wiley & Sons, Ltd.

引用

页码：3634 / 3640

页数：7

共 18 条

[1]

[Anonymous], 2013, G00237376 GARTN INC

[2]

[Anonymous], 2007, 2007 6 INT C INFORM

[3] Evaluation of entropy-based detection of outbound denial-of-service attacks in edge networks [J].

Basicevic, Ilija ;

Ocovaj, Stanislav ;

Popovic, Miroslav .

SECURITY AND COMMUNICATION NETWORKS, 2015, 8 (05) :837-844

[4] Detecting Distributed Denial of Service Attacks: Methods, Tools and Future Directions [J].

Bhuyan, Monowar H. ;

Kashyap, H. J. ;

Bhattacharyya, D. K. ;

Kalita, J. K. .

COMPUTER JOURNAL, 2014, 57 (04) :537-556

[5]

Cao J, 2003, LECT NOTES STAT, V171, P83

[6]

Crovella M. E., 1996, Performance Evaluation Review, V24, P160, DOI 10.1145/233008.233038

[7]

GITLIN RD, 1992, DATA COMMUNICATIONS

[8]

Guang C, 2005, LECT NOTES COMPUT SC, V3611, P338

[9]

Karagiannis T, 2004, IEEE INFOCOM SER, P1558

[10] Mining anomalies using traffic feature distributions [J].

Lakhina, A ;

Crovella, M ;

Diot, C .

ACM SIGCOMM COMPUTER COMMUNICATION REVIEW, 2005, 35 (04) :217-228

← 1 2 →