Note on Studying Change Point of LRD Traffic Based on Li’s Detection of DDoS Flood Attacking

Distributed denial-of-service (DDoS) flood attacks remain great threats to the Internet. To ensure network usability and reliability, accurate detection of these attacks is critical. Based on Li's work on DDoS flood attack detection, we propose a DDoS detection method by monitoring the Hurst va...

Full description

Saved in:
Bibliographic Details
Published inMathematical Problems in Engineering Vol. 2010; no. 2010; pp. 1 - 14
Main Authors Xia, Zhengmin, Lu, Songnian, Tang, Junhua
Format Journal Article
LanguageEnglish
Published Cairo, Egypt Hindawi Limiteds 01.01.2010
Hindawi Puplishing Corporation
Hindawi Publishing Corporation
Hindawi Limited
Subjects
Denial of service attacks
Estimates
False alarms
Floods
Internet
Intrusion
Mathematical analysis
Mathematical problems
Methods
Monitoring
Network reliability
Parameter estimation
R&D
Research & development
Self-similarity
Studies
Traffic engineering
Traffic flow
Wireless networks
Online AccessGet full text

Cover

More Information
Summary:Distributed denial-of-service (DDoS) flood attacks remain great threats to the Internet. To ensure network usability and reliability, accurate detection of these attacks is critical. Based on Li's work on DDoS flood attack detection, we propose a DDoS detection method by monitoring the Hurst variation of long-range dependant traffic. Specifically, we use an autoregressive system to estimate the Hurst parameter of normal traffic. If the actual Hurst parameter varies significantly from the estimation, we assume that DDoS attack happens. Meanwhile, we propose two methods to determine the change point of Hurst parameter that indicates the occurrence of DDoS attacks. The detection rate associated with one method and false alarm rate for the other method are also derived. The test results on DARPA intrusion detection evaluation data show that the proposed approaches can achieve better detection performance than some well-known self-similarity-based detection methods.
Bibliography:ObjectType-Article-2
SourceType-Scholarly Journals-1
ObjectType-Feature-1
content type line 23
ISSN:1024-123X
1563-5147
DOI:10.1155/2010/962435