Deakin University
Browse
yu-informationtheory-2008.pdf (237.85 kB)

Information theory based detection against network behavior mimicking DDoS attacks

Download (237.85 kB)
journal contribution
posted on 2008-04-01, 00:00 authored by Shui Yu, Wanlei Zhou, Robin Ram Mohan DossRobin Ram Mohan Doss
DDoS is a spy-on-spy game between attackers and detectors. Attackers are mimicking network traffic patterns to disable the detection algorithms which are based on these features. It is an open problem of discriminating the mimicking DDoS attacks from massive legitimate network accessing. We observed that the zombies use controlled function(s) to pump attack packages to the victim, therefore, the attack flows to the victim are always share some properties, e.g. packages distribution behaviors, which are not possessed by legitimate flows in a short time period. Based on this observation, once there appear suspicious flows to a server, we start to calculate the distance of the package distribution behavior among the suspicious flows. If the distance is less than a given threshold, then it is a DDoS attack, otherwise, it is a legitimate accessing. Our analysis and the preliminary experiments indicate that the proposed method- can discriminate mimicking flooding attacks from legitimate accessing efficiently and effectively.

History

Journal

IEEE communications letters

Volume

12

Issue

4

Pagination

319 - 321

Publisher

IEEE

Location

USA

ISSN

1089-7798

Language

eng

Notes

This material is presented to ensure timely dissemination of scholarly and technical work. Copyright and all rights therein are retained by authors or by other copyright holders. All persons copying this information are expected to adhere to the terms and constraints invoked by each author's copyright. In most cases, these works may not be reposted without the explicit permission of the copyright holder.

Publication classification

C1 Refereed article in a scholarly journal

Copyright notice

2008, IEEE

Usage metrics

    Research Publications

    Exports

    RefWorks
    BibTeX
    Ref. manager
    Endnote
    DataCite
    NLM
    DC