Title
FFSc: a novel measure for low-rate and high-rate DDoS attack detection using multivariate data analysis.
Abstract
A Distributed Denial of Service DDoS attack is a major security threat for networks and Internet services. Attackers can generate attack traffic similar to normal network traffic using sophisticated attacking tools. In such a situation, many intrusion detection systems fail to identify DDoS attack in real time. However, DDoS attack traffic behaves differently from legitimate network traffic in terms of traffic features. Statistical properties of various features can be analyzed to distinguish the attack traffic from legitimate traffic. In this paper, we introduce a statistical measure called Feature Feature score for multivariate data analysis to distinguish DDoS attack traffic from normal traffic. We extract three basic parameters of network traffic, namely, entropy of source IPs, variation of source IPs, and packet rate to analyze the behavior of network traffic for attack detection. The method is validated using CAIDA DDoS 2007 and MIT DARPA datasets. Copyright © 2016 John Wiley & Sons, Ltd.
Year
DOI
Venue
2016
10.1002/sec.1460
Security and Communication Networks
Keywords
Field
DocType
DDoS,correlation,low-rate attack,feature
Denial-of-service attack,Computer science,Computer security,Network packet,Computer network,Multivariate analysis,Intrusion detection system,Application layer DDoS attack,The Internet
Journal
Volume
Issue
ISSN
9
13
1939-0114
Citations 
PageRank 
References 
3
0.42
9
Authors
3
Name
Order
Citations
PageRank
Nazrul Hoque130.42
Dhruba K. Bhattacharyya222627.72
Jugal K. Kalita385662.32