Abstract:Distributed denial of service attacks are cyber-attacks that target the availability of servers. As a result, legitimate users no longer have access to the service. This can have a negative impact on an organization, such as lack of reputation and economic losses. Therefore, it is important to design defense mechanisms against these attacks. There are systems for detecting distributed denial of service attacks in the literature, which still have various shortcomings. Some of these systems detect the presence of attack traffic without identifying the attack packets or flows. Others use static thresholds and therefore cannot adapt to changes in legitimate traffic. In this paper, we propose an online system that aims to detect flooding attacks in a short timeframe and a client–server environment. The proposed detection system consists of five modules, namely features extraction and connections construction, suspicious activity detection, attack connections detection, alert generation and threshold update. The suspicious activity detection module calculates the normalized Shannon entropy by considering the source Internet Protocol address as a random variable. Suspicious activity is detected when the computed entropy is below a threshold. The threshold calculation is based on Chebyshev’s theorem. We propose a dynamic threshold algorithm to track changes in legitimate traffic. We evaluate the proposed system through simulations and using a publicly available dataset. Compared to other similar works, the proposed detection system has a better performance in terms of detection rate, false positive rate, precision and overall accuracy.

Detecting DDoS Attacks Based on Network Connection Statistics

Detection of low-rate DDoS attack based on self-similarity

Low-rate DoS Attack Detection Method Based on Hybrid Deep Neural Networks.

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Detection and Response of Low-Rate TCP-targeted Denial of Service Attacks

Intelligent DDoS Detection in Botnet Combined with Packet-Level Features under SDN

A New Multistage Approach to Detect Subtle DDoS Attacks.

Group Testing Based Detection of Web Service DDoS Attackers.

DDoS Attack Detection Method Based on Network Abnormal Behavior in Big Data Environment

An Online Entropy-based DDoS Flooding Attack Detection System with Dynamic Threshold

Router based detection for low-rate agents of DDoS attack

DDoSMiner: an Automated Framework for DDoS Attack Characterization and Vulnerability Mining.

A Queue Model to Detect DDos Attacks

An entropy and machine learning based approach for DDoS attacks detection in software defined networks

DDoS detection and analysis system based on comprehensive scoring

Denial-of-Service Attack Detection via Differential Analysis of Generalized Entropy Progressions

A Queueing Analysis for the Denial of Service (dos) Attacks in Computer Networks

The use of statistical features for low-rate denial-of-service attack detection

Low-rate DDoS attacks detection method using data compression and behavior divergence measurement

LDoS attack detection method based on traffic time-frequency characteristics

DDoS Attack Detection under SDN Context