Abstract:The means to achieve DDoS (distributed denial of service) attacks are becoming increasingly automated and diverse. A problem that automated attack tools cannot address, at least for now, is the inevitable repetitive or periodic nature of traffic data, which are important features for the effective detection of DDoS attacks. Some researchers have proposed to detect DDoS attacks by analyzing the frequency domain information or information entropy of network communication signals or network packets. However, they still suffer from insufficient accuracy and slow response time when dealing with large-scale attack data and multiple-packet types of attacks. Therefore, we hope to develop a detection method that can detect large-scale and multiple types of DDoS. This paper proposes a new DDoS detection method based on fast Fourier transform (FFT) and information entropy. This method (FFT and entropy-based DDoS detection method [FEDDM]) focuses on the periodicity of DDoS network traffic. First, we consider each piece of network traffic data as a network behavior. Then, we prove that the network traffic data conforms to the Riemann flow structure. We define the concept of work of stream data and treat it as a feature. The effect of stream data on the communication capacity can be considered as the work performed by the stream data on the channel. In addition, to improve the efficiency and accuracy of detection, we use the FFT coefficients and information entropy of work as features to train the neural network (NN) to detect DDoS attacks. This method is lightweight, faster, and more generally applicable. The experiment proved the advantage of this method using the latest CICDDoS2019 dataset. In the simulation, the detection accuracy of NetBIOS, SNMP, syn, and WebDDoS is more than 99.99%, which proves our method. (c) 2021 Elsevier Ltd. All rights reserved.

Detecting DDoS Attacks Using Conditional Entropy

Combining cross-correlation and fuzzy classification to detect distributed denial-of-service attacks

Detection of low-rate DDoS attack based on self-similarity

Characterizing Network Anomaly Traffic with Euclidean Distance-Based Multiscale Fuzzy Entropy.

DDoS Flooding Attack Detection Based on Joint-Entropy with Multiple Traffic Features.

DDoS attack detection method based on conditional random field with feature set

Distributed Denial of Service Attacks Detection Method Based on Conditional Random Fields.

Ddos Attack Detection Algorithm Based on Ip Entropy Model

Dynamic Entropy Based DoS Attack Detection Method

Detection of DDoS Attacks in Software Defined Networking Using Entropy

Riemannian Manifold on Stream Data: Fourier Transform and Entropy-Based DDoS Attacks Detection Method.

Detecting DDoS Attacks Based on Network Connection Statistics

DDoS Attacks Detection Model and Its Application

DDoS attack detection method based on network traffic and IP entropy

An Entropy-Based DDoS Defense Mechanism in Software Defined Networks.

An Online Entropy-based DDoS Flooding Attack Detection System with Dynamic Threshold

Denial-of-Service Attack Detection via Differential Analysis of Generalized Entropy Progressions

Real-Time Detection of Application-Layer DDoS Attack Using Time Series Analysis

Probability principle of a reliable approach to detect signs of DDOS flood attacks

DDoS attack detection in SDN: Enhancing entropy‐based detection with machine learning

A New Multistage Approach to Detect Subtle DDoS Attacks.