Abstract:Application-layer distributed denial-of-service attacks have become a serious threat to modern high-speed computer networks and systems. Unlike network-layer attacks, application-layer attacks can be performed using legitimate requests from legitimately connected network machines that make these attacks undetectable by signature-based intrusion detection systems. Moreover, the attacks may utilize protocols that encrypt the data of network connections in the application layer, making it even harder to detect an attacker’s activity without decrypting users’ network traffic, and therefore violating their privacy. In this paper, we present a method that allows us to detect various application-layer denial-of-service attacks against a computer network in a timely fashion. We focus on detection of the attacks that utilize encrypted protocols by applying an anomaly-detection-based approach to statistics extracted from network packets. Since network traffic decryption can violate ethical norms and regulations on privacy, the detection method proposed analyzes network traffic without its decryption. The method involves construction of a model of normal user behavior by analyzing conversations between a web server and its clients. The construction algorithm is self-adaptive and allows one to update the model every time a new portion of network traffic data becomes available for analysis. Once the model has been built, it can be applied to detect various application-layer types of denial-of-service attacks, including slow attacks, computational attacks, and more advanced attacks imitating normal web user behavior. The proposed technique is evaluated with realistic end user network traffic generated in our virtual network environment. Evaluation results show that these attacks can be properly detected, while the number of false alarms remains very low.

Dynamic Online Traffic Identification Scheme Based on Data Stream Clustering Algorithm

Real-time Detection of Traffic Congestion Based on Trajectory Data

A Design and Implementation of P2p Network Traffic Identification System

HClustream: A Novel Approach for Clustering Evolving Heterogeneous Data Stream

Dynamic Micro-cluster-Based Streaming Data Clustering Method for Anomaly Detection.

Novel Dynamic Multiple Classification System for Network Traffic

A method of on-line fast identification for the chaos in traffic flow

ESA-Stream: Efficient Self-Adaptive Online Data Stream Clustering

Online Stream Clustering Using Density and Affinity Propagation Algorithm

Identifying Traffic Clusters in Urban Networks Based on Graph Theory Using License Plate Recognition Data

Network Traffic Classification Algorithm Based on Spectral Clustering

Clustering-based Active Learning Classification towards Data Stream

Fast Graph Stream Classification Using Discriminative Clique Hashing.

Clustering Text Data Streams

An enhanced self-learning-based clustering scheme for real-time traffic data distribution in wireless networks

Online Clustering of Evolution Data Stream Based on Affinity Propagation Clustering

Clustering Stream Data by Exploring the Evolution of Density Mountain

Data Stream Clustering for Application-Layer DDoS Detection in Encrypted Traffic

Anomaly Intrusion Detection Based on Data Stream

Distributed Data Stream Clustering: A Fast EM-based Approach

Online learning for streaming data classification in nonstationary environments