Abstract:Detection of distributed denial of service (DDoS) attacks has been a challenging problem for network security. Most of the existing works take into account the anomaly features of the traffic caused by DDoS. However, these detection methods suffer from either less generality or high computational and memory costs in detecting subtle DDoS attacks. In this paper, we first present a model for DDoS attacks with quantitative measurements. Based on this model, we find that there are two factors that have a severe influence on the deviation of traffic features. In view of these two factors, the DDoS attack traffic observed by monitors can be trivial, leading to the subtle DDoS attacks which are difficult to detect. To detect the subtle DDoS anomalies at monitors close to the attack sources, we propose a novel multistage DDoS detection framework that consists of a NTS (Network Traffic State) prediction, a fine-grained singularity detection and a malicious address extraction engine. We also briefly introduced how to distribute our detection framework to enhance the performance of detecting world-wide DDoS attacks. Moreover, the prototype system is implemented and evaluated with real network traces from our campus network and testbed. The results show that our method can detect various DDoS attacks efficiently even though the attack rate is low. Our method can extract malicious IPs for attack reaction with records for a short period, and multiple monitors distributed in the network can fuse the results of extraction seamlessly to improve the accuracy of detection

Detection of Drive-by Downloads Based on the Frequent Embedded Subtree Pattern-Mining Algorithm

Detection of Drive-by Downloads Based on Dynamic Page Views

Detection and Analysis of Drive-by Downloads and Malicious Websites

Real-time Algorithm for Trend Analysis of Dynamic Data Streams

Method of Preventing Drive-by Download Attack Based on Browser Extension

Coordinated Web Scan Detection Based on Hierarchical Correlation

JShield: towards real-time and vulnerability-based detection of polluted drive-by download attacks.

Group Testing Based Detection of Web Service DDoS Attackers.

Mining Network Traffic with the k -Means Clustering Algorithm for Stepping-Stone Intrusion Detection

Preventing Drive-by Download Via Inter-Module Communication Monitoring

Application of intelligent algorithms in library resource malicious download detection system

Underground Application Collection Method Based on Spiking Traffic Analysis

DDoS detection and analysis system based on comprehensive scoring

A New Multistage Approach to Detect Subtle DDoS Attacks.

Web Page Trojan Detection Method Based on Dynamic Behavior Analysis

An Exploit Kits Detection Approach Based on HTTP Message Graph

Detection and analysis of malicious JavaScript code based on pre-filter

MineHunter - A Practical Cryptomining Traffic Detection Algorithm Based on Time Series Tracking.

New algorithm mining intrusion patterns

Anteater: Advanced Persistent Threat Detection With Program Network Traffic Behavior

Detecting Malicious Websites in Depth through Analyzing Topics and Web-pages