Abstract:Distributed Denial of Service (DDoS) attacks are getting increasingly harmful to the Internet, showing no signs of slowing down. Developing an accurate detection mechanism to thwart DDoS attacks is still a big challenge due to the rich variety of these attacks and the emergence of new attack vectors. In this paper, we propose a new tree-based DDoS detection approach that operates on a flow as a stream structure, rather than the traditional fixed-size record structure containing aggregated flow statistics. Although aggregated flow records have gained popularity over the past decade, providing an effective means for flow-based intrusion detection by inspecting only a fraction of the total traffic volume, they are inherently constrained. Their detection precision is limited not only by the lack of packet payloads, but also by their structure, which is unable to model fine-grained inter-packet relations, such as packet order and temporal relations. Additionally, inferring aggregated flow statistics must wait for the complete flow to end. Here we show that considering flow inputs as variable-length streams composed of their associated packet headers, allows for very accurate and fast detection of malicious flows. We evaluate our proposed strategy on the CICDDoS2019 and CICIDS2017 datasets, which contain a comprehensive variety of DDoS attacks. Our approach matches or exceeds existing machine learning techniques' accuracy, including state-of-the-art deep learning methods. Furthermore, our method achieves significantly earlier detection, e.g., with CICDDoS2019 detection based on the first 2 packets, which corresponds to an average time-saving of 99.79% and uses only 4--6% of the traffic volume.

A Lightweight Ddos Flooding Attack Detection Algorithm Based On Synchronous Long Flows

Low-rate DoS Attack Detection Method Based on Hybrid Deep Neural Networks.

Detecting SYN Flooding Agents under Any Type of IP Spoofing

Detection and Response of Low-Rate TCP-targeted Denial of Service Attacks

Router based detection for low-rate agents of DDoS attack

Detection of low-rate DDoS attack based on self-similarity

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

A novel mechanism to defend against low-rate denial-of-service attacks

Light-weight Detection Method Against SYN Flooding Attacks

Detection and Defense of SYN Flood Attacks Based on Dual Stack Network Firewall

DDoS Attack Detection Method Based on Network Abnormal Behavior in Big Data Environment

Group Testing Based Detection of Web Service DDoS Attackers.

Low-rate DDoS attacks detection method using data compression and behavior divergence measurement

A Method Based on AMHI for DDoS Attacks Detection and Defense

Detection of LDDoS Attacks Based on TCP Connection Parameters

A Flow is a Stream of Packets: A Stream-Structured Data Approach for DDoS Detection

A DoS Resilient Flow-level Intrusion Detection Approach for High-speed Networks

A New Multistage Approach to Detect Subtle DDoS Attacks.

A Robust Scheme To Detect Syn Flooding Attacks

LDoS attack detection method based on traffic time-frequency characteristics

Design a Hybrid Flooding Attack Defense Scheme under the Cloud Computing Environment