Abstract:Detection of distributed denial of service (DDoS) attacks has been a challenging problem for network security. Most of the existing works take into account the anomaly features of the traffic caused by DDoS. However, these detection methods suffer from either less generality or high computational and memory costs in detecting subtle DDoS attacks. In this paper, we first present a model for DDoS attacks with quantitative measurements. Based on this model, we find that there are two factors that have a severe influence on the deviation of traffic features. In view of these two factors, the DDoS attack traffic observed by monitors can be trivial, leading to the subtle DDoS attacks which are difficult to detect. To detect the subtle DDoS anomalies at monitors close to the attack sources, we propose a novel multistage DDoS detection framework that consists of a NTS (Network Traffic State) prediction, a fine-grained singularity detection and a malicious address extraction engine. We also briefly introduced how to distribute our detection framework to enhance the performance of detecting world-wide DDoS attacks. Moreover, the prototype system is implemented and evaluated with real network traces from our campus network and testbed. The results show that our method can detect various DDoS attacks efficiently even though the attack rate is low. Our method can extract malicious IPs for attack reaction with records for a short period, and multiple monitors distributed in the network can fuse the results of extraction seamlessly to improve the accuracy of detection

A DDoS attack detection method based on HMM time series prediction and chaos model

Low-rate DoS Attack Detection Method Based on Hybrid Deep Neural Networks.

Detection of low-rate DDoS attack based on self-similarity

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Robust Algorithm for Attack Detection Based on Time‐varying Hidden Markov Model Subject to Outliers

Combining cross-correlation and fuzzy classification to detect distributed denial-of-service attacks

Real-Time Detection of Application-Layer DDoS Attack Using Time Series Analysis

LDoS attack detection method based on traffic time-frequency characteristics

DDoS attack detection method based on conditional random field with feature set

DDoS Attack Detection Method Based on Network Abnormal Behavior in Big Data Environment

A New Multistage Approach to Detect Subtle DDoS Attacks.

DDoS attack detection method based on feature extraction of deep belief network

Prediction Approach against DDoS Attack based on Machine Learning Multiclassfier

A Method Based on AMHI for DDoS Attacks Detection and Defense

Two-Layers DDoS Attack Detection Model Using Machine Learning in Software Defined Networking

A DDoS Attack Detection Method Based on SVM in Software Defined Network

An intelligent behavioral-based DDOS attack detection method using adaptive time intervals

Multi-domain collaborative two-level DDoS detection via hybrid deep learning

DDoS Attack Detection Based on Fast Fractional Fourier Transform

Distributed Denial of Service Attacks Detection Method Based on Conditional Random Fields.

Detection of DDoS Attacks in Software Defined Networking Using Machine Learning Models