The Use of Anomaly Detection for the Detection of Different Types of DDoS Attacks in Cloud Environment

Hossein Abbasi,Naser Ezzati-Jivan,Martine Bellaiche,Chamseddine Talhi,Michel R. Dagenais
DOI: https://doi.org/10.1007/s41635-021-00119-z
2021-10-16
Journal of Hardware and Systems Security
Abstract:In most scenarios, distributed denial of service (DDoS) attacks can be categorized into three distinct groups: (1) attacks targeting and consuming bandwidth, (2) attacks targeting selected applications and (3) attacks targeting connection-layer exhaustion. This study discusses in depth our proposal of a unique, inclusive model that has the ability to precisely detect and categorize DDoS attacks with the help of comparing normal traffic and resource usage against the traffic and resource utilization reported during potential attack situations. Since the features from all three attack categories are dependent upon each other, we based the metrics of our detection model on data collected from all three types during each attack. Additionally, we utilized the cumulative sum algorithm for the sake of change detection in traffic and resource usage patterns.
What problem does this paper attempt to address?