IEEE Communications Letters · 2016 · 123 citations · 10 references
Hardware SecurityDdos DetectionEngineeringInternet Traffic AnalysisIntrusion Detection SystemInformation SecurityChaotic SystemChaotic BehaviorDenial-of-service AttackComputer NetworksNetworked Computer SystemsNetwork TrafficsDenial-of-service AttacksBotnet DetectionComputer ScienceNetwork Traffic MeasurementNovel DosNetwork Security
The study proposes a method to detect DoS and DDoS attacks. The method extracts per‑minute packet counts and source‑IP counts, builds a Box‑Cox‑normalized packet time series, fits an ARIMA model to forecast future packets, computes maximum and local Lyapunov exponents of prediction errors, and uses these chaotic indicators along with the packet‑to‑IP ratio to classify traffic. Simulations demonstrate 99.5% accuracy in distinguishing normal from attack traffic.
This letter deals with the problem of detecting DoS and DDoS attacks. First of all, two features including number of packets and number of source IP addresses are extracted from network traffics as detection metrics in every minute. Hence, a time series based on the number of packets is built and normalized using a Box-Cox transformation. An ARIMA model is also employed to predict the number of packets in every following minute. Then, the chaotic behavior of prediction error time series is examined by computing the maximum Lyapunov exponent. The local Lyapunov exponent is also calculated as a suitable indicator for chaotic and nonchaotic errors. Finally, a set of rules are proposed based on repeatability of chaotic behavior and enormous growth in the ratio of number of packets to number of source IP addresses during attack times to classify normal and attack traffics from each other. Simulation results show that the proposed algorithm can accurately classify 99.5% of traffic states.
10
ARIMA Based Network Anomaly Detection
Asrul H. Yaacob, Ian K. T. Tan, Su Fong Chien et al. · 2010 · 158 citations