A modified DBSCAN clustering algorithm for proactive detection of DDoS attacks

Abstract

In this paper, an exact and proactive technique is created to distinguish Distributed Denial of Service (DDoS) attacks. This is achieved by using an entropy concept to measure abnormal traffic changes according to the phases of the attack. This traffic is then clustered by using a modified DBSCAN algorithm, and the centroids for the resulting clusters are then used as patterns for efficient distance-based classification to detect DDoS attacks. The experimental results showed that the classification based on DBSCAN centroids achieved accuracy of more than (98%). This system is characterized by processing and analyzing high-speed network traffic (by using entropy), discovering and accurately identifying types of DDoS attacks to reduce false alarms, and early detecting DDoS attacks in real time.