Effective metric for detecting distributed denial-of-service attacks based on information divergence

IET Communications

Volumn 3, Issue 12, 2009, Pages 1851-1860

  Li, K ^a   Zhou, W ^a   Yu, S ^a  

^a DEAKIN UNIVERSITY   (Australia)

Author keywords

[No Author keywords available]

Indexed keywords

ATTACK FLOW; DISTRIBUTED DENIAL OF SERVICE ATTACK; DIVERGENCE MEASURES; FALSE POSITIVE RATES; INFORMATION DISTANCE; INFORMATION DIVERGENCE; INFORMATION FLOWS; KULLBACK LEIBLER DIVERGENCE; OPTIMAL DETECTION; RELATIVE ENTROPY;

INFORMATION THEORY; INTRUSION DETECTION; PROBABILITY DISTRIBUTIONS;

COMPUTER CRIME;

EID: 70450210296     PISSN: 17518628     EISSN: None     Source Type: Journal    
DOI: 10.1049/iet-com.2008.0586     Document Type: Article

References (22)

1. Carl, G., Kesidis, G., Brooks, R.R., and Rai, S.: ' Denial-of-service attack-detection techniques ', IEEE Internet Comput., 2006, 10, (1), p. 82-89 1089-7801
2. Gu, Y., McCallum, A., and Towsley, D.: ' Detecting anomalies in network traffic using maximum entropy estimation ', Proc. ACM/SIGCOMM Internet Measurement Conf. - IMC 2005, October, 2005
3. Patcha, A., and Park, J.-M.: ' An overview of anomaly detection techniques: existing solutions and latest technological trends ', Comput. Netw., 2007, 51, p. 391-409
4. Sekar, R., Gupta, A., Frullo, J., Shanbhag, T., Zhou, S., Tiwari, A., and Yang, H.: ' Specification based anomaly detection: a new approach for detecting network intrusions ', Proc. ACM CCS, 2002
5. Yu, S., Zhou, W., and Doss, R.: ' Information theory based detection against network behavior mimicking DDoS attacks ', IEEE Commun. Lett., 2008, 12, (4), p. 319-321 1089-7798
6. Rényi, A.: ' On measures of entropy and information ', Proc. Fourth Berkeley Symp, Math. Stat. and Probability, 1961, 1, p. 547-561
7. Baraniuk, R.G., Flandrin, P., Janssen, A.J.E.M., and Michel, O.J.J.: ' Measuring time-frequency information content using the Renyi entropies ', IEEE Trans Inf. Theory, 2001, 47, (4), p. 1391-1409 0018-9448
8. Shannon, C.E.: ' A mathematical theory of communication ', Bell Syst. Tech. J., 1948, 27, p. 379-423 and 623-656 0005-8580
9. Karol, Z.: ' Rényi extrapolation of Shannon entropy ', Open Sys. Inf. Dyn., 2003, 10, p. 297-310
10. Wenke, L., and Dong, X.: ' Information-theoretic measures for anomaly detection ', Proc. IEEE Symp. Security and Privacy, S&P 2001, 2001
11. Du, P., and Abe, S.: ' IP packet size entropy-based scheme for detection of DoS/DDoS attacks ', IEICE Trans. Inf. Syst., 2008, E91-D, (5), p. 1274-1281 0916-8532
12. Ledesma, S., and Liu, D.: ' Synthesis of fractional Gaussian noise using linear approximation for generating self-similar network traffic ', Comput. Commun. Rev., 2000, 30, p. 3448-3470 0146-4833
13. Perrin, E., Harba, R., Berzin-Joseph, C., Iribarren, I., and Bonami, A.: ' nth-order fractional Brownian motion and fractional Gaussian noises ', IEEE Trans. Signal Process., 2001, 45, p. 1049-1059 1053-587X
14. Willinger, W.: ' Traffic modeling for high-speed networks: theory versus practice ', (Springer-Verlag, 1995), 'Stochastic networks'
15. Bao Y., Krim H.: 'Renyi entropy based divergence measures for ICA'. IEEE Workshop on Statistical Signal Processing, 28 September-1 October 2003, pp. 565-568
16. Perrin, E., Harba, R., Jennane, R., and Iribarren, I.: ' Fast and exact synthesis for 1-D Fractional Brownian motion and fractional Gaussian noises ', IEEE Signal Process. Lett., 2002, 9, p. 382-384 1070-9908
17. Broniatowski, M.: ' Estimation of the Kullback-Leibler divergence ', (Allerton Press, 2003), Mathematical Methods of Statistics
18. Yu, C., Kai, H., and Ku, W.-S.: et al. ' Collaborative detection of DDoS attacks over multiple network domains ', IEEE Trans Parallel Distrib. Syst., 2007, 18, (12), p. 1649-1662 1045-9219
19. Kumar, K., Joshi, R.C., and Singh, K.: ' A distributed approach using entropy to detect DDoS attacks in ISP domain ', Proceedings of the 2007 Int. Conf. on Signal Processing, Communications and Networking (ICSCN'07), 2007, pp. 331-337
20. Bercher, J.-F.: ' On some entropy functionals derived from Rényi information divergence ', Inf. Sci., 2008, 178, (12), p. 2489-2506
21. http://www.ll.mit.edu/mission/communications/ist/corpora/ideval/data/ 2000/LLS-DDOS-2.0.2.html
22. McHugh, J.: ' Testing intrusion detection systems: a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory ', ACM Trans. Inf. Syst. Secur. (TISSEC), 2000, 3, (4), p. 262-294