Adaptive clustering with feature ranking for DDoS attacks detection

Proceedings - 2010 4th International Conference on Network and System Security, NSS 2010

Volumn , Issue , 2010, Pages 281-286

  Zi, Lifang ^a   Yearwood, John ^a   Wu, Xin Wen ^b  

^a UNIVERSITY OF BALLARAT   (Australia)

^b GRIFFITH UNIVERSITY   (Australia)

Author keywords

Adaptive clustering; DDoS detection; Feature ranking

Indexed keywords

ADAPTIVE CLUSTERING; ADAPTIVE PROCESS; CLUSTER STRUCTURE; DDOS ATTACK; DDOS DETECTION; DISTRIBUTED DENIAL OF SERVICE ATTACK; FEATURE RANKING; FEATURE VECTORS; INCREMENTAL CLUSTERING ALGORITHM; LINEAR CORRELATION COEFFICIENT; MODIFIED GLOBAL; NETWORK TRAFFIC;

CLUSTER ANALYSIS; NETWORK SECURITY;

CLUSTERING ALGORITHMS;

EID: 78650311599     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/NSS.2010.70     Document Type: Conference Paper

References (25)

1. S. M. Specht and R. B. Lee, "Distributed Denial of Service: Taxonomies of Attacks, Tools and Countermeasures," Proc. of the 17th International Conference on Parallel and Distributed Computing Systems, Citeseer, 2004, pp. 543-550.
2. P. J. Criscuolo, "Distributed Denial of Service: Trin00, Tribe Flood Network, Tribe Flood Network 2000, and Stacheldraht CIAC-2319," Department of Energy Computer Incident Advisory (CIAC), Lawrence Livermore National Laboratory, Rev.1, UCRL-ID-136939, 2000.
3. J. B. D. Cabrera, et al., "Proactive Detection of Distributed Denial of Service Attacks Using MIB Traffic Variables - A Feasibility Study," Proc. of the 7th IEEE/IFIP International Symposium on Integrated Network Management, 2001, pp. 1-14.
4. S. Jin and D. Yeung, "A Covariance Analysis Model for DDoS Attack Detection," Proc. of IEEE International Conference on Communications, vol. 4, 2004, pp. 1882-1886.
5. K. Lee, J. Kim, K. Kwon, Y. Han, and S. Kim, "DDoS Attack Detection Method Using Cluster Analysis," Expert Systems with Applications, vol. 34, no. 3, pp. 1659-1665, 2008.
6. Y. Huang and J. Pullen, "Countering Denial-of-service Attacks Using Congestion Triggered Packet Sampling and Filtering," Proc. of the 10th International Conference on Computer Communications and Networks, 2001, pp. 490-494.
7. C. Jin, H. Wang, and K. Shin, "Hop-count Filtering: An Effective Defense against Spoofed DDoS Traffic," Proc. of the 10th ACM Conference on Computer and Communications Security, 2003, pp. 30-41.
8. H. Burch and B. Cheswick, "Tracing Anonymous Packets to Their Approximate Source, Proc. of the 14th USENIX System Administration Conference (LISA 2000), 2000.
9. R. Stone, "CenterTrack: An IP Overlay Network for Tracking DoS Floods," Proc. of the USENIX Security Symposium, 2000.
10. S. Savage, D. Wetherall, A. Karlin, and T. Anderson, "Network Support for IP Traceback," ACM/IEEE Transactions on Networking, vol. 9, no. 3, pp. 226-237, 2001.
11. A. Belenky and N. Ansari, "IP Traceback with Deterministic Packet Marking," IEEE Communications Letters, vol. 7, no. 4, pp. 162-164, 2003.
12. L. Feinstein, D. Schnackenberg, R. Balupari, and D. Kindred, "Statistical Approaches to DDoS Attack Detection and Response," Proc. of the DARPA Information Survivability Conference and Exposition, vol. 1, Citeseer, 2003, pp. 303-314.
13. Y. Liao and V. Vemuri, "Use of K-Nearest Neighbor Classifier for Intrusion Detection," Computers & Security, vol. 21, no. 5, pp. 439-448, 2002.
14. W. Streilein, R. Cunningham, and S. Webster, "Improved Detection of Low-profile Probe and Denial-of-service Attacks," Proc. of the 2001 Workshop on Statistical and Machine Learning Techniques in Computer Intrusion Detection, Citeseer, 2001.
15. D. Gavrilis and E. Dermatas, "Real-time Detection of Distributed Denial-of-service Attacks Using RBF Networks and Statistical Features," Computer Networks, vol. 48, no. 2, pp. 235-245, 2005.
16. C. E. Shannon and W. Weaver, "A Mathematical Theory of Communication," Bell System Technical Journal, vol. 27, pp. 379-423, 1948.
17. J. Pena, J. Lozano, and P. Larranaga, "An Empirical Comparison of Four Initialization Methods for the K-means Algorithm," Pattern recognition letters, vol. 20, no. 10, pp. 1027-1040, 1999.
18. A. Likas, N. Vlassis, and J. J. Verbeek, "The Global K-means Clustering Algorithm," Pattern Recognition, vol. 36, no. 2, pp. 451-461, 2003.
19. A. Bagirov, "Modified Global K-means Algorithm for Minimum Sumof- squares Clustering Problems," Pattern Recognition, vol. 41, no. 10, pp. 3192-3199, 2008.
20. Y. Hong, S. Kwong, Y. Chang, and Q. Ren, "Consensus Unsupervised Feature Ranking from Multiple Views," Pattern Recognition Letters, vol. 29, no. 5, pp. 595-602, 2008.
21. L. Yu and H. Liu, "Feature Selection for High-dimensional Data: a Fast Correlation-based Filter Solution," Proc. of International Conference on Machine Learning, 2003, pp. 856-863.
22. I. Guyon and A. Elisseeff, "An Introduction to Variable and Feature Selection," Journal of Machine Learning Research, vol. 3, pp. 1157-1182, 2003.
23. D. Sridhar, E. Bartlett, and R. Seagrave, "Information Theoretic Subset Selection for Neural Network Models," Computers & Chemical Engineering, vol. 22, no. 4-5, pp. 613-626, 1998.
24. M. Hall and L. Smith, "Feature Subset Selection: a Correlation Based Filter Approach," Proc. of the 4th International Conference on Neural Information Processing and Intelligent Information Systems, Citeseer, 1997, pp. 855-858.
25. MIT Lincoln Laboratory. (2000). DARPA Intrusion Detection Scenario Specific Datasets [On line]. Available: http://www.ll.mit.edu/mission/ communications/ist/corpora/ideval/data/2000/LLS-DDOS-1.0.html.