Ddos detection and traceback with decision tree and grey relational analysis

International Journal of Ad Hoc and Ubiquitous Computing

Volumn 7, Issue 2, 2011, Pages 121-136

  Wu, Yi Chi ^a   Tseng, Huei Ru ^b   Yang, Wuu ^a   Jan, Rong Hong ^a  

^a NATIONAL CHIAO TUNG UNIVERSITY   (Taiwan)

^b INDUSTRIAL TECHNOLOGY RESEARCH INSTITUTE   (Taiwan)

Author keywords

Attacker traceback; Ddos detection; Decision tree; Grey relational analysis

Indexed keywords

DECISION TREES; FLOW PATTERNS; NETWORK SECURITY; PATTERN MATCHING;

ATTACKER TRACE BACKS; DDOS DETECTION; DECISION TREE TECHNIQUES; DISTRIBUTED DENIAL OF SERVICE ATTACK; FALSE NEGATIVE RATE; FALSE POSITIVE RATES; GREY RELATIONAL ANALYSIS; TRAFFIC FLOW PATTERNS;

DENIAL-OF-SERVICE ATTACK;

EID: 79952585972     PISSN: 17438225     EISSN: 17438233     Source Type: Journal    
DOI: 10.1504/IJAHUC.2011.038998     Document Type: Article

References (33)

1. Bellovin, S.M., Leech, M. and Taylor, T. (2001) ICMP Traceback Messages, IETF, Internet Draft.
2. Benzel, T., Braden, R., Kim, D., Neuman, C., Joseph, A. and Sklower, K. (2006) 'Experience with DETER: a testbed for security research', Proceedings of the 2nd International Conference on Testbeds and Research Infrastructures for the Development of Networks and Communities (TRIDENTCOM'06), March.
3. Berral, J.L., Poggi, N., Alonso, J., Gavaldá, R., Torres, J. and Parashar, M. (2008) 'Adaptive distributed mechanism against flooding network attacks based on machine learning', Proceedings of the 1st ACM Workshop on Workshop on AISec, October, pp.43-50.
4. Bloom, B H. (1970) 'Space/time trade-offs in hash coding with allowable errors', Communications of the ACM, Vol. 13, No. 7, July, pp.422-426.
5. Bouzida, Y. and Cuppens, F. (2006) 'Neural networks vs. decision trees for intrusion detection', IEEE/IST Workshop on Monitoring, Attack Detection and Mitigation (MonAM'06), September.
6. Burch, H. (2000) 'Tracing anonymous packets to their approximate source', Proceedings of the 14th USENIX Conference on System Administration, December, pp.319-328.
7. Deng, J.L. (1989) 'Introduction to grey system theory', The Journal of Grey System, Vol. 1, No. 1, November, pp.1-24.
8. Djalaliev, P., Jamshed, M., Farnan, N. and Brustoloni, J. (2008) 'Sentinel: hardware-accelerated mitigation of bot-based DDoS attacks', Proceedings of the 17th International Conference on Computer Communications and Networks, August, pp.633-640.
9. Douligeris, C. and Mitrokotsa, A. (2004) 'DDoS attacks and defense mechanisms: classification and state-of-the-art', Computer Networks, Vol. 44, No. 5, April, pp.643-666.
10. Fallah, M.S. (2010) 'A puzzle-based defense strategy against flooding attacks using game theory', IEEE Transactions on Dependable and Secure Computing, Vol. 7, No. 1, January-March, pp.5-19.
11. Hsia, K.H., Chen, M.Y. and Chang, M.C. (2004) 'Comments on data pre-processing for grey relational analysis', Journal of Grey System, Vol. 7, No. 1, June, pp.15-20.
12. Izaddoost, A. Othman, M. and Rasid, M.F.A. (2007) 'Accurate ICMP traceback model under DoS/DDoS attack', Proceedings of the International Conference on Advanced Computing and Communications (ADCOM'07), December, pp.441-446.
13. Kim, Y. and Helmy, A. (2005) 'SWAT: small world-based attacker traceback in ad-hoc networks', Proceedings of the 2nd International Conference on Mobile and Ubiquitous Systems: Networking and Services (MobiQuitous'05), July, pp.85-96. (Pubitemid 44523267)
14. Li, X. and Chan, C.W. (2006) 'Applying a machine intelligence algorithm for prediction', Proceedings of the International Conference on Computational Intelligence and Security, Vol. 1, November, pp.793-796.
15. Lim B. and Uddin, M.S. (2005) 'Statistical-based SYN-flooding detection using programmable network processor', Proceedings of the 3rd International Conference on Information Technology and Applications (ICITA'05), Vol. 2, July, pp.465-470. (Pubitemid 43763242)
16. Lin, Y. and Liu, S. (2004) 'A historical introduction to grey systems theory', Proceedings of the IEEE International Conference on Systems, Man and Cybernetics, Vol. 3, October, pp.2403-2408. (Pubitemid 40408523)
17. Mansfield, G., Ohta, K., Takei, Y., Kato, N. and Nemoto, Y. (2000) 'Towards trapping wily intruders in the large', Computer Networks, Vol. 34, No. 4, October, pp.659-670.
18. Mirkovic J. and Reiher, P. (2005) 'D-WARD: a sourceend defense against flooding denial-of-service attacks', IEEE Transactions on Dependable and Secure Computing, Vol. 2, No. 3, July-September, pp.216-232. (Pubitemid 41560432)
19. Mirkovic, J. and Reiher, P. (2004) 'A taxonomy of DDoS attack and DDoS defense mechanisms', ACM SIGCOMM Computer Communications Review, Vol. 34, No. 2, April, pp.39-54.
20. Mirkovic, J., Prier, G. and Reiher, P. (2003) 'Source-end DDoS defense', Proceedings of the 2nd IEEE International Symposium on Network Computing and Applications (NCA'03), April, pp.171-178.
21. Noh, S., Lee, C., Choi, K. and Jung, G. (2003) 'Detecting distributed denial of service (DDoS) attacks through inductive learning', Proceedings of the 4th International Conference on Intelligent Data Engineering and Automated Learning (IDEAL'03), March, pp.286-295. (Pubitemid 36996100)
22. Öke, G. and Loukas, G. (2007) 'A denial of service detector based on maximum likelihood detection and the random neural network', The Computer Journal, Vol. 50, No. 6, September, pp.717-727. (Pubitemid 350031419)
23. Peng, T., Leckie, C. and Ramamohanarao, K. (2007) 'Survey of network-based defense mechanisms countering the DoS and DDoS problems', ACM Computing Surveys, Vol. 39, No. 1, pp.1-45.
24. Qu, H., Su, P., Lin, D. and Feng, D. (2005) 'A packet marking scheme for IP traceback', Proceedings of the International Conference on Networking, April, pp.964-971. (Pubitemid 41452203)
25. Quinlan, J.R. (1986) 'Induction of decision trees', Machine Learning, Vol. 1, No. 1, pp.81-106.
26. Quinlan, J.R. (1993) C4.5: Programs for Machine Learning, Morgan Kaufmann Publishers, San Mateo, CA.
27. Rokach, L. and Maimon, O. (2005) 'Top-down induction of decision trees classifier - a survey', IEEE Transactions on Systems, Man, and Cybernetics, Part C: Applications and Reviews, Vol. 35, No. 4, November, pp.476-487. (Pubitemid 41638167)
28. Savage, S., Wetherall, D., Karlin, A. and Anderson, T. (2000) 'Practical network support for IP traceback', ACM SIGCOMM Computer Communications Review, Vol. 30, No. 4, August, pp.295-306.
29. Schwab, S., Wilson, B., Ko, C. and Hussain, A. (2007) 'SEER: a security experimentation environment for DETER', Proceedings of the DETER Community Workshop on Cyber Security Experimentation and Test, August.
30. Sommers, J., Kim, H. and Barford, P. (2004) 'Harpoon: a flow-level traffic generator for router and network tests', Proceedings of the Joint International Conference on Measurement and Modeling of Computer Systems, June, pp.392-393.
31. Stone, R. (2000) 'CenterTrack: an IP overlay network for tracking DoS floods', Proceedings of the 9th Conference on USENIX Security Symposium, Vol. 9, July, pp.15.
32. Waxman, B.M. (1988) 'Routing of multipoint connections', IEEE Journal on Selected Areas in Communications, Vol. 6, No. 9, December, pp.1617-1622.
33. Zaroo, P. (2002) A survey of DDoS Attacks and Some DDoS Defense Mechanisms, Technical Report, Lecture Notes for Advanced Information Assurance (CS626), Computer Science, Purdue University.