Ensemble-based DDoS detection and mitigation model

Proceedings of the 5th International Conference on Security of Information and Networks, SIN'12

Volumn , Issue , 2012, Pages 79-86

  Bhatia, Sajal ^a   Schmidt, Desmond ^a   Mohay, George ^a  

^a QUEENSLAND UNIVERSITY OF TECHNOLOGY   (Australia)

Author keywords

DDoS attacks; Flash events; MIB data analysis; Modelling; Network traffic analysis; Synthetic traffic generation

Indexed keywords

APPLICATION LAYERS; DDOS ATTACK; DDOS DETECTION; DISTRIBUTED DENIAL OF SERVICE ATTACK; FLASH EVENT; MANAGEMENT INFORMATION BASE; NETWORK TRAFFIC ANALYSIS; PARTIAL IMPLEMENTATION; SERVER LOADS; SOFTWARE-BASED; SYNTHETIC NETWORKS; TRAFFIC GENERATION; TRAFFIC GENERATORS; WORK-IN-PROGRESS;

FREQUENCY HOPPING; MODELS; NETWORK LAYERS; SECURITY OF DATA;

INFORMATION MANAGEMENT;

EID: 84870380223     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2388576.2388587     Document Type: Conference Paper

References (21)

1. KDD Cup 1999 Data, http://kdd.ics.uci.edu/databases/kddcup99/kddcup99. html.7http://www.endace.com/dag-7.5g2-datasheet.html.
2. The CAIDA UCSD "DDoS Attack 2007" Dataset. http://www.caida. org/data/passive/ddos-20070804-dataset.xml.
3. E. Ahmed, G. Mohay, A. Tickle, and S. Bhatia. Use of IP Addresses for High Rate Flooding Attack Detection. In Proceedings of the International Information Security Conference (SEC 2010): Security and Privacy - Silver Lining in the Cloud, IFIP World Computer Congress, Brisbane, Australia, 20-23, September 2010.
4. M. Arlitt and T. Jin. 1998 World Cup Web Site Access Logs. http://www.acm.org/sigcomm/ITA/, 1998.
5. C. Bao. Intrusion Detection Based on One-class SVM and SNMP MIB Data. In 2009 Fifth International Conference on Information Assurance and Security, pages 346-349. IEEE, 2009.
6. S. Bhatia, G. Mohay, D. Schmidt, and A. Tickle. Modelling web-server flash events. In Proceedings of The 11th IEEE International Symposium on Network Computing and Applications (NCA) 2012, pages 79-86. IEEE, 2012.
7. S. Bhatia, G. Mohay, A. Tickle, and E. Ahmed. Parametric differences between a real-world distributed denial-of-service attack and a flash event. In Proceedings of Sixth International Conference on Availability, Reliability and Security (ARES), 2011, pages 210-217. IEEE, 2011.
8. J. Bumgamer and S. Borg. The US-CCU report on the gerogian cyber campaign . Technical report, U.S. Cyber Consequences Unit, 2009.
9. L. Garber. Denial-of-service attacks rip the Internet. Computer, 33(4):12-17, 2000.
10. C. Grice. How a basic attack crippled Yahoo. Technical report, CNET News, 2000.
11. S. Jin and D. Yeung. A covariance analysis model for ddos attack detection. In Communications, 2004 IEEE International Conference on, volume 4, pages 1882-1886. IEEE, 2004.
12. J. Jung, B. Krishnamurthy, and M. Rabinovich. Flash crowds and denial of service attacks: Characterization and implications for CDNs and web sites. In Proceedings of the 11th international conference on World Wide Web, page 304. ACM, 2002.
13. S. Kandula, D. Katabi, M. Jacob, and A. Berger. Botz-4-sale: Surviving organized DDoS attacks that mimic flash crowds. In Proceedings of the 2nd conference on Symposium on Networked Systems Design & Implementation- Volume 2, pages 287-300. USENIX Association, 2005.
14. L. Limwiwatkul and A. Rungsawangr. Distributed denial of service detection using TCP/IP header and traffic measurement analysis. In Proceedings of the 2004 International Symposium on Communications and Information Technologies (ISCIT 2004), Sapporo, Japan, 2004.
15. J. Nazario. Political DDoS: Estonia and Beyond . In Invited Talk, in 17th USENIX Security Symposium, July 28-Aug 1, 2008, San Jose, CA, USA, 2008.
16. H. Park, P. Li, D. Gao, H. Lee, and R. Deng. Distinguishing between FE and DDoS Using Randomness Check. Information Security, pages 131-145, 2008.
17. J. Park and M. Kim. Design and implementation of an snmp-based traffic flooding attack detection system. Challenges for Next Generation Network Operations and Service Management, pages 380-389, 2008.
18. T. Peng, C. Leckie, and K. Ramamohanarao. Proactively detecting distributed denial of service attacks using source IP address monitoring. NETWORKING 2004, Networking Technologies, Services, and Protocols; Performance of Computer and Communication Networks; Mobile and Wireless Communications, pages 771-782, 2004.
19. M. Rajab, J. Zarfoss, F. Monrose, and A. Terzis. My botnet is bigger than yours (maybe, better than yours): Why size estimates remain challenging. In Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets, page 5. USENIX Association, 2007.
20. Yifu Feng, Rui Guo, Dongqi Wang, and Z. Bencheng. Research on the Active DDoS Filtering Algorithm Based on IP Flow. In Proceedings of the 2009 Fifth International Conference on Natural Computation, 2009.
21. J. Yu, H. Lee, M. Kim, and D. Park. Traffic flooding attack detection with SNMP MIB using SVM. Computer Communications, 31(17):4212-4219, 2008.