Visual analytics model for intrusion detection in flood attack

Proceedings - 12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2013

Volumn , Issue , 2013, Pages 277-284

  Zhang, Jinson ^a   Huang, Mao Lin ^a  

^a UNIVERSITY OF TECHNOLOGY SYDNEY   (Australia)

Author keywords

attack density; attack scale; DDoS flood attack; information visualization; Network security; workload

Indexed keywords

ATTACK SCALE; DISTRIBUTED DENIAL OF SERVICE ATTACK; FLOOD ATTACKS; INFORMATION VISUALIZATION; INTRUSION DETECTION SYSTEMS; SYSTEM CAPABILITIES; VISUAL ANALYTICS; WORKLOAD;

INFORMATION SYSTEMS; INTRUSION DETECTION; NETWORK SECURITY;

FLOODS;

EID: 84893491079     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/TrustCom.2013.38     Document Type: Conference Paper

References (36)

1. R.K.C. Chang, "Defending against flooding-based distributed denialof-service attacks: a tutorial," Communications Magazine, IEEE , vol.40, no.10, pp.42-51, Oct 2002
2. J. Mirkovic and P. Reiher, "A taxonomy of DDoS attack and DDoS defense mechanisms". SIGCOMM Computer. Communication Review. vol 34, no. 2, 2004, pp, 39-53.
3. Y. Yu, M. Fry, A. Schaeffer-Filho, P. Smith and D. Hutchison, "An adaptive approach to network resilience: Evolving challenge detection and mitigation," 2011 8th International Workshop on the Design of Reliable Communication Networks (DRCN), pp.172-179, 10-12 Oct. 2011
4. Y. Xiang, K. Li, and W. Zhou, "Low-Rate DDoS Attacks Detection and Traceback by Using New Information Metrics," Information Forensics and Security, IEEE Transactions on , vol.6, no.2, pp.426-437, June 2011
5. Habiba and T. Berger-Wolf, "Working for Influence: Effect of Network Density and Modularity on Diffusion in Networks," In Proc, 2011 IEEE 11th International Conference on Data Mining Workshops (ICDMW), PP.933-940, 11 Dec. 2011
6. F.L. Villafuerte, K. Terfloth and J. Schiller, "Using Network Density as a New Parameter to Estimate Distance," In Proc. ICN 2008. Seventh International Conference on Networking, pp.30-35, 13-18 April 2008
7. Y. Chen and K. Hwang, "Collaborative Change Detection of DDoS Attacks on Community and ISP Networks". In Collaborative Technologies and Systems, 2006. CTS 2006, pp. 401-410, 14-17 May 2006
8. M.L. Huang, J. Zhang, Q. V. Nguyen and J. Wang, "Visual Clustering of Spam Emails for DDoS Analysis," In Information Visualization, IV 2011, 15th International Conference on, pp.65-72, 13-15 July 2011
9. J. Zhang, M.L. Huang and D. Hoang, "Detecting DDoS Attack in Spam Emails using Density-Weight Model". In Proc, ICITIS 2011, 2011 2nd IEEE International Conference on Information Theory and Information Security, Hangzhou, China, pp.344-352, 4-6 Nov 2011
10. Y. Huang, X. Fu, Q. Hou and Z. Yu, "The Early Detection of DDoS Based on the Persistent Increment Feature of the Traffic Volume," In Proc, AINAW 2008, 22nd International Conference on Advanced Information Networking and Applications-Workshops, 2008, pp.365-370, 25-28 March 2008
11. A. Shiravi, H. Shiravi, M. Tavallaee, and A.A. Ghorbani, "Toward developing a systematic approach to generate benchmark datasets for intrusion detection," Computers & Security, Volume 31, Issue 3, May 2012, Pages 357-374, ISSN 0167-4048
12. S. Savage, D. Wetherall, A. Karlin and T Anderson, "Network support for IP traceback," Networking, IEEE/ACM Transactions on , vol.9, no.3, pp.226-237, Jun 2001
13. P. Eades and M.L. Huang , "Navigating Clustered Graphs using Force-Directed Methods", Journal of Graph Algorithms and Applications, vol. 4 no. 3, pp 157-181, July, 2000.
14. Q.V. Nguyen, M.L. Huang, "A space-optimized tree visualization," In Proc, INFOVIS '02, IEEE Symposium on Information Visualization, 2002, pp. 85-92
15. Y. Kim, J.Y. Jo, H.J. Chao and F. Merat, "High-speed router filter for blocking TCP flooding under DDoS attack," In Proc, 2003 IEEE International Performance, Computing, and Communications Conference, pp. 183-190, 9-11 April 2003
16. S. Elnaffar and P. Martin, "Techniques and a Framework for Characterizing Computer Systems' Workloads," Innovations in Information Technology, 2006, pp.1-5, Nov. 2006
17. M. Nijim, T. Xie and X. Qin, "Integrating a performance model in self-managing computer systems under mixed workload conditions," In Proc, IRI 2005, IEEE International Conference on Information Reuse and Integration, 2005, pp. 132-137, 15-17 Aug. 2005
18. A.R. Abdulgafer, P.N. Marimuthu and S.J. Habib, "Redesign of gridbased enterprise information network through servers consolidation," In Proc, ICCIT 2010, 5th International Conference on Computer Sciences and Convergence Information Technology, pp.445-450, Nov. 30-Dec. 2 2010
19. M.N. Bennani and D.A. Menasce, "Assessing the robustness of selfmanaging computer systems under highly variable workloads," In Proc, International Conference on Autonomic Computing, 2004, pp. 62-69, 17-18 May 2004
20. H. Koike, K. Ohno, and K. Koizumi, "Visualizing cyber attacks using IP matrix," In Proc, VizSEC 05, IEEE Workshop on Visualization for Computer Security, 2005. pp. 91-98
21. M. Li, J. Li, and W. Zhao, "Experimental study of DDOS attacking of flood type based on NS2" International Journal of Electronics and Computers, vol. 1, no. 2, pp. 143, 2009.
22. K. Lee, J. Kim, K.H. Kwon, Y. Han and S. Kim, "DDoS attack detection method using cluster analysis", Expert Systems with Applications, Volume 34, Issue 3, April 2008, Pages 1659-1665, ISSN 0957-4174
23. J. Zhang, P. Yang, L. Lu, and L. Chen, "NetViewer: A Visualization Tool for Network Security Events," In proc, NSWCTC '09. International Conference on Networks Security, Wireless Communications and Trusted Computing, 2009, pp. 434-437
24. KDD Cup 1999. Available on http://kdd.ics.uci.edu/databases/kddcup99/ kddcup99.html, August 2010.
25. L. Garber, 'Denial-of-service attacks rip the Internet'. IEEE Computer, 2000, Vol 33, pp 12-17
26. V. Paxson, 'An analysis of using reflectors for distributed denial-ofservice attacks'. SIGCOMM Computer. Communication. Review. vol 31, issue 3, July 2001, pp.38-47
27. J. McPherson, K-L Ma, P. Krystosk, T. Bartoletti, and M. Christensen. "PortVis: a tool for port-based detection of security events". In Procc, VizSEC/DMSEC '04, 2004 ACM workshop on Visualization and data mining for computer security, 2004, pp.73-81
28. J. Mirkovic, G. Prier and P. Reiher, "Attacking DDoS at the source," In Proc, 10th IEEE International Conference on Network Protocols, 2002, pp. 312-321, 12-15 Nov. 2002
29. C. Kintzel, J. Fuchs, and F. Mansmann. "Monitoring large IP spaces with ClockView". In Proc, VizSec '11, 8th International Symposium on Visualization for Cyber Security. 2011 , pp.1-10
30. J-P. van Riel and B. Irwin. "InetVis, a visual tool for network telescope traffic analysis". In Proc, AFRIGRAPH '06. 4th international conference on Computer graphics, virtual reality, visualisation and interaction in Africa, 2006, pp.85-89.
31. A. Yaar, A. Perrig and D. Song, "StackPi: New Packet Marking and Filtering Mechanisms for DDoS and IP Spoofing Defense," IEEE Journal on Selected Areas in Communications, vol.24, no.10, pp.1853-1863, Oct. 2006
32. D.K.Y. Yau, J.C.S. Lui, F. Liang and Y. Yam, "Defending against distributed denial-of-service attacks with max-min fair server-centric router throttles". IEEE/ACM Transaction on Networking. Vol.13, no.1,pp. 29-42, Feb 2005
33. K. Lakkaraju, W. Yurcik, and A.J. Lee, "NVisionIP: netflow visualizations of system state for security situational awareness". In Proc, VizSEC/DMSEC '04, 2004 ACM workshop on Visualization and data mining for computer security. 2004, pp.65-72
34. E.M. Salvador and L.Z. Granville, "Using visualization techniques for SNMP traffic analyses," In Proc, ISCC 2008, IEEE Symposium on Computers and Communications, 2008, pp.806-811, 6-9 July 2008
35. X. Yin, W. Yurcik, M. Treaster, Y. Li, and K. Lakkaraju. "VisFlowConnect: netflow visualizations of link relationships for security situational awareness". In Proc, VizSEC/DMSEC '04, 2004 ACM workshop on Visualization and data mining for computer security, 2440, pp.26-34
36. R. Ball, G.A. Fink and C. North. "Home-centric visualization of network traffic for security administration". In Proc, VizSEC/DMSEC '04, 2004 ACM workshop on Visualization and data mining for computer security, 2004, pp.55-64