An on-line intrusion detection approach to identify low-rate DoS attacks

Proceedings - International Carnahan Conference on Security Technology

Volumn 2014-October, Issue October, 2014, Pages

  Aiello, M ^a   Cambiaso, E ^a   Mongelli, M ^a   Papaleo, G ^a  

^a CNR   (Italy)

Author keywords

anomaly detection; denial of service; fourier transform; slow dos attack

Indexed keywords

ANOMALY DETECTION; FOURIER TRANSFORMS; INTRUSION DETECTION; NETWORK SECURITY;

DENIAL OF SERVICE; DETECTION METHODS; INTRUSION DETECTION APPROACHES; LOW RATES; PACKET INSPECTION; REAL TRAFFIC; SMALL TIME HORIZON; SPECTRAL FEATURE;

DENIAL-OF-SERVICE ATTACK;

EID: 84931084108     PISSN: 10716572     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CCST.2014.6987039     Document Type: Conference Paper

References (18)

1. S. Bhatia, G. Mohay, A. Tickle, and E. Ahmed, "Parametric differences between a real-world distributed denial-of-service attack and a flash event," in Availability, Reliability and Security (ARES), 2011 Sixth International Conference on, Aug 2011, pp. 210-217.
2. Y. Xie and S. zheng Yu, "Monitoring the application-layer ddos attacks for popular websites," Networking, IEEE/ACM Transactions on, vol. 17, no. 1, pp. 15-25, Feb 2009.
3. M. Aiello, G. Papaleo, and E. Cambiaso, "Slowreq: A weapon for cyberwarfare operations. characteristics, limits, performance, remediations," in International Joint Conference SOCO13-CISIS13-ICEUTE13. Springer, 2014, pp. 537-546.
4. D. Moustis and P. Kotzanikolaou, "Evaluating security controls against http-based ddos attacks," in Information, Intelligence, Systems and Applications (IISA), 2013 Fourth International Conference on, July 2013, pp. 1-6.
5. R. Braga, E. Mota, and A. Passito, "Lightweight ddos flooding attack detection using nox/openflow," in Local Computer Networks (LCN), 2010 IEEE 35th Conference on, Oct 2010, pp. 408-415.
6. S. Dolev, Y. Elovici, A. Kesselman, and P. Zilberman, "Trawling traffic under attack, overcoming ddos attacks by target-controlled traffic filtering," in Parallel and Distributed Computing, Applications and Technologies, 2009 International Conference on, Dec 2009, pp. 336-341.
7. T. Tuncer and Y. Tatar, "Detection dos attack on fpga using fuzzy association rules," in Trust, Security and Privacy in Computing and Communications (TrustCom), 2011 IEEE 10th International Conference on, Nov 2011, pp. 1271-1276.
8. H. Liu and M. S. Kim, "Real-time detection of stealthy ddos attacks using time-series decomposition," in Communications (ICC), 2010 IEEE International Conference on, May 2010, pp. 1-6.
9. E. Cambiaso, G. Papaleo, G. Chiola, and M. Aiello, "Slow dos attacks: definition and categorisation," International Journal of Trust Management in Computing and Communications, vol. 1, no. 3, pp. 300-319, 2013.
10. L. C. Giralte, C. Conde, I. M. De Diego, and E. Cabello, "Detecting denial of service by modelling web-server behaviour," Computers & Electrical Engineering, vol. 39, no. 7, pp. 2252-2262, 2013.
11. E. Cambiaso, G. Papaleo, and M. Aiello, "Introducing the slownext attack," in Technical Report IEIIT-CNR 1274. National Research Council, 2014.
12. F. Gont, Security Assessment of the Transmission Control Protocol (TCP), Internet Engineering Task Force (IETF), 01 2001.
13. A. Sperotto, G. Schaffrath, R. Sadre, C. Morariu, A. Pras, and B. Stiller, "An overview of ip flow-based intrusion detection," Communications Surveys Tutorials, IEEE, vol. 12, no. 3, pp. 343-356, Third 2010.
14. T. Benmusa, D. J. Parish, and M. Sandford, "Detecting and classifying delay data exceptions on communication networks using rule based algorithms," International Journal of Communication Systems, vol. 18, no. 2, pp. 159-177, 2005. [Online]. Available: http://dx.doi.org/10.1002/dac.694
15. W. Ellens, P. uraniewski, A. Sperotto, H. Schotanus, M. Mandjes, and E. Meeuwissen, "Flow-based detection of dns tunnels," in Emerging Management Mechanisms for the Future Internet, ser. Lecture Notes in Computer Science, G. Doyen, M. Waldburger, P. eleda, A. Sperotto, and B. Stiller, Eds. Springer Berlin Heidelberg, 2013, vol. 7943, pp. 124-135.
16. K. M. Prasad, A. R. M. Reddy, and K. V. Rao, "Discriminating ddos attack traffic from flash crowds on internet threat monitors (itm) using entropy variations," 2013.
17. S. Guiau, Information Theory with New Applications, ser. Advanced Book Program - McGraw-Hill Book Company. MacGraw-Hill Books Company, 1977. [Online]. Available: http://books.google.it/books?id=DohQAAAAMAAJ
18. C. Callegari, L. Gazzarrini, S. Giordano, M. Pagano, and T. Pepe, "Improving pca-based anomaly detection by using multiple time scale analysis and kullbackleibler divergence," International Journal of Communication Systems, pp. n/a-n/a, 2012. [Online]. Available: http://dx.doi.org/10.1002/dac.2432