Detection of DDoS backscatter based on traffic features of darknet TCP packets

Proceedings - 2014 9th Asia Joint Conference on Information Security, AsiaJCIS 2014

Volumn , Issue , 2014, Pages 39-43

  Furutani, Nobuaki ^a   Ban, Tao ^b   Nakazato, Junji ^b   Shimamura, Jumpei ^c   Kitazono, Jun ^a   Ozawa, Seiichi ^a  

^a KOBE UNIVERSITY   (Japan)

^b NATIONAL INSTITUTE OF INFORMATION AND COMMUNICATIONS TECHNOLOGY   (Japan)

^c CLWIT INC   (Japan)

Author keywords

DDoS attacks; machine learning; network security; Support Vector Machine; traffic classification

Indexed keywords

ARTIFICIAL INTELLIGENCE; BACKSCATTERING; DENIAL-OF-SERVICE ATTACK; LEARNING SYSTEMS; SECURITY OF DATA; SUPPORT VECTOR MACHINES; TELECOMMUNICATION TRAFFIC; TRANSMISSION CONTROL PROTOCOL;

DDOS ATTACK; ECONOMIC DAMAGES; IMMINENT THREATS; LABEL INFORMATION; PRIVATE COMPANIES; PUBLIC ORGANIZATIONS; TRAFFIC CLASSIFICATION; TRAFFIC FEATURES;

NETWORK SECURITY;

EID: 84946688296     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/AsiaJCIS.2014.23     Document Type: Conference Paper

References (26)

1. PAR. Kumar and S. Selvakumar, "Distributed Denial-of- Service (DDoS) Threat in Collaborative Environment - A Survey on DDoS Attack Tools and Traceback Mechanisms," Advance Computing Conference, IACC 2009, pp. 1275-1280, 2009.
2. R. Anderson, "Security Engineering (A Guide to Building Dependable Distributed Systems)," Wiley, pp. 364-366, 2002.
3. P. Sangkatsanee, N. Wattanapongsakorn, and C. Charnsripinyo, "Practical real-time intrusion detection using machine learning approaches," Computer Communications, pp. 2227-2235, 2011.
4. D. Stevanovic, N. Vlajic, and A. An, "Detection of malicious and non-malicious website visitors using unsupervised neural network learning," Applied Soft Computing, pp. 698-708, 2013.
5. J. Zhang, Y. Xiang, W. Zhou, and Y. Wang, "Unsupervised traffic classification using flow statistical properties and IP packet payload," Journal of Computer and System, pp. 573-585, 2013.
6. R. Zhong and G. Yue, "DDoS Detection System Based on Data Mining," the Second International Symposium on Networking and Network Security, pp. 62-65, 2010.
7. M. Bailey, E. Cooke, F. Jahanian, N. Provos, K. Rosaen, and D. Watson, "Data Reduction for the Scalable Automated Analysis of Distributed Darknet Traffic," IMC '05 Proc. of the 5th ACM SIGCOMM conference on Internet Measuremen, pp. 239-252, 2005.
8. K. Nakao, D. Inoue, and E. Masashi, "Practical correlation analysis between scan and malware profiles against zeroday attacks based ondarknet monitoring," IEICE Trans. on Information and Systems, vol.E92-D, no.5, pp. 787-798, 2009.
9. S. Akimoto, Y. Hori, and K. Sakurai, "Collaborative behavior visualization and its detection by observing darknet traffic," Cyberspace Safety and Security, pp. 212-226, 2012.
10. S. Zargar, J. Joshi, and D. Tipper, "A survey of defense mechanisms against distributed denial of service (DDoS) flooding attacks," Communications Surveys & Tutorials, pp. 2046-2069, IEEE, 2013.
11. H. Yasui, T. Kimura, and H. Tsuji, "Kisowomanabu computer Gairon," Ohmsha, pp. 135-142, 2011, in Jananese.
12. D. Moore, C. Shannon, G. Voelker, and S. Savage, "Network Telescopes: Techical Report," Technical report, Caida, 2004.
13. R. O. Duda, P. E. Hart, and D. G. Stork, "Pattern Classification," Wiley, pp. 14-17, 2000.
14. S. Abe, "Support Vector Machines for Pattern Classification (Advance in Pattern Recognition)," Springer-Verlag, London, UK, 2010.
15. J. F. Kurose and K. W. Ross, "Computer Networking: A Top- Down Approach," Pearson Education, Boston, 2010.
16. LA. Larzon, M. Degermark, and S. Pink, "UDP Lite for Real Time Multimedia Applications," HP Labs, 1999.
17. CL. Schuba, IV. Krsul, and MG. Kuhn, "Analysis of a denial of service attack on TCP," Security and Privacy, pp. 208-223, 1997.
18. J. Pahdye and S. Floyd, "On Inferring TCP Behavior," ACM SIGCOMM Computer Communication Review, pp. 287-297, 2001.
19. Y. W. Chang, C. J. Hsieh, K. W. Chang, M. Ringgaard, and C. J. Lin, "Training and Testing Low-degree Polynomial Data Mappings via Linear SVM," Journal of Machine Learning Research, pp. 1471-1490, 11, 2010.
20. C. Gold and P. Sollich, "Model selection for support vector machine classification," Neurocomputing, pp. 221-249, 2003.
21. C. W. Hsu, C. C. Chang, and C. J. Lin, "A practical guide to support vector classification," Technical report, Department of Computer Science, National Taiwan University. 2003.
22. R. Kohavi, "A Study of Cross-Validation and Bootstrap for Accuracy Estimation and Model Selection," IJCAI, 1995.
23. M. Kamizono, "Datasets for Anti-Malware Research(MWS Datasets 2013)," 2013.
24. S. McCreary and K. C. Claffy, "Trends in Wide Area IP Traffic Patterns," Technical report, Caida, 2000.
25. J. Nakazato, J. Shimamura, M. Eto, D. Inoeu, and K. Nakao, "Backscatter Analysis toward Clear Categorization of DoS Attacks," SCIS, 2013, in Jananese.
26. C. C. Chang and C. J. Lin, "LIBSVM: a library for support vector machines," ACM Transactions on Intelligent Systems and Technology, 2:27:1-27:27, 2011. Software available at http://www.csie.ntu.edu.tw/ cjlin/libsvm