Distributed Denial of Service (DDoS) attack is a continuous critical threat to the internet. Application layer DDoSAttack is derived from the lower layers. Application layer based DDoS attacks use legitimate HTTP requests after establishment of TCP three way hand shaking and overwhelms the victim resources, such as sockets, CPU, memory, disk, database bandwidth. Network layer based DDoS attacks sends the SYN, UDP and ICMP requests to the server and exhausts the bandwidth. Normal profile is created from user's access behavior attributes which is the base line to differentiate DDoS attacks from flash crowd. An anomaly detection mechanism is proposed in this paper to detect DDoS attacks using Enhanced Support Vector Machine (ESVM) with string kernels. Normal user access behavior attributes is used as training samples for ESVM, which produces the model file. Data collected during normal and attack is used as test samples for ESVM. Application and Network layer DDoS attacks are classified with classification accuracy of 99 % with ESVM.
scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.