Adaptive DDoS Detector Design Using Fast Entropy Computation Method

Abstract

Recently, the threat of DDoS (Distributed Denial-of-Service) attacks is growing continuously and acquiring attacking tools via Internet is getting easy. One of the researches introduced a fast method to detect attacks using modified information entropy (so called Fast Entropy). Fast Entropy shows the significant reduce of computational time compared to conventional entropy computation while it maintains detection accuracy. However, Fast Entropy needs the manual threshold settings during detection process which is not realistic in real detection facility. We introduce adaptive detector with dynamic detection window size and adaptive threshold shifting using Fast Entropy, called AFEA (Adaptive DDoS attack detection using Fast Entropy Approach). Our adaptive DDoS detector successfully demonstrates that its performance of the DDoS detection can be enhanced by the best result of Fast Entropy detection scheme without manual threshold setting and system training while it maintains the same computational time of Fast Entropy detection scheme. In addition, we found that Dynamic AFEA can enhance detection level more than fixed (non-dynamic) one when it is equipped with Fast Entropy.

A lightweight snapshot-based DDoS detector

“…An adaptive threshold is finally computed to detect anomalies within the traffic. The AFEA detector [6] is also based on similar techniques. Özçelik and Brooks [7] present a detector using the traffic headers entropy postprocessed with a wavelet filter and CUSUM to improve the detection accuracy.…”

A Novel Protective Framework for Defeating HTTP‐Based Denial of Service and Distributed Denial of Service Attacks

“…FAEB scheme does so periodically based on the adopted time in the module's configuration by calculating entropy of overall requests through the following formulas [50–55]: $\begin{array}{c}\text{entropy}=\text{Pi}\hspace{0.17em}\ast {\log }_{\mathrm{2}}\text{Pi},\\ \text{Pi}=\frac{\text{uri}\_\text{counts}}{\text{total}\_\text{counts}}.\end{array}$ …”

A System for Validating and Comparing Host-Based Ddos Detection Mechanisms

“…Currently, authors often use a private method to do that with various means. In [19], [20], for instance, authors implement their proposed algorithm as simulation programs and run on desktop with a certain data sets for getting the four quantities. The detection mechanisms for SYN flooding were surveyed in [18].…”

“…Researchers apply creatively various theories, such as calculating entropy in information theory [9], [10], [11], [12], data mining and artificial intelligent [13], [14], [15], [16], GT model in [26]. The performance of DDoS defense mechanisms were overall assessed by [17].…”