An in-depth analysis on traffic flooding attacks detection and system using data mining techniques

Yu, Jaehak; Kang, Hyunjoong; Park, Dae-Heon; Bang, Hyo-Chan; Kang, Do Wook

doi:10.1016/j.sysarc.2013.08.008

Cited by 43 publications

(17 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…One such massive attack happened at http://yahoo.com website on 7 February 2000. Similar attacks were reported in other commercial organizations such as http://cnn.com, e‐bay and Amazon. Yet another attack, the slammer worm —its virulent propagation resulted in the shutdown of range of critical systems, including a safety monitoring system in Ohio, thousands of automatic teller machines run by the Bank of America, and the Internet share trading in South Korea.…”

Section: Introductionsupporting

confidence: 81%

Application layer DDoS attack detection using cluster with label based on sparse vector decomposition and rhythm matching

Liao

Kang

et al. 2015

Security Comm. Networks

View full text Add to dashboard Cite

Distributed Denial of Service attack (DDoS) has been one of the greatest threats to network security for years. In recent years, DDoS attackers turn to application layer, which makes DDoS attack detection systems based on net layer and transport layer lose their performance. In this layer, Web service is the most vulnerable application. In this study, we analyze the differentiation between users behaviors, as we extract two feature sequences from Web logs to represent characteristics of user behavior, and then, application layer DDoS attack detection system architecture based on feature sequences is presented. This architecture is divided into two parts. For each part, we propose detection methods, respectively. Specially, we consider users request frequency sequence as sparse vector, and then put forward a kind of classification algorithm called sparse vector decomposition and rhythm matching (SVD‐RM), which is based on sparse vector decomposition and rhythm matching. This algorithm is fully considering the discrepancy of different users in access behavior. A cluster algorithm with label, called L‐Kmeans, is also proposed as embedded classifier in SVD‐RM. Finally, we simulate four kinds of prevalent application layer DDoS attack and conduct experiments to certify the effectiveness of our methods. Experimental results show that proposed methods are good to distinguish legal users and attackers in application layer. Copyright © 2015 John Wiley & Sons, Ltd.

show abstract

Section: Introductionsupporting

confidence: 81%

Application layer DDoS attack detection using cluster with label based on sparse vector decomposition and rhythm matching

Liao

Kang

et al. 2015

Security Comm. Networks

View full text Add to dashboard Cite

show abstract

“…• Direct physical representation: In this technique, the desired network topology is built by physically arranging a network of routers, switches, and computers [8].…”

Section: Testbed Design Strategiesmentioning

confidence: 99%

Towards a Reliable Intrusion Detection Benchmark Dataset

Sharafaldin¹,

Gharib²,

Lashkari³

et al. 2017

JSN

205

100

View full text Add to dashboard Cite

The urgently growing number of security threats on Internet and intranet networks highly demands reliable security solutions. Among various options, Intrusion Detection (IDSs) and Intrusion Prevention Systems (IPSs) are used to defend network infrastructure by detecting and preventing attacks and malicious activities. The performance of a detection system is evaluated using benchmark datasets. There exist a number of datasets, such as DARPA98, KDD99, ISC2012, and ADFA13, that have been used by researchers to evaluate the performance of their intrusion detection and prevention approaches. However, not enough research has focused on the evaluation and assessment of the datasets themselves and there is no reliable dataset in this domain. In this paper, we present a comprehensive evaluation of the existing datasets using our proposed criteria, a design and evaluation framework for IDS and IPS datasets, and a dataset generation model to create a reliable IDS or IPS benchmark dataset.

show abstract

“…Our analysis were carried out using Weka [44] that contains a collection of machine learning algorithms for data mining tasks. The parameters for classification in the experiments were set to the default values in Weka.…”

Section: Resultsmentioning

confidence: 99%

Ensemble-based multi-filter feature selection method for DDoS detection in cloud computing

Osanaiye

Cai

Choo

et al. 2016

J Wireless Com Network

262

136

View full text Add to dashboard Cite

Widespread adoption of cloud computing has increased the attractiveness of such services to cybercriminals. Distributed denial of service (DDoS) attacks targeting the cloud's bandwidth, services and resources to render the cloud unavailable to both cloud providers, and users are a common form of attacks. In recent times, feature selection has been identified as a pre-processing phase in cloud DDoS attack defence which can potentially increase classification accuracy and reduce computational complexity by identifying important features from the original dataset during supervised learning. In this work, we propose an ensemble-based multi-filter feature selection method that combines the output of four filter methods to achieve an optimum selection. We then perform an extensive experimental evaluation of our proposed method using intrusion detection benchmark dataset, NSL-KDD and decision tree classifier. The findings show that our proposed method can effectively reduce the number of features from 41 to 13 and has a high detection rate and classification accuracy when compared to other classification techniques.

show abstract

An in-depth analysis on traffic flooding attacks detection and system using data mining techniques

Cited by 43 publications

References 11 publications

Application layer DDoS attack detection using cluster with label based on sparse vector decomposition and rhythm matching

Application layer DDoS attack detection using cluster with label based on sparse vector decomposition and rhythm matching

Towards a Reliable Intrusion Detection Benchmark Dataset

Ensemble-based multi-filter feature selection method for DDoS detection in cloud computing

Contact Info

Product

Resources

About