Automatic detection of DDoS attacks to notification services

Abstract

A notification service alerts a large number of recipients to important or emergency events in a timely manner. A denial of service (DoS) attack inserts unnecessary traffic to slow down or chock the notification service and a distributed DoS (DDoS) comes from seemingly various sources. The challenge of automated detection of DDoS attacks lies in distinguishing attacks from temporary surge of normal notification traffic. This paper proposes an 'escalation hierarchy' method to detect such types of DDoS intrusions by monitoring performance degradation at various levels of social events. Our trial of the method on an industrial large-scale notification service showed the effectiveness of our method through automating both consistency checking of measurement data and identification of causes for performance degradation.