DDoS attack detection method based on network abnormal behaviour in big data environment

Abstract

Distributed denial of service (DDoS) attack becomes a rapidly growing problem with the fast development of the Internet. The existing DDoS attack detection methods have time-delay and low detection rate. This paper presents a DDoS attack detection method based on network abnormal behavior in a big data environment. Based on the characteristics of flood attack, the method filters the network flows to leave only the "many-to-one" network flows to reduce the interference from normal network flows and improve the detection accuracy. We define the network abnormal feature value (NAFV) to reflect the state changes of the old and new IP address of "many-to-one" network flows. Finally, the DDoS attack detection method based on NAFV real-time series is built to identify the abnormal network flow states caused by DDoS attacks. The experiments show that compared with similar methods, this method has higher detection rate, lower false alarm rate and missing rate.

Formal Specification and Verification of Distributed Denial of Service (DDoS)

“…This section introduces the results of model-checking obtained from the formal analysis of the DDoS protocol given in [5]. This protocol can also be simulated over NS3 [17] but we verify the functional requirements of the protocol which is indeed a specialization of the UPPAAL tool set.…”

“…According to best of our knowledge, the DDoS protocol given in [5] is not formally verified yet. We show that the mechanism of a DDoS can be simulated in a model-checker and we can analyse the scheme of determining the DDoS attack.…”

“…In this paper,the given protocol of the DDoS attack detection model is checked by formal verification in "UPPAAL" [4] to check whether the solution to a given problem is valid or not. The protocol is defined in [5]. A model-checking approach is applied on reachability of DoS with the help of timed automata [6].…”

“…This paper is based on the specification of the protocol. The protocol in [5] explains that why a DoS (Denial of service) cannot be prevented [9][10]. This article provides the specification of Distributed-denialof-service.…”