DDoS detection and traceback with decision tree and grey relational analysis

Abstract

Abstract:In Distributed Denial-of-Service (DDoS) Attack, an attacker breaks into many innocent computers (called zombies). Then, the attacker sends a large number of packets from zombies to a server, to prevent the server from conducting normal business operations. We design a DDoS-detection system based on a decision-tree technique and, after detecting an attack, to trace back to the attacker's locations with a traffic-flow pattern-matching technique. Our system could detect DDoS attacks with the false positive ratio about 1.2-2.4%, false negative ratio about 2-10%, and find the attack paths in traceback with the false negative rate 8-12% and false positive rate 12-14%.

EVFDT: An Enhanced Very Fast Decision Tree Algorithm for Detecting Distributed Denial of Service Attack in Cloud-Assisted Wireless Body Area Network

“…For this research, data mining techniques have been studied and evaluated for the detection of DDoS attack in cloud-assisted WBAN environment. From the perspective of DDoS attack detection, existing data mining techniques (Subbulakshmi et al [6], Wu et al [7], Lee et al [8], Arun and Selvakumar [9], and Thwe and Thandar [10]) can be broadly classified into source-based and destination-based detection techniques. Source-based detection techniques are deployed near the source of an attack whereas destination-based detection techniques are deployed near the victim of an attack.…”

“…Wu et al [7] proposed a destination-based DDoS attack detection technique. In this technique, a decision tree is deployed for attack detection and a traffic pattern matching technique for attack identification and its traceback.…”

Supervised learning‐based DDoS attacks detection: Tuning hyperparameters

“…Attack prevention and detection techniques in networks have been studied steadily over the past two decades with various approaches, such as stochastic modeling, decision theory, and game theory [1][2][3][4]. Recently, machine learning (ML) techniques, such as multilayer perceptron (MLP), have been applied to network attack detection [5][6][7][8][9][10][11][12][13][14][15][16][17][18][19][20][21][22][23]. In addition, as social media outlets, such as Facebook and Twitter, are regarded as possible vehicles for the next large cybercrime [24], research on the prediction of cyberattacks based on social media data has been studied [20].…”

Towards the Detection of Mobile DDoS Attacks in 5G Multi-Tenant Networks

“…Therefore, traditional detection and mitigation systems, which are not aware of these random changes in topology, will not be able to protect 5G mobile networks. Trace back mechanisms, such as packet marking or link testing [3], are not viable in case of a DDoS attack because of their high computational, network or management overheads. One crucial objective declared by the 5G-PPP Architecture Working Group is to create a cognitive and autonomic network management system that can self-adapt to the changing conditions of the network, which includes changes in the topology of the network [4].…”