Identifying Application-Layer DDoS Attacks Based on Request Rhythm Matrices

Lin, Huan; Cao, Shoufeng; Wu, Jiayan; Cao, Zhenzhong; Wang, Fengyu

doi:10.1109/access.2019.2950820

Cited by 11 publications

(4 citation statements)

References 43 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Dynamically selected algorithms from the framework classification algorithms are ready to detect different DDoS ways that use fussy logic [11]. Utility Layered Distribution Service Denial (UL-DDoS) Attacks and Al-DDoS attack's magic can make many intrusion prevention methods ineffective and pose a significant threat to websites [12].…”

Section: Related Workmentioning

confidence: 99%

Iterative Dichotomiser Posteriori Method Based Service Attack Detection in Cloud Computing

Dhiyanesh¹,

Karthick²,

Radha³

et al. 2023

Computer Systems Science and Engineering

View full text Add to dashboard Cite

Cloud computing (CC) is an advanced technology that provides access to predictive resources and data sharing. The cloud environment represents the right type regarding cloud usage model ownership, size, and rights to access. It introduces the scope and nature of cloud computing. In recent times, all processes are fed into the system for which consumer data and cache size are required. One of the most security issues in the cloud environment is Distributed Denial of Service (DDoS) attacks, responsible for cloud server overloading. This proposed system ID3 (Iterative Dichotomiser 3) Maximum Multifactor Dimensionality Posteriori Method (ID3-MMDP) is used to overcome the drawback and a relatively simple way to execute and for the detection of (DDoS) attack. First, the proposed ID3-MMDP method calls for the resources of the cloud platform and then implements the attack detection technology based on information entropy to detect DDoS attacks. Since because the entropy value can show the discrete or aggregated characteristics of the current data set, it can be used for the detection of abnormal data flow, User-uploaded data, ID3-MMDP system checks and read risk measurement and processing, bug rating file size changes, or file name changes and changes in the format design of the data size entropy value. Unique properties can be used whenever the program approaches any data error to detect abnormal data services. Finally, the experiment also verifies the DDoS attack detection capability algorithm.Keywords: ID3 (Iterative dichotomiser 3) maximum multifactor dimensionality posterior method (ID3-MMDP); distributed denial of service (DDoS) attacks; detection of abnormal data flow; SK measurement and processing; bug rating file size

show abstract

Section: Related Workmentioning

confidence: 99%

Iterative Dichotomiser Posteriori Method Based Service Attack Detection in Cloud Computing

Dhiyanesh¹,

Karthick²,

Radha³

et al. 2023

Computer Systems Science and Engineering

View full text Add to dashboard Cite

show abstract

“…A Denial of Service (DDoS) attack is a malicious distributed attack on an online network that becomes disabled for users, and this DDoS attack will burden and paralyze server services [27][28][29][30]. The distribution of DDoS in a global attack will infiltrate various devices, which are often referred to as botnets.…”

Section: Distributed Denial Of Service (Ddos)mentioning

confidence: 99%

Network Forensics Against Volumetric-Based Distributed Denial of Service Attacks on Cloud and the Edge Computing

Yudhana¹,

Riadi²,

Suharti³

2022

IJSSE

View full text Add to dashboard Cite

Cyber attacks are increasingly rampant and even damage the reputation of companies, agencies, and services. DDoS attacks have been overgrowing in the last year, which has resulted in substantial losses. Volumetric-based Distributed Denial of Service (DDoS) is a hazardous attack type because it can consume server resources, causing the server to be unable to serve customer requests. The network design consisting of hardware and software becomes the essential capital that is a determinant of the quality of a network in the long term. A firewall is one way to stop the occurrence of DDoS. Forensics and mitigation in this study apply Packet Filtering Firewall and Circuit Level Gateway Firewall against ICMP-Flood DDoS attacks. The research methodology is a simulated experiment on cloud and edge computing networks. Forensics and mitigation in cloud computing are carried out at layer 3, the Internet Protocol layer TCP/IP model, by applying a Packet-Filtering Firewall with a success rate of 64%-69% traffic reduction. In contrast, the success of reducing server resource usage is 73.75%. At the same time, Edge computing is carried out at layer 4, namely the Transport Protocol layer TCP/IP model, by applying a Circuit-Level Gateway Firewall with a success rate of reducing traffic by 55%-98.88%. In comparison, the success of lowering server resource usage is 96% and restoring traffic and paralyzed servers to normal position.

show abstract

“…A statistical model called the RM (rhythm matrix) was proposed in [18] to detect application layer DDoS attack. The RM model can detect DDoS attacks according to the increase of the abnormality degree in the RM and distinguish flash crowds from application layer DDoS attacks.…”

Section: Related Workmentioning

confidence: 99%

Detection of Application Layer DDoS Attack Based on SIS Epidemic Model

2021

View full text Add to dashboard Cite

Distrusted Denial of Service attack (DDoS) is one of the major threats to network security. The HTTP flooding attack is the hardest type of DDoS attacks to detect since the malicious packets are hidden in a huge amount of normal traffic. In this work, we introduce a new detection scheme for HTTP flooding attack by using Susceptible-Infective-Susceptible (SIS) model of an infectious disease which used in dynamic systems. During any time interval, the server can measure various values of attributes for its users like number of total connections, number of open connections and number of closed connections. These values can be used to detect any abnormal behavior or infected connections in a server by mapping this attributes with SIS model. Thus we can get suspected and infected connections during every time interval. Extensive trace driven simulation has been conducted to demonstrate the efficiency of the proposed scheme in terms of its detection rate and probability of false positive. INDEX TERMS Intrusion detection, DDoS attack, HTTP protocol, SIS epidemic model.

show abstract

Identifying Application-Layer DDoS Attacks Based on Request Rhythm Matrices

Cited by 11 publications

References 43 publications

Iterative Dichotomiser Posteriori Method Based Service Attack Detection in Cloud Computing

Iterative Dichotomiser Posteriori Method Based Service Attack Detection in Cloud Computing

Network Forensics Against Volumetric-Based Distributed Denial of Service Attacks on Cloud and the Edge Computing

Detection of Application Layer DDoS Attack Based on SIS Epidemic Model

Contact Info

Product

Resources

About