Computational Intelligent Techniques for Detecting Denial of Service Attacks

Abstract

Recent cyber attacks on the Internet; have proven that none of the open network systems are immune to availability attacks. Recent trend of the adversaries “if I can’t have it, nobody can” has changed the emphasis on the information resource availability in regards to information assurance. Cyber attacks that are launched to deny the information resources, data and services to the legitimate user are termed as denial of service attacks (DoS) or availability attacks. The distributed nature of the Internet helps the adversary to accomplish a multiplicative effect of the attack; such attacks are called distributed denial of service attacks. Detecting and responding to denial of service attacks in real time has become an elusive goal owing to the limited information available from the network connections. This paper presents a comparative study of using support vector machines (SVMs), multivariate adaptive regression splines (MARS) and linear genetic programs (LGPs) for detecting denial of service attacks. We investigate and compare the performance of detecting DoS based on the mentioned techniques, with respect to a well-known sub set of intrusion evaluation data gathered by Lincoln Labs. The key idea is to train the above mentioned techniques using already discovered patterns (signatures) that represent DoS attacks. We demonstrate that highly efficient and accurate signature based classifiers can be constructed by using computational intelligent techniques to detect DoS attacks. Future we describe our ongoing effort of using computational intelligent agents to respond to DoS attacks at the boundary controllers of the network.