Skip to main content

Detecting DDoS Attacks Using Dispersible Traffic Matrix and Weighted Moving Average

  • Conference paper
Advances in Information Security and Assurance (ISA 2009)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 5576))

Included in the following conference series:

Abstract

Distributed Denial of Service (DDoS) attacks have become significant threats on Internet according to the development of network infrastructure and recent communication technology. There are various types of DDoS attacks with different characteristics. These differences have made very difficult to detect such attacks. Furthermore, the sophisticated the evolution of DDoS attacks techniques and the enhanced scale of Botnet encourage attackers to launch DDoS attacks. The IP spoofing technique also makes difficult detect and traceback of DDoS attacks. In this paper, we propose a new detection model for spoofed DDoS attacks using dispersible traffic matrix and weighted moving average. This proposed detection model can not only visualize network traffic streams but also describe the dispersibility characteristics of DDoS attacks such as intensity, duration and rate of DDoS traffic. We carry out experiments on both DARPA 2000 dataset and real data in our network testbed environments so as to validate the feasibility of our approach. Our approach demonstrates that it effectively detects the DDoS attacks in the early stage and in very short time, even though DDoS attacks’ streams are low. Also, the proposed detection model shows a good performance in terms of detection accuracy, speed, and false alarms.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Subscribe and save

Springer+ Basic
$34.99 /Month
  • Get 10 units per month
  • Download Article/Chapter or eBook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 84.99
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 109.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Similar content being viewed by others

References

  1. Bezeq, R., Kim, H., Rozovskii, B., Tartakovsky, A.: A Novel Approach to Detection of Denial of-Service Attacks via Adaptive Sequential and Batch equential Change-Point Methods. In: IEEE Systems Man and Cybernetics Information Assurance Workshop, pp. 1–7 (2001)

    Google Scholar 

  2. Ferguson, P., Senie, D.: Network Ingress Filtering: Defeating Denial of Service Attacks which Employ IP Source Address Spoofing, RFC 2827 (2000)

    Google Scholar 

  3. Gil, T., Poletto, M.: MULTOPS: A Data Structure for Bandwidth Attack Detection. In: USENIX Security Symposium, Washington D.C (2001)

    Google Scholar 

  4. Lee, K., Kim, J., Kwon, K., Han, Y., Kim, S.: DDoS attack detection method using cluster analysis. In: Expert Systems with Applications, vol. 34, pp. 1659–1665. Elsevier, Amsterdam (2008)

    Google Scholar 

  5. Li, J., Mirkovic, J., Wang, M., Reiher, P., Zhang, L.: SAVE: Source Address Validity Enforcement Protocol. In: INFOCOM 2002, vol. 3, pp. 1557–1566 (2002)

    Google Scholar 

  6. Mirkovic, J., Reiher, P.: A Taxonomy of DDoS Attack and DDoS Defense Mechanisms. In: SIGCOMM, vol. 34, pp. 39–53. ACM Press, New York (2004)

    Google Scholar 

  7. Mirkovic, J., Prier, G., Reiher, P.: Attacking DDoS at the Source. In: IEEE International Conference on Network Protocols, pp. 312–321 (2002)

    Google Scholar 

  8. Papadopoulos, C., Lindell, R., Mehringer, J., Hussain, A., Govindan, R.: COSSACK: Coordinated Suppression of Simultaneous Attacks. In: DARPA Information Survivability Conference and Exposition Washington DC, vol. 1, pp. 2–13 (2003)

    Google Scholar 

  9. Park, H., Lee, H., Kim, H.: Detecting Unknown Worms Using Randomness Check. IEICE Transactions on Communication E90(B4), 894–903 (2007)

    Article  Google Scholar 

  10. Park, K., Lee, H.: On the Effectiveness of Route-Based Packet Filtering for Distributed DoS Attack Prevention in Power-Law Internets. In: ACM SIGCOMM (2001)

    Google Scholar 

  11. Zhang, G., Parashar, M.: Cooperative Defense Against DDoS Attacks. Journal of Research and Practice in Information Technology 38(1), 69–84 (2006)

    Google Scholar 

  12. MIT Lincoln Lab., DARPA intrusion detection scenario specific datasets, http://www.ll.mit.edu/IST/ideval/data/2000/2000_data_index.html (2000)

Download references

Author information

Authors and Affiliations

Authors

Editor information

Editors and Affiliations

Rights and permissions

Reprints and permissions

Copyright information

© 2009 Springer-Verlag Berlin Heidelberg

About this paper

Cite this paper

Kim, T.H., Kim, D.S., Lee, S.M., Park, J.S. (2009). Detecting DDoS Attacks Using Dispersible Traffic Matrix and Weighted Moving Average. In: Park, J.H., Chen, HH., Atiquzzaman, M., Lee, C., Kim, Th., Yeo, SS. (eds) Advances in Information Security and Assurance. ISA 2009. Lecture Notes in Computer Science, vol 5576. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-02617-1_30

Download citation

  • DOI: https://doi.org/10.1007/978-3-642-02617-1_30

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-642-02616-4

  • Online ISBN: 978-3-642-02617-1

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics