DDoS Attacks Detection Using GA Based Optimized Traffic Matrix
Authors:
- Je Hak LeeJLJe Hak Lee
- Dong Seong KimDKDong Seong Kim
- Sang Min LeeSLSang Min Lee
- Jong Sou ParkJPJong Sou Park
- 1 June 2011
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
- Vol. 3042, 216-220
Abstract
Threat of Distributed Denial of Service (DDoS) attacks has been increasing with growth of computer and network infrastructures. DDoS attacks generating mass traffics make network bandwidth and/or system resources depleted. Therefore, it is significant to detect DDoS attacks in early stage. Our previous approach used a traffic matrix to detect DDoS attack. However, it is hard to tune up the parameters of the matrix including (i) size of traffic matrix, (ii) packet based window size, and (iii) threshold value of variance from packets information with respect to various monitoring environments and DDoS attacks. In this paper, we propose an enhanced DDoS attacks detection approach which (i) improves the traffic matrix building operation and (ii) optimizes the parameters of the traffic matrix using Genetic Algorithm (GA). We perform experiments with DARPA 2000 dataset and LBL-PKT-4 dataset of Lawrence Berkeley Laboratory to show its performance in terms of detection accuracy and speed.Keywords
This publication has 5 references indexed in Scilit:
- A taxonomy of DDoS attack and DDoS defense mechanismsACM SIGCOMM Computer Communication Review, 2004
- DDoS attacks and defense mechanisms: classification and state-of-the-artComputer Networks, 2004
- Statistical approaches to DDoS attack detection and response2004
- Proactively Detecting Distributed Denial of Service Attacks Using Source IP Address Monitoring2004
- Nonparametric Methods in Change-Point Problems1993