Entropy-based input-output traffic mode detection scheme for DoS/DDoS attacks (ネットワークシステム)

概要

論文の詳細を見る
Nowadays Distributed Denial of Service (DDoS) attacks are threatening the widely used Internet. How to detect DDoS attacks quickly and effectively becomes an important and challenging work. Many detection schemes based on traffic distribution have been proposed, but problems are still remaining. The real Internet traffic is changefully and not easily modeled in a short term. Studying the characteristics of traffic distribution is a popular considering way; however these kinds of schemes need a relatively long observation time to decide statistics property. This will mitigate detection scheme's efficiency. In our paper we have studied the network node's Input-Output traffic and proposed a relatively simple traffic analyses model, named "8 Input-Output Modes Model"(8-IOMM). Based on this new model, we have adopted an entropy-based scheme to detect out DDoS attacks. We've tested the scheme with the typical Internet traffic from Science Information Network and the DDoS attack data from OPNET simulation tool! The results show that our detection scheme works efficiently.
2008-05-08