Detecting App-DDoS Attacks Based on Marking Access and d-SVDD

Abstract:

In order to enhance the extensibility of current attack feature extracted and detection means for App-DDoS(Application Layer Distributed Denial of Service, App-DDoS) attacks, a novel feature extracted method based on marking access and a new detection algorithm named d-SVDD are proposed. After expressing kinds of App-DDoS attacks as characteristic vectors by access marked strategy and feature extracted strategy, d-SVDD algorithm is used for secondary classification and detection of pre-set area around decision boundary based on SVDD. It is proved by experiments that the proposed feature extracted and detection means can realize effective detection for kinds of App-DDoS attacks, both have satisfying time, space and extensibility performance.

• Periodical: Applied Mechanics and Materials (Volumes 347-350)
• Pages: 3734-3739
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.347-350.3734
• Online since: August 2013
• Authors: Jin Ling Li, Bin Qiang Wang
• Keywords: Anomaly Detection, App-DDoS Attack, D-SVDD, Marking Access

References

[1] V Durcekova, L Schwartz, N Shahmehri. Sophisticated Denial of Service Attacks Aimed at Application Layer[C]. ELEKTRO, Rajeck Teplice, 2012: 55-60.

DOI: 10.1109/elektro.2012.6225571

[2] Anuja. R. Zade, Suhas. H. Patil. A Survey on Various Defense Mechanisms Against Application Layer Distributed Denial Of Service Attack [J]. International Journal on Computer Science and Engineering, 2011, 11(3): 3558-3563.

[3] DUAN Jian-li, LIU Shu-xia. Research on Web Log Mining Analysis[C]. International Symposium on Instrumentation & Measurement, Sensor Network and Automation, 2012: 515-519.

DOI: 10.1109/msna.2012.6324636

[4] Yatahai T, Isohara T, Sasase I. Detection of HTTP-GET Flood Attack Based on Analysis of Page Access Behavior[C]. Proceedings of the IEEE Pacific Rim Conference on Communications，Computers and Signal Processing, 2007: 232-235.

DOI: 10.1109/pacrim.2007.4313218

[5] XIE Yi, YU Shun-zheng. Monitoring the Application-Layer DDoS Attacks for Popular Websites[C]. IEEE/ACM Transaction on Networking, 2009, 1(17): 15-25.

DOI: 10.1109/tnet.2008.925628

[6] XIE Yi, YU Shun-zheng. A Large-Scale Hidden Semi-Markov Model for Anomaly Detection on User Browsing Behaviors[C]. IEEE/ACM Transaction on Networking, 2009, 1(17): 54-65.

DOI: 10.1109/tnet.2008.923716

[7] Ranjan S, Swaninathan R, Uysal M, Knightly E. DDoS-Shield: DDoS-resilient scheduling to counter application layer attacks[C]. IEEE/ACM Transaction on Networking, 2009, 1(17): 26-39.

DOI: 10.1109/tnet.2008.926503

[8] Agrawal, P. K, Gupta, B. B, Jain, S. SVM Based Scheme for Predicting Number of Zombies in a DDoS Attack[C]. European Intelligence and Security Informatics Conference, Athens, 2011: 178-182.

DOI: 10.1109/eisic.2011.19

[9] ZHU Xiao-kai, YANG De-gui. Multi-Class Support Vector Domain Description for Pattern Recognition Based on a Measure of Expansibility[J]. Chinese Journal of Electronics. 2009, 3(37): 464-469.

[10] Tapas kanungo, David M. Mount, Nathan S. Netanyahu. An Efficient k-Means Clustering Algorithm: Analysis and Implementation[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2002, 7(24): 881-892.

DOI: 10.1109/tpami.2002.1017616

[11] ZHI Jian. Research on DDoS Attack Based on The Application Layer. [Master dissertation], Dalian Maritime University, (2011).

[12] OU Shuai. Research and Design of Defense System Against DNS Distributed Denial of Service Attack. [Master dissertation], Southwest Jiaotong University, (2009).