DDoS detection and traceback with decision tree and grey relational analysis

Yi Chi Wu*, Huei Ru Tseng, Wuu Yang, Rong Hong Jan

*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

11 Scopus citations

Abstract

As modern life becomes increasingly closely bound to the Internet, network security becomes increasingly important. Like it or not, we all live under the shadow of network threats. The threats could cause leakage of privacy and/or economic loss. Among network attacks, the DDoS (distributed denial-of-service) attack is one of the most frequent and serious. In a DDoS attack, an attacker first breaks into many innocent computers (called zombies) by taking advantages of known or unknown bugs and vulnerabilities in the software. Then the attacker sends a large number of packets from these already-captured zombies to a server. These packets either occupy a major portion of the server's network bandwidth or they consume much of the server's time. The server is then prevented from conducting normal business operations. In order to mitigate the DDoS threat, we design a system to detect DDoS attacks based on a decision-tree technique and, after detecting an attack, to trace back to the approximate locations of the attacker with a traffic-flow pattern-matching technique. We conduct our experiment on the DETER system. According to our experiment results, our system could detect the DDoS attack with the false positive ratio about 1.2% - 2.4%, false negative ratio about 2% - 10% with different kind of attack, attack sending rate and find the attack path in traceback with the false negative rate 8% - 12% and false positive rate 12% - 14%.

Original languageEnglish
Title of host publication3rd International Conference on Multimedia and Ubiquitous Engineering, MUE 2009
Pages306-314
Number of pages9
DOIs
StatePublished - 1 Dec 2009
Event3rd International Conference on Multimedia and Ubiquitous Engineering, MUE 2009 - Qingdao, China
Duration: 4 Jun 20096 Jun 2009

Publication series

Name3rd International Conference on Multimedia and Ubiquitous Engineering, MUE 2009

Conference

Conference3rd International Conference on Multimedia and Ubiquitous Engineering, MUE 2009
CountryChina
CityQingdao
Period4/06/096/06/09

Fingerprint Dive into the research topics of 'DDoS detection and traceback with decision tree and grey relational analysis'. Together they form a unique fingerprint.

Cite this