Machine Recognition of DDoS Attacks Using Statistical Parameters

Juraj Smiesko, Pavel Segec and Martin Kontsek ()
Additional contact information
Juraj Smiesko: Department of InfoComm Networks, Faculty of Management Science and Informatics, University of Zilina, 010 26 Zilina, Slovakia
Pavel Segec: Department of InfoComm Networks, Faculty of Management Science and Informatics, University of Zilina, 010 26 Zilina, Slovakia
Martin Kontsek: Department of InfoComm Networks, Faculty of Management Science and Informatics, University of Zilina, 010 26 Zilina, Slovakia

Mathematics, 2023, vol. 12, issue 1, 1-30

Abstract: As part of the research in the recently ended project SANET II, we were trying to create a new machine-learning system without a teacher. This system was designed to recognize DDoS attacks in real time, based on adaptation to real-time arbitrary traffic and with the ability to be embedded into the hardware implementation of network probes. The reason for considering this goal was our hands-on experience with the high-speed SANET network, which interconnects Slovak universities and high schools and also provides a connection to the Internet. Similar to any other public-facing infrastructure, it is often the target of DDoS attacks. In this article, we are extending our previous research, mainly by dealing with the use of various statistical parameters for DDoS attack detection. We tested the coefficients of Variation, Kurtosis, Skewness, Autoregression, Correlation, Hurst exponent, and Kullback–Leibler Divergence estimates on traffic captures of different types of DDoS attacks. For early machine recognition of the attack, we have proposed several detection functions that use the response of the investigated statistical parameters to the start of a DDoS attack. The proposed detection methods are easily implementable for monitoring actual IP traffic.

Keywords: IP traffic description; DDoS attack detection; coefficient of variation; kurtosis; skewness; autoregression; correlation; hurst exponent; Kullback–Leibler divergence; predicting tunnels; recognition of DDoS attacks (search for similar items in EconPapers)
JEL-codes: C (search for similar items in EconPapers)
Date: 2023
References: View references in EconPapers View complete reference list from CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/2227-7390/12/1/142/pdf (application/pdf)
https://www.mdpi.com/2227-7390/12/1/142/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jmathe:v:12:y:2023:i:1:p:142-:d:1311430

Access Statistics for this article

Mathematics is currently edited by Ms. Emma He

More articles in Mathematics from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().