A Chaotic Complexity Measure for Cognitive Machine Classification of Cyber-Attacks on Computer Networks

Muhammad Salman Khan, Ken Ferens and Witold Kinsner
Additional contact information
Muhammad Salman Khan: Department of Electrical and Computer Engineering, University of Manitoba, Winnipeg, MB, Canada
Ken Ferens: Department of Electrical and Computer Engineering, University of Manitoba, Winnipeg, MB, Canada
Witold Kinsner: Department of Electrical and Computer Engineering, University of Manitoba, Winnipeg, MB, Canada

International Journal of Cognitive Informatics and Natural Intelligence (IJCINI), 2014, vol. 8, issue 3, 45-69

Abstract: Today's evolving cyber security threats demand new, modern, and cognitive computing approaches to network security systems. In the early years of the Internet, a simple packet inspection firewall was adequate to stop the then-contemporary attacks, such as Denial of Service (DoS), ports scans, and phishing. Since then, DoS has evolved to include Distributed Denial of Service (DDoS) attacks, especially against the Domain Name Service (DNS). DNS based DDoS amplification attacks cannot be stopped easily by traditional signature based detection mechanisms because the attack packets contain authentic data, and signature based detection systems look for specific attack-byte patterns. This paper proposes a chaos based complexity measure and a cognitive machine classification algorithm to detect DNS DDoS amplification attacks. In particular, this paper computes the Lyapunov exponent to measure the complexity of a flow of packets, and classifies the traffic as either normal or anomalous, based on the magnitude of the computed exponent. Preliminary results show the proposed chaotic measure achieved a detection (classification) accuracy of about 98%, which is greater than that of an Artificial Neural Network. Also, contrary to available supervised machine learning mechanisms, this technique does not require any offline training. This approach is capable of not only detecting offline threats, but has the potential of being applied over live traffic flows using DNS filters.

Date: 2014
References: Add references at CitEc
Citations:

Downloads: (external link)
http://services.igi-global.com/resolvedoi/resolve. ... 18/IJCINI.2014070104 (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:igg:jcini0:v:8:y:2014:i:3:p:45-69

Access Statistics for this article

International Journal of Cognitive Informatics and Natural Intelligence (IJCINI) is currently edited by Kangshun Li

More articles in International Journal of Cognitive Informatics and Natural Intelligence (IJCINI) from IGI Global
Bibliographic data for series maintained by Journal Editor ().