A model to partly but reliably distinguish DDOS flood traffic from aggregated one
type: Item
instance of: scholarly article
title: A model to partly but reliably distinguish DDOS flood traffic from aggregated one
zbMATH Open document ID: 1264.93105
DOI: 10.1155/2012/860569
author: Ming Li
author: Wei Zhao
published in: Mathematical Problems in Engineering
publication date: 2013-06-11T00:00:00Z
review text: Summary: Reliable distinguishing DDOS flood traffic from aggregated traffic is desperately desired by reliable prevention of DDOS attacks. By reliable distinguishing, we mean that flood traffic can be distinguished from aggregated one for a predetermined probability. The basis to reliably distinguish flood traffic from aggregated one is reliable detection of signs of DDOS flood attacks. As is known, reliably distinguishing DDOS flood traffic from aggregated traffic becomes a tough task mainly due to the effects of flash-crowd traffic. For this reason, this paper studies reliable detection in the underlying DiffServ network to use static-priority schedulers. In this network environment, we present a method for reliable detection of signs of DDOS flood attacks for a given class with a given priority. There are two assumptions introduced in this study. One is that flash-crowd traffic does not have all priorities but some. The other is that attack traffic has all priorities in all classes, otherwise an attacker cannot completely achieve its DDOS goal. Further, we suppose that the protected site is equipped with a sensor that has a signature library of the legitimate traffic with the priorities flash-crowd traffic does not have. Based on those, we are able to reliably distinguish attack traffic from aggregated traffic with the priorities that flash-crowd traffic does not have according to a given detection probability.
Mathematics Subject Classification ID: 93C40
Mathematics Subject Classification ID: 94C12
Mathematics Subject Classification ID: 93C55
zbMATH DE Number: 6173646
Wikidata QID: Q58912275
describes a project that uses: longmemo
MaRDI profile type: Publication
full work available at URL: https://doi.org/10.1155/2012/860569
OpenAlex ID: W1968230679
cites work: Q4448437
cites work: Q4865042
cites work: Random-order fractional differential equation models
cites work: A reflected fBm limit for fluid models with ON/OFF sources under heavy traffic
cites work: Fractals and hidden symmetries in DNA
cites work: Dynamical aspects of macroscopic and quantum transitions due to coherence function and time series events
cites work: On deterministic traffic regulation and service guarantees: a systematic approach by filtering
cites work: A calculus for network delay. II. Network analysis
cites work: Q3559758
cites work: Q4938041
cites work: Synthesis of multifractional Gaussian noises based on variable-order fractional operators
cites work: An improved ARED algorithm for congestion control of network transmission
cites work: A tutorial on nonlinear time-series data mining in engineering asset health and reliability prediction: concepts, models, and algorithms
cites work: A novel approach to equipment health management based on auto-regressive hidden semi-Markov model (AR-HSMM)
cites work: Enclosed Laplacian Operator of Nonlinear Anisotropic Diffusion to preserve singularities and delete isolated points in image smoothing
cites work: A numerical method for preserving curve edges in nonlinear anisotropic smoothing
cites work: A new adaptive local linear prediction method and its application in hydrological time series
cites work: Self-tuning random early detection algorithm to improve performance of network transmission
cites work: Variance-Constrained ${\cal H}_{\infty}$ Filtering for a Class of Nonlinear Time-Varying Systems With Multiple Missing Measurements: The Finite-Horizon Case
description: scientific article; zbMATH DE number 6173646