Low-Rate and High-Rate Distributed DoS Attack Detection Using Partial Rank Correlation

• Published in: 2015 Fifth International Conference on Communication Systems and Network Technologies pp. 706 - 710
• Main Authors: Bhuyan, M. H., Kalwar, A., Goswami, A., Bhattacharyya, D. K., Kalita, J. K.
• Format: Conference Proceeding
• Language: English
• Published: IEEE 01-04-2015
• Subjects: Accuracy; attack; Bandwidth; Computer crime; Correlation; DDoS; Entropy; high-rate; Internet; low-rate; network traffic; rank correlation; Servers
• DOI: 10.1109/CSNT.2015.24

Distributed Denial of Service (DDoS) attacks pose a serious threat to efficient and uninterrupted Internet services. During Distributed Denial of Service (DDoS), attackers make fool of innocent servers (i.e., Slave) into reddening packets to the victim. Most low-rate DDoS attack detection mechanisms are associated with specific protocols used by the attacks. Due to the use of slave, it has been found that the traffic flow for such an attack and their response flow to the victim may have linear relationships with another. Based on this observation, we propose the Partial Rank Correlation-based Detection (PRCD) scheme to detect both low-rate and high-rate DDoS attacks. Our experimental results confirm theoretical analysis and demonstrate the effectiveness of the proposed scheme in practice.