Improved Mca Based Dos Attack Detection

Lakshmi Prasanna Kumar Relangi, M Krishna Satya Varma

Abstract


A denial of service (DoS) attack is a malicious attempt to make a server or a network resource unavailable to users, usually by temporarily interrupting or suspending the services of a host connected to the Internet Interconnected systems, such as Web servers, database servers, cloud computing servers etc, are now under threads from network attackers. As one of most common and aggressive means, Denial-of-Service (DoS) attacks cause serious impact on these computing systems. In this paper, we present a DoS attack detection system that uses Multivariate Correlation Analysis (MCA) for accurate network traffic characterization by extracting the geometrical correlations between network traffic features. Our MCA-based DoS attack detection system employs the principle of anomaly-based detection in attack recognition. This makes our solution capable of detecting known and unknown DoS attacks effectively by learning the patterns of legitimate network traffic only. Furthermore, a triangle-area-based technique is proposed to enhance and to speed up the process of MCA. The effectiveness of our proposed detection system is evaluated using KDD Cup 99 dataset, and the influences of both non-normalized data and normalized data on the performance of the proposed detection system are examined. The results show that our system outperforms two other previously developed state-of-the-art approaches in terms of detection accuracy.


Keywords


Denial-of-Service attack, network traffic characterization, multivariate correlations, triangle area

References


V. Paxson, “Bro: A System for Detecting Network Intruders in Realtime,â€

Computer Networks, vol. 31, pp. 2435-2463, 1999

P. Garca-Teodoro, J. Daz-Verdejo, G. Maci-Fernndez, and E. Vzquez, “Anomaly-based Network Intrusion Detection: Techniques, Systems and Challenges,†Computers & Security, vol. 28, pp. 18-28, 2009.

D. E. Denning, “An Intrusion-detection Model,†IEEE Transactions on Software Engineering, pp. 222-232, 1987.

K. Lee, J. Kim, K. H. Kwon, Y. Han, and S. Kim, “DDoS attack detection method using cluster analysis,†Expert Systems with Applications, vol. 34, no. 3, pp. 1659-1665, 2008.

A. Tajbakhsh, M. Rahmati, and A. Mirzaei, “Intrusion detection using fuzzy association rules,†Applied Soft Computing, vol. 9, no. 2, pp. 462-469, 2009.

J. Yu, H. Lee, M.-S. Kim, and D. Park, “Traffic flooding attack detection with SNMP MIB using SVM,†Computer Communications, vol. 31, no. 17, pp. 4212-4219, 2008.

W. Hu, W. Hu, and S. Maybank, “AdaBoost-Based Algorithm for Network Intrusion Detection,†Trans. Sys. Man Cyber. Part B, vol. 38, no. 2, pp. 577-583, 2008.

C. Yu, H. Kai, and K. Wei-Shinn, “Collaborative Detection of DDoS Attacks over Multiple Network Domains,†Parallel and Distributed Systems, IEEE Transactions on, vol. 18, pp. 1649-1662, 2007.

G. Thatte, U. Mitra, and J. Heidemann, “Parametric Methods for Anomaly Detection in Aggregate Traffic,†Networking, IEEE/ACM Transactions on, vol. 19, no. 2, pp. 512-525, 2011.

S. T. Sarasamma, Q. A. Zhu, and J. Huff, “Hierarchical Kohonenen Net for Anomaly Detection in Network Security,†Systems, Man, and Cybernetics, Part B: Cybernetics, IEEE Transactions on, vol. 35, pp. 302-312, 2005.

S. Yu, W. Zhou, W. Jia, S. Guo, Y. Xiang, and F. Tang, “Discriminating

DDoS Attacks from Flash Crowds Using Flow Correlation Coefficient,†Parallel and Distributed Systems, IEEE Transactionson, vol. 23, pp. 1073-1080, 2012.

S. Jin, D. S. Yeung, and X. Wang, “Network Intrusion Detection in Covariance Feature Space,†Pattern Recognition, vol. 40, pp. 2185- 2197, 2007.

C. F. Tsai and C. Y. Lin, “A Triangle Area Based Nearest Neighbors Approach to Intrusion Detection,†Pattern Recognition, vol. 43, pp. 222-229, 2010.

A. Jamdagni, Z. Tan, X. He, P. Nanda, and R. P. Liu, “RePIDS: A multi tier Real-time Payload-based Intrusion Detection System,†Computer Networks, vol. 57, pp. 811-824, 2013.

Z. Tan, A. Jamdagni, X. He, P. Nanda, and R. P. Liu, “Denialof Service Attack Detection Based on Multivariate Correlation Analysis,†Neural Information Processing, 2011, pp. 756-765.

Z. Tan, A. Jamdagni, X. He, P. Nanda, and R. P. Liu, “Triangle- Area-Based Multivariate Correlation Analysis for Effective Denialof- Service Attack Detection,†The 2012 IEEE 11th International Conference on Trust, Security and Privacy in Computing and Communications, Liverpool, United Kingdom, 2012, pp. 33-40.

S. J. Stolfo, W. Fan, W. Lee, A. Prodromidis, and P. K. Chan, “Costbased modeling for fraud and intrusion detection: results from the JAM project,†The DARPA Information Survivability Conference and Exposition 2000 (DISCEX ’00), Vol.2, pp. 130-144, 2000.

G. V. Moustakides, “Quickest detection of abrupt changes for a class of random processes,†Information Theory, IEEE Transactions on, vol. 44, pp. 1965-1968, 1998.

A. A. Cardenas, J. S. Baras, and V. Ramezani, “Distributed change detection for worms, DDoS and other network attacks,†The American Control Conference, Vol.2, pp. 1008-1013, 2004.

W. Wang, X. Zhang, S. Gombault, and S. J. Knapskog, “Attribute Normalization in Network Intrusion Detection,†The 10th International Symposium on Pervasive Systems, Algorithms, and Networks (ISPAN), 2009, pp. 448-453.


Full Text: PDF [Full Text]

Refbacks

  • There are currently no refbacks.


Copyright © 2013, All rights reserved.| ijseat.com

Creative Commons License
International Journal of Science Engineering and Advance Technology is licensed under a Creative Commons Attribution 3.0 Unported License.Based on a work at IJSEat , Permissions beyond the scope of this license may be available at http://creativecommons.org/licenses/by/3.0/deed.en_GB.

Â