Detecting DDoS Attacks Using Conditional Entropy

摘要：

Distributed denial of service (DDoS) attacks is one of the major threats to the current Internet After analyzing the characteristics of DDoS attacks and the existing approaches to detect DDoS attacks, a novel detection method based on conditional entropy is proposed in this paper. First, a group of statistical features based on conditional entropy is defined, which is named Traffic Feature Conditional Entropy (TFCE), to depict the basic characteristics of DDoS attacks, such as high traffic volume and Multiple-to-one relationships. Then, a trained support vector machine (SVM) classifier is applied to identify the DDoS attacks. We experiment with the MIT Data Set in order to evaluate our approach. The results show that the proposed method not only can distinguish between attack traffic and normal traffic accurately, but also is more robustness to resist disturbance of background traffic compared with its counterparts.

关键词： distributed denial of service conditional entropy support vector machine

作者: Yun Liu Jianping Yin Jieren Cheng Boyun Zhang

作者单位: School of Computer, National University of Defense Technology Changsha, China

会议类型: 国际会议

会议名称: The 2010 International Conference on Computer Application and System Modeling(2010计算机应用与系统建模国际会议 ICCASM 2010)

会议地点: 太原

会议语种:英文

页码: 278-282

在线出版日期: 2010-10-22（万方平台首次上网日期，不代表论文的发表时间）