An early detection of low rate DDoS attack to SDN based data center networks using information distance metrics

Towards sFlow and adaptive polling sampling for deep learning based DDoS detection in SDN

Attacks over the Internet are becoming more and more complex and sophisticated. How to detect security threats and measure the security of the Internet arises a significant research topic. For detecting the Internet attacks and measuring its security, collecting different categories of data and employing methods of data analytics are essential. However, the literature still lacks a thorough review on security-related data collection and analytics on the Internet. Therefore, it becomes a necessity to review the current state of the art in order to gain a deep insight on what categories of data should be collected and which methods should be used to detect the Internet attacks and to measure its security. In this paper, we survey existing studies about security-related data collection and analytics for the purpose of measuring the Internet security. We first divide the data related to network security measurement into four categories: 1) packet-level data; 2) flow-level data; 3) connection-level data; and 4) host-level data. For each category of data, we provide a specific classification and discuss its advantages and disadvantages with regard to the Internet security threat detection. We also propose several additional requirements for security-related data analytics in order to make the analytics flexible and scalable. Based on the usage of data categories and the types of data analytic methods, we review current detection methods for distributed denial of service flooding and worm attacks by applying the proposed requirements to evaluate their performance. Finally, based on the completed review, a list of open issues is outlined and future research directions are identified.

/pdf/security-data-collection-and-data-analytics-in-the-internet-42jezn60fe.pdf

Security Data Collection and Data Analytics in the Internet: A Survey

Efficient DDoS flood attack detection using dynamic thresholding on flow-based network traffic

Machine-learning based network intrusion detection systems (ML-NIDS) are increasingly popular in the fight against network attacks. In particular, promising detection results have been demonstrated in conjunction with Software-Defined Networks (SDN), in which the logically centralized control plane provides access to data from across the network. However, research into adversarial attacks against machine learning classifiers has highlighted vulnerabilities in a number of fields. These vulnerabilities raise concerns about the implementation of similar classifiers in anomaly-based NIDSs within SDNs. In this work, we investigate the viability of adversarial attacks against classifiers in this field. We implement an anomaly-based NIDS, Neptune, as a target platform that utilises a number of different machine learning classifiers and traffic flow features. We develop an adversarial test tool, Hydra, to evaluate the impact of adversarial evasion classifier attacks against Neptune with the goal of lowering the detection rate of malicious network traffic. The results demonstrate that with the perturbation of a few features, the detection accuracy of a specific SYN flood Distributed Denial of Service (DDoS) attack by Neptune decreases from 100% to 0% across a number of classifiers. Based on these results, recommendations are made as to how to increase the robustness of classifiers against the demonstrated attacks.

/pdf/investigating-adversarial-attacks-against-network-intrusion-3sk9eutwxp.pdf

Investigating Adversarial Attacks against Network Intrusion Detection Systems in SDNs

Low-rate Distributed Denial-of-Service (low-rate DDoS) attacks are a new challenge to cyberspace, as the attackers send a large amount of attack packets similar to normal traffic, to throttle legitimate flows. In this paper, we propose a measurement—expectation of packet size—that is based on the distribution difference of the packet size to distinguish two typical low-rate DDoS attacks, the constant attack and the pulsing attack, from legitimate traffic. The experimental results, obtained using a series of real datasets with different times and different tolerance factors, are presented to demonstrate the effectiveness of the proposed measurement. In addition, extensive experiments are performed to show that the proposed measurement can detect the low-rate DDoS attacks not only in the short and long terms but also for low packet rates and high packet rates. Furthermore, the false-negative rates and the adjudication distance can be adjusted based on the detection sensitivity requirements.

https://downloads.hindawi.com/journals/scn/2017/3691629.pdf

Low-Rate DDoS Attack Detection Using Expectation of Packet Size

Distributed Denial-of-Service (DDoS) attacks are a great threat to the Internet. Enabling accurately detection of Distribute Denial-of-Service attacks is important because it is the foundation of defense against the attacks. In this paper, we focus on the distribution difference of the packet size between normal traffic flows and attack traffic flows and propose an entropy-based detection measurement. The measurement can highlights the characteristics of attack traffic. The experimental results show that the proposed measurement can effectively and clearly distinguish attack flows from normal flows in both low and high packet rate.

Mingchao Liao

Papers

Low-Rate DDoS Attack Detection Using Expectation of Packet Size

DDoS attack detection using packet size interval

Detection of polarization state of a polarized light using azimuthally symmetric dye-doped liquid crystals