Skip to main content
SpringerLink
Log in
Book cover

International Conference on Knowledge Science, Engineering and Management

KSEM 2017: Knowledge Science, Engineering and Management pp 129–136Cite as

A Behavior-Based Method for Distinction of Flooding DDoS and Flash Crowds

  • Conference paper
  • First Online:

  • 1867 Accesses

Part of the book series: Lecture Notes in Computer Science ((LNAI,volume 10412))

Abstract

DDoS and Flash Crowds are always difficult to distinguish. In order to solve this issue, this paper concluded a new feature set to profile the behaviors of legitimate users and Bots, and proposed an idea employed Random Forest to distinguish DDoS and FC on two widely-used datasets. The results show that the proposed idea can achieve distinguishing accuracy more than 95%. With comparison with traditional methods-Entropy, it still has a high accuracy.

This is a preview of subscription content, log in via an institution.

Chapter
USD   29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD   39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD   54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Learn about institutional subscriptions

References

  1. Mansfield-Devine, S.: The growth and evolution of DDoS. Netw. Secur. 2015(10), 13–20 (2015)

    Article  Google Scholar 

  2. Jung, J., Krishnamurthy, B., Rabinovich, M.: Flash crowds and denial of service attacks: characterization and implications for CDNs and web sites. In: Proceedings of the 11th International Conference on World Wide Web, pp. 293–304. ACM (2002)

    Google Scholar 

  3. Xie, Y., Yu, S.-Z.: A large-scale hidden semi-Markov model for anomaly detection on user browsing behaviors. IEEE/ACM Trans. Netw. (TON) 17(1), 54–65 (2009)

    Article  Google Scholar 

  4. Oikonomou, G., Mirkovic, J.: Modeling human behavior for defense against flash-crowd attacks. In: 2009 IEEE International Conference on Communications, pp. 1–6. IEEE (2009)

    Google Scholar 

  5. Thapngam, T., Yu, S., Zhou, W., Beliakov, G.: Discriminating DDoS attack traffic from flash crowd through packet arrival patterns. In: 2011 IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), pp. 952–957. IEEE (2011)

    Google Scholar 

  6. Yu, S., Guo, S., Stojmenovic, I.: Fool me if you can: mimicking attacks and anti-attacks in cyberspace. IEEE Trans. Comput. 64(1), 139–151 (2015)

    Article  MathSciNet  MATH  Google Scholar 

  7. Yu, S., Thapngam, T., Liu, J., Wei, S., Zhou, W.: Discriminating DDoS flows from flash crowds using information distance. In: Proceedings of the third International Conference on Network and System Security, NSS 2009, pp. 351–356. IEEE (2009)

    Google Scholar 

  8. Saravanan, R., Shanmuganathan, S., Palanichamy, Y.: Behavior-based detection of application layer distributed denial of service attacks during flash events. Turkish J. Electr. Eng. Comput. Sci. 24(2), 510–523 (2016)

    Article  Google Scholar 

  9. Mori, G., Malik, J.: Recognizing objects in adversarial clutter: breaking a visual captcha. In: 2003 IEEE Computer Society Conference on Computer Vision and Pattern Recognition, vol. 1, pp. I–134 (2003)

    Google Scholar 

  10. Breiman, L.: Random forests. Mach. Learn. 45(1), 5–32 (2001)

    Article  MATH  Google Scholar 

  11. CAIDA “DDoS Attack 2007” Dataset. http://www.caida.org/data/passive/ddos-20070804_dataset.xml

  12. World Cup 1998 dataset. http://ita.ee.lbl.gov/html/contrib/WorldCup.html

Download references

Author information

Authors and Affiliations

  1. Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China

    Degang Sun, Kun Yang, Zhixin Shi & Bin Lv

Authors
  1. Degang Sun
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Kun Yang
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Zhixin Shi
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Bin Lv
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Zhixin Shi .

Editor information

Editors and Affiliations

  1. Deakin University, Burwood, Victoria, Australia

    Gang Li

  2. University of Arizona, Tucson, Arizona, USA

    Yong Ge

  3. Southwest University, Chongqing, China

    Zili Zhang

  4. Peking University, Beijing, China

    Zhi Jin

  5. University of Technology Sydney, Sydney, New South Wales, Australia

    Michael Blumenstein

Rights and permissions

Reprints and permissions

Copyright information

© 2017 Springer International Publishing AG

About this paper

Cite this paper

Sun, D., Yang, K., Shi, Z., Lv, B. (2017). A Behavior-Based Method for Distinction of Flooding DDoS and Flash Crowds. In: Li, G., Ge, Y., Zhang, Z., Jin, Z., Blumenstein, M. (eds) Knowledge Science, Engineering and Management. KSEM 2017. Lecture Notes in Computer Science(), vol 10412. Springer, Cham. https://doi.org/10.1007/978-3-319-63558-3_11

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-63558-3_11

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-63557-6

  • Online ISBN: 978-3-319-63558-3

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation