High specificity Training-Free Association-Rules-Inspired DDoS (Denial-Of-Service) Detection Scheme

Abstract

Distributed denial of service(DDoS) is an attack which is launched by a series of compromised machines trying to overwhelm a target server, website or network devices. Study reviews a huge number of companies in North America are facing the considerable loss since their online services are being attacked by DDoS and the average cost to deal with DDoS attack is estimated to be $50,000 and $100,000 per hour. Hence, efficient DDoS attack detection techniques are needed to defense against the DDoS attacks from huge amount of network traffic flow data. Association rules is a common technique to produce abnormal behaviors detection. However, in conventional association-based intrusion detection mechanism, sophisticated training method is required to obtain appropriate threshold of support and confidence factors. In addition, today's attackers usually change one or two parameters of their attack flow frequently, making these detection systems hard to distinguish them from legitimate users. Although these attacks can be detected through setting a low support and confidence threshold, the false positive rate is too high to accept. In this paper, a high-specificity training free association-rules-inspired DDoS detection scheme is proposed. This scheme is contributing to identify a high specificity and potentially useful pattern from a massive network traffic. In addition, 3 cases study has been developed to show the superiority of the proposed scheme. Some simulations have been practiced and the results shows that 80% of the true positive rate can be achieved with the false positive rate lower than 1%.