The Community for Technology Leaders
RSS Icon
Subscribe
Issue No.04 - October-December (2004 vol.1)
pp: 193-208
ABSTRACT
This paper presents a simple and robust mechanism, called Change-Point Monitoring (CPM), to detect denial of service (DoS) attacks. The core of CPM is based on the inherent network protocol behaviors and is an instance of the Sequential Change Point Detection. To make the detection mechanism insensitive to sites and traffic patterns, a nonparametric Cumulative Sum (CUSUM) method is applied, thus making the detection mechanism robust, more generally applicable, and its deployment much easier. CPM does not require per-flow state information and only introduces a few variables to record the protocol behaviors. The statelessness and low computation overhead of CPM make itself immune to any flooding attacks. As a case study, the efficacy of CPM is evaluated by detecting a SYN flooding attack—the most common DoS attack. The evaluation results show that CPM has short detection latency and high detection accuracy.
INDEX TERMS
CUSUM algorithm, DoS attacks, intrusion detection, protocol behavior.
CITATION
Haining Wang, Kang G. Shin, "Change-Point Monitoring for the Detection of DoS Attacks", IEEE Transactions on Dependable and Secure Computing, vol.1, no. 4, pp. 193-208, October-December 2004, doi:10.1109/TDSC.2004.34
20 ms
(Ver 2.0)

Marketing Automation Platform Marketing Automation Tool