Network and System Security, International Conference on (2009)
Gold Coast, Queensland, Australia
Oct. 19, 2009 to Oct. 21, 2009
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/NSS.2009.35
Both Flash crowds and DDoS (Distributed Denial-of-Service) attacks have very similar properties in terms of internet traffic, however Flash crowds are legitimate flows and DDoS attacks are illegitimate flows, and DDoS attacks have been a serious threat to internet security and stability. In this paper we propose a set of novel methods using probability metrics to distinguish DDoS attacks from Flash crowds effectively, and our simulations show that the proposed methods work well. In particular, these mathods can not only distinguish DDoS attacks from Flash crowds clearly, but also can distinguish the anomaly flow being DDoS attacks flow or being Flash crowd flow from Normal network flow effectively. Furthermore, we show our proposed hybrid probability metrics can greatly reduce both false positive and false negative rates in detection.
DDoS, Flash crowd, Probability metrics
J. Liu, W. Zhou, P. Li, K. Li and J. Hai, "Distinguishing DDoS Attacks from Flash Crowds Using Probability Metrics," Network and System Security, International Conference on(NSS), Gold Coast, Queensland, Australia, 2009, pp. 9-17.