A generalized detection system to detect distributed denial of service attacks and flash events for information theory metrics

Abstract

Distributed denial of service (DDoS) attacks pose a severe threat to extensively used web-based services andapplications. Many detection approaches have been proposed in the literature, but ensuring the security and availabilityof data, resources, and services to end users remains an ongoing research challenge. Nowadays, the traffic volume oflegitimate users has also increased manifold. A flash event (FE) is a high-rate legitimate traffic situation wherein millionsof legitimate users start accessing a particular network resource, such as a web server, simultaneously. The detection ofDDoS attacks becomes more challenging when DDoS attacks are launched during behaviorally similar FEs. This researchpaper proposes a generalized detection system for metrics, based on information theory, capable of detecting differenttypes of DDoS attacks and FEs. We used publically available MIT Lincoln, CAIDA, and FIFA datasets along witha synthetically generated DDoSTB dataset to validate the proposed detection algorithm in terms of various detectionsystem evaluation metrics such as false positive rate, false negative rate, classification rate, and detection accuracy. Sucha generalized detection system would be useful to researchers for validating and comparing various information theorymetrics based solutions.