Title: Estimating strength of DDoS attack using various regression models

Authors: B.B. Gupta, R.C. Joshi, Manoj Misra

Addresses: Department of Electronics and Computer Engineering, Indian Institute of Technology Roorkee, Roorkee 247667, India. ' Department of Electronics and Computer Engineering, Indian Institute of Technology Roorkee, Roorkee 247667, India. ' Department of Electronics and Computer Engineering, Indian Institute of Technology Roorkee, Roorkee 247667, India

Abstract: Anomaly-based DDoS detection systems construct profile of the traffic normally seen in the network, and identify anomalies whenever traffic deviate from normal profile beyond a threshold. This extend of deviation is normally not utilised. This paper reports the evaluation results of proposed approach that utilises this extend of deviation from detection threshold to estimate strength of DDoS attack using various regression models. A relationship is established between number of zombies and observed deviation in sample entropy. Various statistical performance measures, such as coefficient of determination (R²), coefficient of correlation (CC), sum of square error (SSE), mean square error (MSE), root mean square error (RMSE), normalised mean square error (NMSE), Nash-Sutcliffe efficiency index (η) and mean absolute error (MAE) are used to measure the performance of various regression models. Internet type topologies used for simulation are generated using transit-stub model of GT-ITM topology generator. NS-2 network simulator on Linux platform is used as simulation test bed for launching DDoS attacks with varied attack strength. A comparative study is performed using different regression models for estimating strength of DDoS attack. The simulation results are promising as we are able to estimate strength of DDoS attack efficiently with very less error rate using various regression models.

Keywords: DDoS attacks; intrusion detection; regression modelling; entropy; distributed DoS; denial-of-service; performance measures; simulation; attack strength.

DOI: 10.1504/IJMIS.2010.039238

International Journal of Multimedia Intelligence and Security, 2010 Vol.1 No.4, pp.378 - 391

Published online: 28 Mar 2011 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article