Distributed Denial of Service (DDoS) is a common type of Cybercrime. It can strongly damage a company reputation and increase its costs. Attackers improve continuously their strategies. They doubled the amount of unleashed communication requests in volume, size, and frequency in the last few years. This occurs against different hosts, causing resource exhaustion. Previous studies focused on detecting or mitigating ongoing DDoS attacks. Yet, addressing DDoS attacks when they are already in place may be too late. In this article, we consider network resilience by early prediction of attack trends. We show empirically the advantage of using non-parametric leading indicators for early prediction of volumetric DDoS attacks. We report promising results over a real dataset from CAIDA. Our results raise new questions and opportunities for further research in early predicting trends of DDoS attacks.
Different studies have particularly tackled the problem of developing early warning techniques for DDoS attacks @cite_8 @cite_7 @cite_4 . @cite_7 , Xiao, Chen and He proposed a cooperative system to produce warning signals. The system is based on a Bloom filter technique. The authors' goal is to reduce storage and computational resources consumption. @cite_8 , Tsai, Chang and Huang presented a multilayer system based on time delay neural networks. Their system is cooperative with each device in the network monitoring its neighbors. At a certain point, the device sends the collected data to an expert module. The module then analyzes all collected data and attempts to match the received data with known DDoS patterns. @cite_4 , Korczy 'nski, Hamieh, Huh, Holm, Rajagopalan and Fefferman presented a cooperative and self-organized anomaly detection system inspired by colonies of honey bees. Their goal was to provide dynamic thresholds to detect anomalous patterns in network traffic. Also, they intended to improve early intrusion detection in order to assist in mitigation of attacks.
@cite_4 @cite_7 @cite_8
2438105941 2045319758 2015129944
Social insect colonies have survived over evolutionary time in part due to the success of their collaborative methods: using local information and distributed decision making algorithms to detect and exploit critical resources in their environment. These methods have the unusual and useful ability to detect anomalies rapidly, with very little memory, and using only very local information. Our research investigates the potential for a self-organizing anomaly detection system inspired by those observed naturally in colonies of honey bees. We provide a summary of findings from a recently presented algorithm for a nonparametric, fully distributed coordination framework that translates the biological success of these methods into analogous operations for use in cyber defense and discuss the features that inspired this translation. We explore the impacts on detection performance of the defined range of distributed communication for each node and of involving only a small percentage of total nodes in the network in the distributed detection communication. We evaluate our algorithm using a software-based testing implementation, and demonstrate up to 20 percent improvement in detection capability over parallel isolated anomaly detectors. Distributed Denial-of-Service (DDoS) attacks pose a serious threat to Internet security. Most current research focuses on detection and prevention methods on the victim server or source side. To date, there has been no work on defenses using valuable information from the innocent client whose IP has been used in attacking packets. In this paper, we propose a novel cooperative system for producing warning of a DDoS attack. The system consists of a client detector and a server detector. The client detector is placed on the innocent client side and uses a Bloom filter-based detection scheme to generate accurate detection results yet consumes minimal storage and computational resources. The server detector can actively assist the warning process by sending requests to innocent hosts. Simulation results show that the cooperative technique presented in this paper can yield accurate DDoS alarms at an early stage. We theoretically show the false alarm probability of the detection scheme, which is insensitive to false alarms when using specially designed evaluation functions. Distributed denial of service (DDoS) is one of the most persecution network attack techniques to be confronted in recent years. From the definition of DDoS, thousands of network attacks must initiate simultaneously and continuously to achieve a successful DDoS attacking. Therefore, almost all of the information system cannot survive as they confront the DDoS attacks. Although there are a lot of intrusion detection system (IDS) developed, preventing DDoS attack is still difficult and perplexing. In this paper, an early warning system for detecting DDoS attacking has been mounted to a traditional IDS to form a completely system. This early warning system is developed based on the rationale of time delay neural network. In the networking topology, each node is monitored with the deployment of detectors to establish a multilayer architecture. In addition, the activities of each node will be monitored by their neighboring nodes to check whether it is still survival or not mutually. After then, all of the attacking information will be collected and transferred to the expert module for integrating analysis. As those nodes dispatched on the DMZ or between the first and second layer of firewall face some attacking similar as the pattern of DDoS, the kernel expert module which dispatched behind the second firewall will take some feasible actions and initiate the defense strategies to protect the kernel information system. In the meanwhile, those failed nodes will be restarted and act as the role of vanguard to assure the networking under normal operation.