doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> Applying Statistical Signal Analysis <s> This paper reviews and discusses the known definitions and properties of second-order self-similar discrete-time processes and supplements them with some more general conditions of self-similarity. A model for ATM cell traffic is presented and self-similarity conditions of this model are found. This study is motivated by observations that traffic in many real communication networks is self-similar in nature. <s> BIB001 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> Applying Statistical Signal Analysis <s> This paper analyzes the characteristics of Internet traffic by studying a six days long trace of the entire interdomain traffic received by an ISP.Our study shows that this traffic is self-similar at time-scales spanning minutes to hours.W e show that this self-similarity could be explained by two factors.First, the traffic volume received from each external source exhibits a heavy-tailed distribution.Second, the number of these external sources is also self-similar.Finally, we show that self-similar traffic can be simulated by users transferring exponentially distributed traffic provided that the number of users is self-similar. <s> BIB002 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> Applying Statistical Signal Analysis <s> We propose a simple and robust mechanism for detecting SYN flooding attacks. Instead of monitoring the ongoing traffic at the front end (like firewall or proxy) or a victim server itself, we detect the SYN flooding attacks at leaf routers that connect end hosts to the Internet. The simplicity of our detection mechanism lies in its statelessness and low computation overhead, which make the detection mechanism itself immune to flooding attacks. Our detection mechanism is based on the protocol behavior of TCP SYN-FIN (RST) pairs, and is an instance of the Seqnential Change Point Detection [l]. To make the detection mecbanism insensitive to site and access pattern, a non-parametric Cnmnlative Sum (CUSUM) method [4] is applied, thus making the detection mechanism much more generally applicable and its deployment much easier. The efficacy of this detection mechanism is validated by trace-driven simulations. The evaluation results show that the detection mechanism has short detection latency and high detection accuracy. Moreover, due to its proximity to the flooding sources, our mechanism not only sets alarms upon detection of ongoing SYN flooding attacks, but also reveals the location of the flooding sources without resorting to expensive IP traceback. <s> BIB003 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> Applying Statistical Signal Analysis <s> The nature of the threats posed by distributed denial of service (DDoS) attacks on large networks, such as the Internet, demands effective detection and response methods. These methods must be deployed not only at the edge but also at the core of the network This paper presents methods to identify DDoS attacks by computing entropy and frequency-sorted distributions of selected packet attributes. The DDoS attacks show anomalies in the characteristics of the selected packet attributes. The detection accuracy and performance are analyzed using live traffic traces from a variety of network environments ranging from points in the core of the Internet to those inside an edge network The results indicate that these methods can be effective against current attacks and suggest directions for improving detection of more stealthy attacks. We also describe our detection-response prototype and how the detectors can be extended to make effective response decisions. <s> BIB004 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> Applying Statistical Signal Analysis <s> This paper presents a systematic method for DDoS attack detection. DDoS attack can be considered system anomaly or misuse from which abnormal behavior is imposed on network traffic. Attack detection can be performed via abnormal behavior identification. Network traffic characterization with behavior modeling could be a good guidance of attack detection. Aggregated traffic has been found to be strong bursty across a wide range of time scales. Wavelet analysis is able to capture complex temporal correlation across multiple time scales with very low computational complexity. We utilize energy distribution based on wavelet analysis to detect DDoS attack traffic. Energy distribution over time would have limited variation if the traffic keeps its behavior over time (i.e. attack-free situation); while an introduction of attack traffic in the network would elicit significant energy distribution deviation in short time period. Our experimental results with typical Internet traffic trace show that energy distribution variance changes markedly causing a "spike" when traffic behaviors affected by DDoS attack In contrast, normal traffic exhibits a remarkably stationary energy distribution. In addition, this spike in energy distribution variance can be captured in early stage of attack, for ahead of congestion build-up, making it an effective attack detection. <s> BIB005 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> Applying Statistical Signal Analysis <s> Detecting signs of distributed denial-of-service (DDOS) flood attacks based on traffic time series analysis needs characterizing traffic series using a statistical model. The essential thing about this model should consistently characterize various types of traffic (such as TCP, UDP, IP, and OTHER) in the same order of magnitude of modeling accuracy. Our previous work [1] uses fractional Gaussian noise (FGN) as a tool for featuring traffic series for the purpose of reliable detection of signs of DDOS flood attacks. As a supplement of [1], this article gives experimental investigations to show that FGN can yet be used for modeling autocorrelation functions of various types network traffic (TCP, UDP, IP, OTHER) consistently in the sense that the modeling accuracy (expressed by mean square error) is in the order of magnitude of 10− − 3. <s> BIB006 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> Applying Statistical Signal Analysis <s> We investigate statistical anomaly detection algorithms for detecting SYN flooding, which is the most common type of Denial of Service (DoS) attack. The two algorithms considered are an adaptive threshold algorithm and a particular application of the cumulative sum (CUSUM) algorithm for change point detection. The performance is investigated in terms of the detection probability, the false alarm ratio, and the detection delay, using workloads of real traffic traces. Particular emphasis is on investigating the tradeoffs among these metrics and how they are affected by the parameters of the algorithm and the characteristics of the attacks. Such an investigation can provide guidelines to effectively tune the parameters of the detection algorithm to achieve specific performance requirements in terms of the above metrics. <s> BIB007 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> Applying Statistical Signal Analysis <s> Distributed denial-of-service(DDoS) attacks have recently emerged as a major threat to the security and stability of the Internet. As we know, traffic bursts always go with DDoS attacks. Detecting the network traffic bursts accurately in real-time can catch such attacks as quickly as possible. In this paper, we categorize the traffic bursts into three kinds: Single-point-burst, Short-flat-burst and Long-flat-burst, and propose a network traffic burst detecting algorithm (BDA-CWT) based on the continuous wavelet transform. In this algorithm, we use a slip window to analyze the traffic data uninterruptedly to detect the Short-flat-burst or the Long-flat-burst, which always represents DDoS attacks. Our experiment has demonstrated that the proposed detection algorithm is responsive and effective in curbing DDoS attacks, in contrast with the discrete wavelet transform and traditional methods (N-point-average and gradient). <s> BIB008 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> Applying Statistical Signal Analysis <s> DDoS(Distributed Denial of Service) is the most troublesome attack nowadays, especially for those people whose operational environment relies on network services and/or the Internet. However, attackers often penetrate innocent routers and hosts to make them unwittingly participate in such a large scale attack as zombies or reflectors. In this paper, we propose an Intrusion Detection System (IDS), named CUSUM Intrusion Detection System (CIDS), which invokes CUSUM as its detection algorithm and logically divides Internet into many autonomous network management units (NMUs), each deploys a CIDS to discover attacks and identify what role a client in such an attack acts as. <s> BIB009 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> Applying Statistical Signal Analysis <s> Worm and Dos, DDos attacks take place more and more frequently nowadays. It makes the internet security facing serious threat. In this paper, we introduced the algorithm and design of ESTABD, an internet backbone Early-bird System of Traffic Anomaly Detection Based. By observing the raw variables such as packets count of protocol, TCP flags and payload length distribution etc., ESTABD analyzes real-time traffic to discover the abrupt traffic anomalous and generate warnings. A traffic anomaly detection algorithm based on Statistic Prediction theory is put forward and the algorithm has been tested on real network data. Further more, Alerts correlation algorithm and system policy are addressed in this paper to detect the known worms& Dos attacks and potentially unknown threats. <s> BIB010 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> Applying Statistical Signal Analysis <s> This paper describes an approach to detecting distributed denial of service (DDoS) attacks that is based on fundamentals of Information Theory, specifically Kolmogorov Complexity. A theorem derived using principles of Kolmogorov Complexity states that the joint complexity measure of random strings is lower than the sum of the complexities of the individual strings when the strings exhibit some correlation. Furthermore, the joint complexity measure varies inversely with the amount of correlation. We propose a distributed active network-based algorithm that exploits this property to correlate arbitrary traffic flows in the network to detect possible denial-of-service attacks. One of the strengths of this algorithm is that it does not require special filtering rules and hence it can be used to detect any type of DDoS attack. We implement and investigate the performance of the algorithm in an active network. Our results show that DDoS attacks can be detected in a manner that is not sensitive to legitimate background traffic. <s> BIB011 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> Applying Statistical Signal Analysis <s> Detection of unknown Denial-of-Service (DoS) attacks is a hard issue. What attackers do is simply to consume a large amount of target resources. This simple feature allows attackers to create a wide variety of attack flows, and hence we must find a sophisticated general metric for detection. A possible metric is Kolmogorov Complexity (KC), a measure of the size of the smallest program capable of representing the given piece of data flows because DoS attacks, known or unknown, are anyway launched by computer programs. However, there are no established DoS-detection methods which make use of this possibility. And to make matters worse, it is well known that KC cannot be rigorously computed. In this paper, we compare three different KC estimation methods including a new proposal of our own, and propose a new DoS-detection method by monitoring fluctuation of KC differentials. <s> BIB012 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> Applying Statistical Signal Analysis <s> Distributed Denial of Service (DDoS) attacks generate enormous packets by a large number of agents and can easily exhaust the computing and communication resources of a victim within a short period of time. In this paper, we propose a method for proactive detection of DDoS attack by exploiting its architecture which consists of the selection of handlers and agents, the communication and compromise, and attack. We look into the procedures of DDoS attack and then select variables based on these features. After that, we perform cluster analysis for proactive detection of the attack. We experiment with 2000 DARPA Intrusion Detection Scenario Specific Data Set in order to evaluate our method. The results show that each phase of the attack scenario is partitioned well and we can detect precursors of DDoS attack as well as the attack itself. <s> BIB013 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> Applying Statistical Signal Analysis <s> This paper proposes a traffic anomaly detector, operated in postmortem and in real-time, by passively monitoring packet headers of traffic. The frequent attacks on network infrastructure, using various forms of denial of service attacks, have led to an increased need for developing techniques for analyzing network traffic. If efficient analysis tools were available, it could become possible to detect the attacks, anomalies and to take action to contain the attacks appropriately before they have had time to propagate across the network. In this paper, we suggest a technique for traffic anomaly detection based on analyzing correlation of destination IP addresses in outgoing traffic at an egress router. This address correlation data are transformed using discrete wavelet transform for effective detection of anomalies through statistical analysis. Results from trace-driven evaluation suggest that proposed approach could provide an effective means of detecting anomalies close to the source. We also present a multidimensional indicator using the correlation of port numbers and the number of flows as a means of detecting anomalies. <s> BIB014
Internet traffic has statistical properties which can be used to detect DoS traffic. For example, Normal Internet traffic is considered to be long-range dependent (LRD) or equivalently self-similar BIB002 . A time series is said to be LRD when its autocorrelation function r xx (τ ) is not summable, that is if ∞ 0 r xx (τ )dτ = +∞. This LRD property can be best established by evaluating the Hurst parameter H defined from the autocorrelation function r xx ∼ cτ 2H−2 as τ becomes very large, where c is a positive constant. The higher the value of H the more self-similar the traffic. In  , the self-similarity property of Internet traffic is used to identify DoS attacks. The authors use the packet number or packet size as the input feature and evaluate the Hurst parameter H by statistical techniques. In their approach, the variance of H in consecutive time intervals is calculated and if there is a doubling of the variance, it is decided that a DoS attack is in progress. In BIB004 , the entropy is used instead of the Hurst parameter, to evaluate the randomness of the incoming traffic. This is combined with the chi-square statistic, which is a measure of the statistical significance and rough estimate of confidence in DoS detection. In another statistical approach BIB006  , Internet traffic is modelled as Fractional Gaussian Noise (FGN), where it is reported that FGN can be used to approximate autocorrelation functions (ACF) of different types of traffic with the same order of modelling accuracy. Their detection scheme is based on the autocorrelation functions of the incoming traffic: the abnormal traffic is the sum of the number of bytes in packets in normal traffic and the attack traffic and the norm of the differences of the autocorrelation functions is used to signal DoS. The authors use simulation of a specific case study to verify that FGN can be used in real-time detection despite existing research showing the limitation of FGN in modelling the ACF of real-time traffic BIB001 . The Cumulative Sum (CUSUM) algorithm is a change point detection algorithm, which is applicable for detecting sharp changes in variables, and has been used widely in DoS detection. It is a lihelihood-ratio based method which signals abrupt changes from one valid hypothesis to another. CUSUM is first proposed for DoS detection in BIB003 , which uses as variables the TCP flags of the incoming traffic. The performance of the CUSUM approach for SYN flood attacks is evaluated in BIB007 , in terms of the detection probability, false alarm ratio, and detection delay. The same concept of CUSUM-based detection is explored in BIB009 , where it is applied in a distributed framework, in autonomous and logically divided parts of a network. In BIB010 an early-bird system of traffic anomaly detection scheme is proposed. This consists of a data centre, a traffic anomaly detection module and an event correlation module. The raw variables collected at the data engines, namely the packet count variable of each protocol, the packet count variables of SYN and FIN flags, ICMP unreachable messages and the packet length count variable of packet payload, are aggregated at the data centre. Then the traffic anomaly detection module uses Statistical Prediction Theory to detect anomalies based on the data provided by the data centre. The traffic is observed for a long period of time and is classified into periodic and non-periodic parts, for each using a different method to predict anomalies, which are then evaluated with predefined pattern profiles. It is often assumed that DoS packets must be highly correlated, contrary to legitimate traffic which is is some sense random. For this reason, the authors of BIB011 suggest using Kolmogorov complexity metrics for DoS detection. If K(x) is the Kolmogorov metric for the incoming packets and the complexity of a concatenated string XY is smaller than the sum of the complexities of each string Protection against Denial of Service Attacks: A Survey 7 then this implies a high correlation in the traffic. In practice, the authors use estimates for the complexity metrics and compute the complexity differentials which indicate legitimate traffic when they yield a value close to zero. An improvement upon this work is presented in BIB012 , where a different Kolmogorov metric estimate is proposed, this time measuring the correlation between the first and second halves of the strings. The corresponding DoS detection algorithm evaluates iteratively the fluctuations of the Kolmogorov complexity differentials and signals an attack when the fluctuations are increased. The authors of BIB013 have recently proposed a more proactive detection method, which concentrates on the changes that occur in the network traffic during the developing phases of the attack. They take into account the various steps of launching an attack, from the recruitment of the different tiers of compromised computers to their simultaneous attack. Since these recruitment processes generate a lot of messages in the network, the authors use entropy of source and destination addresses together with rates of packet types as their main statistical data. They separate each phase of the attack with a clustering algorithm and identify detection pre-cursors. Although it is not easy to evaluate the specific method, since the authors use a relatively outdated DARPA dataset, their suggestion that an attack can be detected at its earliest stages is promising. Several experiments have shown that the energy distribution of normal traffic is stationary. During a DoS attack however, the traffic behaviour appears to change significantly, as well as the energy distribution variance. For this reason, detection methods may use wavelet transform analysis to extract information about the energy content of the packets BIB005 . Traffic is considered to be normal if the variation in the energy distribution is smaller than a predetermined threshold. A network traffic burst detection algorithm based on the continuous wavelet transform is presented in BIB008 . With this method, flat bursts in the network traffic are considered to belong to three classes (long bursts, short bursts and one-point bursts), and a continuous wavelet transform algorithm is used for their real-time identification. Recently, wavelet approximation and system identification theory have been combined for anomaly detection in  . However, DoS is handled as one of five general categories of intrusions, with only two input features being directly relevant. In BIB014 , the use of correlation of destination IP addresses, port numbers and the number of flows. The authors employ wavelet transforms to study the address and port number correlation over several timescales. Since, the input features refer to the outgoing traffic at an egress router, the approach is suitable for an edge network, where the attack can be detected near its sources. Generally, wavelet based methods are able to reach detection decisions in relatively short time, but need significant computational resources for this. They use sliding sampling windows and time step increments, the choice of which determine the algorithm's performance. A small window may be inadequate for the calculation of the energy distribution variation, while a large window increases the computational needs. As is explained in BIB005 , an additional consideration that the wavelet methods introduce is the boundary effect that can exist in wavelet analysis.