An empirical evaluation of information metrics for low-rate and high-rate DDoS attack detection

作者：Bhuyan Monowar H^*; Bhattacharyya D K; Kalita J K

来源：Pattern Recognition Letters, 2015, 51: 1-7.

DOI：10.1016/j.patrec.2014.07.019

• DDoS attack
• Information metric
• Threat
• Network traffic
• Entropy

Distributed Denial of Service (DDoS) attacks represent a major threat to uninterrupted and efficient Internet service. In this paper, we empirically evaluate several major information metrics, namely, Hartley entropy, Shannon entropy, Renyi's entropy, generalized entropy, Kullback-Leibler divergence and generalized information distance measure in their ability to detect both low-rate and high-rate DDoS attacks. These metrics can be used to describe characteristics of network traffic data and an appropriate metric facilitates building an effective model to detect both low-rate and high-rate DDoS attacks. We use MIT Lincoln Laboratory, CAIDA and TUIDS DDoS datasets to illustrate the efficiency and effectiveness of each metric for DDoS detection.

• 出版日期2015-1-1