JUCS - Journal of Universal Computer Science 15(2): 488-504, doi: 10.3217/jucs-015-02-0488
A New Detection Method for Distributed Denial-of-Service Attack Traffic based on Statistical Test
expand article infoChin-Ling Chen
‡ National Pingtung Institute of Commerce, Pingung, Taiwan
Open Access
This study has proposed a new detection method for DDoS attack traffic based on two-sample t-test. We first investigate the statistics of normal SYN arrival rate (SAR) and confirm it follows normal distribution. The proposed method identifies the attack by testing 1) the difference between incoming SAR and normal SAR, and 2) the difference between the number of SYN and ACK packets. The experiment results show that the possibilities of both false positives and false negatives are very low. The proposed mechanism is also demonstrated to have the capability of detecting DDoS attack quickly.
security and protection, network monitoring, statistical computing