A New Detection Method for Distributed Denial-of-Service Attack Traffic based on Statistical Test

Chin-Ling Chen

doi:10.3217/jucs-015-02-0488

JUCS - Journal of Universal Computer Science 15(2): 488-504, doi: 10.3217/jucs-015-02-0488

A New Detection Method for Distributed Denial-of-Service Attack Traffic based on Statistical Test

Chin-Ling Chen^‡

‡ National Pingtung Institute of Commerce, Pingung, Taiwan

Corresponding author: Chin-Ling Chen ( clchen@mail.npic.edu.tw )

This article is freely available under the J.UCS Open Content License.

Citation: Chen C-L (2009) A New Detection Method for Distributed Denial-of-Service Attack Traffic based on Statistical Test. JUCS - Journal of Universal Computer Science 15(2): 488-504. https://doi.org/10.3217/jucs-015-02-0488

Abstract

This study has proposed a new detection method for DDoS attack traffic based on two-sample t-test. We first investigate the statistics of normal SYN arrival rate (SAR) and confirm it follows normal distribution. The proposed method identifies the attack by testing 1) the difference between incoming SAR and normal SAR, and 2) the difference between the number of SYN and ACK packets. The experiment results show that the possibilities of both false positives and false negatives are very low. The proposed mechanism is also demonstrated to have the capability of detecting DDoS attack quickly.

Keywords

security and protection, network monitoring, statistical computing