Real time detection and classification of DDoS attacks using enhanced SVM with string kernels

Distributed Denial of Service (DDoS) attack is a continuous critical threat to the internet. Application layer DDoS Attack is derived from the lower layers. Application layer based DDoS attacks use legitimate HTTP requests after establishment of TCP three way hand shaking and overwhelms the victim r...

Full description

Saved in:
Bibliographic Details
Main Authors: Ramamoorthi, A., Subbulakshmi, T., Shalinie, S. M.
Format: Conference Proceeding
Language:English
Subjects:
Anomaly detection
Computer crime
DDoS
Enhanced Support Vector Machine (ESVM)
Floods
Intrusion detection
IP networks
Kernel
Servers
String kernels
Support vector machines
Training
Online Access:Request full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Distributed Denial of Service (DDoS) attack is a continuous critical threat to the internet. Application layer DDoS Attack is derived from the lower layers. Application layer based DDoS attacks use legitimate HTTP requests after establishment of TCP three way hand shaking and overwhelms the victim resources, such as sockets, CPU, memory, disk, database bandwidth. Network layer based DDoS attacks sends the SYN, UDP and ICMP requests to the server and exhausts the bandwidth. Normal profile is created from user's access behavior attributes which is the base line to differentiate DDoS attacks from flash crowd. An anomaly detection mechanism is proposed in this paper to detect DDoS attacks using Enhanced Support Vector Machine (ESVM) with string kernels. Normal user access behavior attributes is used as training samples for ESVM, which produces the model file. Data collected during normal and attack is used as test samples for ESVM. Application and Network layer DDoS attacks are classified with classification accuracy of 99% with ESVM.
DOI:10.1109/ICRTIT.2011.5972281