Anomaly Detection for DDoS Attacks Based on Gini Coefficient
Yun Liu, Siyu Jiang, Jiuming Huang · 2013
Distributed Denial-of-Service (DDoS) attacks present a very serious threat to the stability of the Internet.In this paper, an anomaly detection method for DDoS attacks based on Gini coefficient is proposed.First, Gini coefficient is introduced to measure the inequalities of packet attribution (IP addresses and ports) distributions during attacks.Then, an improved TCM-KNN algorithm is applied to identify attacks by classifying the Gini coefficient samples extracted from realtime network traffic.The experimental results demonstrate that the proposed method can effectively distinguish DDoS attacks from normal traffic, and has higher detection ratio and lower false alarm ratio than similar detection methods.