Detecting DoS and DDoS Attacks Using Chi-Square
Fang−Yie Leu, Chia-Chi Pai · 2009
In this paper, we propose an agent_based distributed intrusion detection architecture, which detects DoS/DDoS attacks by comparing source IP addresses' normal and current connection frequencies. First, we collect source IPs' packet statistics to obtain their normal packet distribution. When current statistics suddenly increase, very often it is an attack. Experimental results show that this approach can effectively detect DoS/DDoS attacks.