Extraction of Characteristics of Anomaly Accessed IP Packets Using Chi-square Method
Shunsuke Oshima, Takuo Nakashima, Yusuke Nishikido · 2009
To defend DoS (denial of service) attacks, an access filtering mechanism is adopted in the end servers or the IDS (intrusion detection system). The difficulty to define the filtering rules lies where normal and anomaly packets have to be distinguished in incoming packets. The purpose of our research is to explore the early detective method for anomaly accesses based on statistic analysis. In this paper, we defined the chi-square method, and then analyze the all amount of incoming packets to our College focusing on the source IP address using chi-square method. As the results, we were able to extract the following features. Firstly, the number of packets was the more suitable scale of the window in the chi-square method than the time scale. Secondly, the setting of the window size with 500 packets and 2 bins made the detection of the DoS attacks within 10 minutes for DNS packets possible. Finally, we verified that the DoS attacks from the same source IP address was detected using the chi-square method.