Rapid Detection of Application Layer DDoS Attacks
Jiayong Chen · Journal of Information Engineering University · 2012
A rapid algorithm for detecting application-layer distributed denial of service(DDoS) attacks is introduced based on the statistical characteristics of application-layer user behaviors.This new method can rapidly identify the abnormal traffic aggregation and distinguish application-layer DDoS attacks from normal access.The application-layer user behavior is firstly abstracted into a series of interaction of protocol keywords.Then a formal description of the difference between the normal behavior and an attack is obtained following the finite state machine(FSM) theory,which is the basis of the detection model.The user behavior statistical characteristic vector is generated based on the statistical characteristics of application-layer protocol keywords.A TOPSIS classifier is constructed and trained to determine whether the suspected application-layer user behavior represents a DDoS attack.The experimental results demonstrate that this method is effective.