Features analysis and detection of DDoS attack
Zijian Deng · Computer Engineering and Applications Journal · 2007
It is a challenge to detect DDoS attack with low false positive and false negative.The key is to find the essential difference between normal stream and attack stream and identify it with simple algorithm.In term of the features of DDoS attack,a new conception of One-Way Connection Density(OWCD) is presented.Meanwhile,a DDoS detecting algorithm following distance measure is described.A cumulative Euclidean distance would be computed to indicate the deviation degree of the DDoS attack.As shown in the experiments,OWCD can more clearly mark DDoS attack than another conception,Flow Connection Density(FCD).This detection measure can also overcome the shortage of two-classification detecting means and efficiently and simply identify the DDoS attack of various attacking intensity.