Detection of LDDoS Attacks Based on TCP Connection Parameters
dc.contributor.author | Siracusano, M | |
dc.contributor.author | Shiaeles, S | |
dc.contributor.author | Ghita, B | |
dc.date.accessioned | 2019-07-28T01:07:21Z | |
dc.date.available | 2019-07-28T01:07:21Z | |
dc.date.issued | 2019-02-07 | |
dc.identifier.isbn | 9781538672723 | |
dc.identifier.issn | 2150-329X | |
dc.identifier.issn | 2150-329X | |
dc.identifier.uri | http://hdl.handle.net/10026.1/14704 | |
dc.description.abstract |
Low-rate application layer distributed denial of service (LDDoS) attacks are both powerful and stealthy. They force vulnerable webservers to open all available connections to the adversary, denying resources to real users. Mitigation advice focuses on solutions that potentially degrade quality of service for legitimate connections. Furthermore, without accurate detection mechanisms, distributed attacks can bypass these defences. A methodology for detection of LDDoS attacks, based on characteristics of malicious TCP flows, is proposed within this paper. Research will be conducted using combinations of two datasets: one generated from a simulated network, the other from the publically available CIC DoS dataset. Both contain the attacks slowread, slowheaders and slowbody, alongside legitimate web browsing. TCP flow features are extracted from all connections. Experimentation was carried out using six supervised AI algorithms to categorise attack from legitimate flows. Decision trees and kNN accurately classified up to 99.99% of flows, with exceptionally low false positive and false negative rates, demonstrating the potential of AI in LDDoS detection. | |
dc.format.extent | 1-6 | |
dc.language.iso | en | |
dc.publisher | IEEE | |
dc.subject | DoS | |
dc.subject | LDoS | |
dc.subject | LDDoS | |
dc.subject | Distributed Denial of Service | |
dc.subject | Low rate attack | |
dc.subject | RoQ | |
dc.subject | Artificial Intelligence | |
dc.subject | Network Defence | |
dc.subject | Machine Learning | |
dc.subject | Deep Learning | |
dc.subject | Computer Security | |
dc.subject | Cyber Security | |
dc.title | Detection of LDDoS Attacks Based on TCP Connection Parameters | |
dc.type | conference | |
dc.type | Proceedings Paper | |
plymouth.author-url | http://arxiv.org/abs/1904.01508v1 | |
plymouth.date-start | 2018-10-23 | |
plymouth.date-finish | 2018-10-25 | |
plymouth.volume | 00 | |
plymouth.publisher-url | http://dx.doi.org/10.1109/GIIS.2018.8635701 | |
plymouth.conference-name | 2018 Global Information Infrastructure and Networking Symposium (GIIS) | |
plymouth.publication-status | Published | |
plymouth.journal | 2018 Global Information Infrastructure and Networking Symposium (GIIS) | |
dc.identifier.doi | 10.1109/giis.2018.8635701 | |
plymouth.organisational-group | /Plymouth | |
plymouth.organisational-group | /Plymouth/Faculty of Science and Engineering | |
plymouth.organisational-group | /Plymouth/Faculty of Science and Engineering/School of Engineering, Computing and Mathematics | |
plymouth.organisational-group | /Plymouth/REF 2021 Researchers by UoA | |
plymouth.organisational-group | /Plymouth/REF 2021 Researchers by UoA/UoA11 Computer Science and Informatics | |
plymouth.organisational-group | /Plymouth/Users by role | |
plymouth.organisational-group | /Plymouth/Users by role/Academics | |
dcterms.dateAccepted | 2019-02-01 | |
dc.rights.embargodate | 2020-7-3 | |
dc.identifier.eissn | 2150-329X | |
dc.rights.embargoperiod | Not known | |
rioxxterms.version | Accepted Manuscript | |
rioxxterms.versionofrecord | 10.1109/giis.2018.8635701 | |
rioxxterms.licenseref.uri | http://www.rioxx.net/licenses/all-rights-reserved | |
rioxxterms.licenseref.startdate | 2019-02-07 | |
rioxxterms.type | Conference Paper/Proceeding/Abstract | |
plymouth.funder | Cyber-Trust: Advanced Cyber-Threat Intelligence, Detection, and Mitigation Platform for a Trusted Internet of Things::European Commision - H2020 RIA |