Abstract
We propose a method for DDoS detection by constructing a fuzzy estimator on the mean packet inter arrival times. We divided the problem into two challenges, the first being the actual detection of the DDoS event taking place and the second being the identification of the offending IP addresses. We have imposed strict real time constraints for the first challenge and more relaxed constraints for the identification of addresses. Through empirical evaluation we confirmed that the detection can be completed within improved real time limits and that by using fuzzy estimators instead of crisp statistical descriptors we can avoid the shortcomings posed by assumptions on the model distribution of the traffic. In addition we managed to obtain results under a 3 sec detection window. © 2012 Elsevier Ltd. All rights reserved.
DOI
10.1016/j.cose.2012.06.002
Publication Date
2012-09-01
Publication Title
Computers & Security
Volume
31
Issue
6
Publisher
Elsevier BV
ISSN
0167-4048
Embargo Period
2024-11-22
First Page
782
Last Page
790
Recommended Citation
Shiaeles, S., Katos, V., Karakos, A., & Papadopoulos, B. (2012) 'Real time DDoS detection using fuzzy estimators', Computers & Security, 31(6), pp. 782-790. Elsevier BV: Available at: https://doi.org/10.1016/j.cose.2012.06.002
