DDoS Detection and Traceback with Decision Tree and Grey Relational Analysis

As modern life becomes increasingly closely bound to the Internet, network security becomes increasingly important. Like it or not, we all live under the shadow of network threats. The threats could cause leakage of privacy and/or economic loss. Among network attacks, the DDoS (distributed denial-of-service) attack is one of the most frequent and serious. In a DDoS attack, an attacker first breaks into many innocent computers (called zombies) by taking advantages of known or unknown bugs and vulnerabilities in the software. Then the attacker sends a large number of packets from these already-captured zombies to a server. These packets either occupy a major portion of the server’s network bandwidth or they consume much of the server’s time. The server is then prevented from conducting normal business operations. In order to mitigate the DDoS threat, we design a system to detect DDoS attacks based on a decision-tree technique and, after detecting an attack, to trace back to the app...

• Type: Conference
• Year: 2009
• Where: MUE
• Authors: Yi-Chi Wu, Huei-Ru Tseng, Wuu Yang, Rong-Hong Jan
• Keywords: Attacker first Breaks, Ddos Attack, MUE 2009, Multimedia, Server’s Network Bandwidth