A Proposal to Distinguish DDoS Traffic in Flash Crowd Environments

A Proposal to Distinguish DDoS Traffic in Flash Crowd Environments

Anderson Aparecido Alves da Silva, Leonardo Santos Silva, Erica Leandro Bezerra, Adilson Eduardo Guelfi, Claudia de Armas, Marcelo Teixeira de Azevedo, Sergio Takeo Kofuji
Copyright: © 2022 |Pages: 16
DOI: 10.4018/IJISP.2022010104
OnDemand:
(Individual Articles)
Available
$37.50
Current Special Offers
No Current Special Offers
TOTAL SAVINGS: $37.50

Abstract

A Flash Crowd (FC) event occurs when network traffic increases suddenly due to a specific reason (e.g. e-commerce sale). Despite its legitimacy, this kind of situation usually decreases the network resource performance. Furthermore, attackers may simulate FC situations to introduce undetected attacks, such as Distributed Denial of Service (DDoS), since it is very difficult to distinguish between legitimate and malicious data flows. To differentiate malicious and legitimate traffic we propose applying zero inflated count data models in conjunction with the Correlation Coefficient Flow (CCF) method – a well-known method used in FC situations. Our results were satisfactory and improve the accuracy of CCF method. Furthermore, since the environment toggles between normal and FC situations, our method has the advantage of working in both situations.
Article Preview
Top

In this section, the conceptual basis that guides the research will be identified and the main works that sought to deal with the same problem described, highlighting what differentiates our research from the works already carried out.

Count Data Distributions

The count data distributions such as Poisson and BINEG serve to determine the number of event occurrences within a discrete period since these events are independent. Generally, these distributions are used when the sample n is large, and the probability of occurrence p of an event is low (Heckert et al., 2002).

Poisson

Poisson regression models are frequently used to analyze count data. A random variable Y with integer values y={0,1,2,…} and an average number of occurrences µ>0 has a Poisson distribution with probability (Ridout & Hinde, 1998) and (Dobsonh & Barnett, 2018):

IJISP.2022010104.m01
(1)

An important issue in the Poisson distribution is that variance is equal to mean: E(Y)=var(Y)=µ. The parameter µ is also used to model the effect of independent variables in the response variable Y through regression. Let Y=(Y1, …,Yn) be independent random variables where Yi is the ith event of ni and θ=(θ1, …,θn) is the vector of parameters of the distribution, the expected value of Yi is E(Yi)=µi=niθi and the model dependence of θi on the independent variables is: IJISP.2022010104.m02. Therefore, the GLM is (Dobsonh & Barnett, 2018):

IJISP.2022010104.m03
(2)

Complete Article List

Search this Journal:
Reset
Volume 18: 1 Issue (2024)
Volume 17: 1 Issue (2023)
Volume 16: 4 Issues (2022): 2 Released, 2 Forthcoming
Volume 15: 4 Issues (2021)
Volume 14: 4 Issues (2020)
Volume 13: 4 Issues (2019)
Volume 12: 4 Issues (2018)
Volume 11: 4 Issues (2017)
Volume 10: 4 Issues (2016)
Volume 9: 4 Issues (2015)
Volume 8: 4 Issues (2014)
Volume 7: 4 Issues (2013)
Volume 6: 4 Issues (2012)
Volume 5: 4 Issues (2011)
Volume 4: 4 Issues (2010)
Volume 3: 4 Issues (2009)
Volume 2: 4 Issues (2008)
Volume 1: 4 Issues (2007)
View Complete Journal Contents Listing