Application of anomaly detection algorithms for detecting SYN flooding attacks

Published 5 April 2005

Vasilios A. Siris, F. Papagalou

DOI10.1109/glocom.2004.1378372

Citations288

Abstract

We investigate statistical anomaly detection algorithms for detecting SYN flooding, which is the most common type of denial of service (DoS) attack. The two algorithms considered are an adaptive threshold algorithm and a particular application of the cumulative sum (CUSUM) algorithm for change point detection. The performance is investigated in terms of the detection probability, the false alarm ratio, and the detection delay. Particular emphasis is on investigating the tradeoffs among these metrics and how they are affected by the parameters of the algorithm and the characteristics of the attacks. Such an investigation can provide guidelines to effectively tune the parameters of the detection algorithm to achieve specific performance requirements in terms of the above metrics.

Keywords

Computer Science

TechnometricsDetection of Abrupt Changes: Theory and Application

2,980 Citations1994Kurt S. Riedel

A unified framework for the design and the performance analysis of the algorithms for solving change detection problems and links with the analytical redundancy approach to fault detection in linear systems are established.

Inferring Internet Denial-of-Service Activity

870 Citations2001David Moore, Geoffrey M. Voelker +1 more

Detecting SYN flooding attacks

571 Citations2003Haining Wang, Danlu Zhang +1 more

A simple and robust mechanism that not only sets alarms upon detection of ongoing SYN flooding attacks, but also reveals the location of the flooding sources without resorting to expensive IP traceback.

USENIX Large Installation Systems Administration ConferenceAberrant Behavior Detection in Time Series for Network Monitoring

301 Citations2000Jake D. Brutlag

The solution was to integrate a model based on exponential smoothing and Holt-Winters forecasting into the Cricket/RRDtool architecture, and while perhaps not optimal, this solution is flexible, efficient, and effective as a tool for automatic aberrant behavior detection.

Application of anomaly detection algorithms for detecting SYN flooding attacks

288 Citations2005Vasilios A. Siris, F. Papagalou

A non-instrusive, wavelet-based approach to detecting network performance problems

124 Citations2001Chun‐Ying Huang, Anja Feldmann +1 more

It is shown that a number of structural properties of aggregate TCP/IP packet traces reveal themselves and can be compared across different time periods and across paths of the traffic destined to different subnets by exploiting the built-in scale-localization ability of wavelets.

Computer NetworksA statistical approach to predictive detection

102 Citations2001Joseph L. Hellerstein, Fan Zhang +1 more

This work model the threshold metric (e.g., HTTP operations per second) at two levels: non-stationary behavior (as is done in workload forecasting for capacity planning) and stationary, time-serial dependencies.

Adaptive thresholding for proactive network problem detection

69 Citations2002Marina Thottan, Chuanyi Ji

For most of the faults studied, detection occurs in advance of the fault and the algorithm is simple enough for potential online implementation: thus allowing the possibility of prediction and recovery in the future.

USENIX Summer Technical ConferenceComputer system performance problem detection using time series models

41 Citations1993Peter J. Hoogenboom, Jay Lepreau

An expert system that automatically sets thresholds, and detects and diagnoses performance problems on a network of Unix computers, and makes one of 18 specific diagnoses and notifies the administrator, and optionally the user.

Ghent University Academic Bibliography (Ghent University)Scampi - A Scaleable monitoring platform for the Internet

26 Citations2004Jan Coppens

The architecture of SCAMPI allows easy writing of monitoring applications, which can run on top of different network adapters without changing the code and which can provide detailed monitoring of high-speed Internet circuits.