Skip to main content
SpringerLink
Log in

DDoS Attacks Detection by Means of Statistical Models

  • Conference paper
  • First Online:
Proceedings of the 9th International Conference on Computer Recognition Systems CORES 2015

Part of the book series: Advances in Intelligent Systems and Computing ((AISC,volume 403))

Abstract

In this article we present a network traffic DDoS attacks detection method based on modeling the variability with the use of conditional average and variance in examined time series. Variability predictions of the analyzed network traffic are realized by estimated statistical models ARFIMA and FIGARCH. We propose simple parameter estimation models with the use of maximum likelihood function. The choice of sparingly parameterized form of the models is realized by means of information criteria representing a compromise between brevity of representation and the size of the prediction error. In the described method we propose using statistical relations between predicted and analyzed network traffic in order to detect abnormal behavior possibly being a result of a network attack. Performed experiments confirmed effectiveness of the analyzed method and cogency of the statistical models. abstract environment.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 169.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 219.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Jackson, K.: Intrusion Detection Systems (IDS). Product Survey. Los Alamos National Library, LA-UR-99-3883 (1999)

    Google Scholar 

  2. Esposito, M., Mazzariello, C., Oliviero, F., Romano, S.P., Sansone C.: Evaluating pattern recognition techniques in intrusion detection systems. In: PRIS, pp. 144–153 (2005)

    Google Scholar 

  3. Lakhina, A., Crovella, M., Diot, C.H.: Characterization of network-wide anomalies in traffic flows. In: Proceedings of the 4th ACM SIGCOMM Conference on Internet Measurement, pp. 201–206 (2004)

    Google Scholar 

  4. Chondola, V., Banerjee, A., Kumar, V.: Anomaly detection: a survey. ACM Comput. Surv. 41(3), 1–72 (2009)

    Article  Google Scholar 

  5. Rodriguez, A., Mozos, M.: Improving network security through traffic log anomaly detection using time series analysis. In: Computational Intelligence in Security for Information Systems, pp. 125–133 (2010)

    Google Scholar 

  6. Liang H., Xiaoming B.: Research of DDoS attack mechanism and its defense frame, computer research and development (ICCRD). In: 3rd International Conference, pp. 440–442 (2011)

    Google Scholar 

  7. Atak i Obrona 2013 Raport, Ataki i metody obrony w internecie w Polsce (2013)

    Google Scholar 

  8. Granger, C.W.J., Joyeux, R.: An introduction to long-memory time series models andfractional differencing. J. Time Ser. Anal. 1, 15–29 (1980)

    Article  MathSciNet  MATH  Google Scholar 

  9. Hosking, J.: Fractional differencing. Biometrika 68, 165–176 (1981)

    Article  MathSciNet  MATH  Google Scholar 

  10. Engle, R.: Autoregressive conditional heteroskedasticity with estimates of the variance of UK inflation. Econometrica 50, 987–1008 (1982)

    Article  MathSciNet  MATH  Google Scholar 

  11. Baillie, R., Bollerslev, T., Mikkelsen, H.: Fractionally integrated generalized autoregressive conditional heteroskedasticity. J. Econom. 74, 3–30 (1996)

    Article  MathSciNet  MATH  Google Scholar 

  12. Crato, N., Ray, B.K.: Model selection and forecasting for long-range dependent processes. J. Forecast. 15, 107–125 (1996)

    Article  Google Scholar 

  13. Gabriel, V.J., Martins, L.F.: On the forecasting ability of ARFIMA models when infrequent breaks occur. Econom. J. 7, 455–475 (2004)

    Article  MathSciNet  MATH  Google Scholar 

  14. Tayefi, M., Ramanathan, T.V.: An overview of FIGARCH and related time series models. AUSTRIAN J. Stat. 41(3), 175–196 (2012)

    Google Scholar 

  15. Box, G., Jenkins, G., Reinsel, G.: Time Series Analysis. Holden-day, San Francisco (1970)

    MATH  Google Scholar 

  16. Brockwell, P., Davis, R.: Introduction to Time Series and Forecasting. Springer, Berlin (2002)

    Book  MATH  Google Scholar 

  17. Beran, J.A.: Statistics for Long-Memory Processes. Chapman and Hall, New York (1994)

    MATH  Google Scholar 

  18. Haslett, J.: Raftery AE space-time modelling with long-memory dependence: assessing Ireland’s wind power resource (with discussion). Appl. Stat. 38(1), 1–50 (1989)

    Article  MathSciNet  Google Scholar 

  19. Hyndman, R.J., Khandakar, Y.: Automatic time series forecasting: the forecast Package for R. J. Stat. Softw. 27(3), 1–22 (2008)

    Article  Google Scholar 

  20. SNORT—Intrusion Detection System, https://www.snort.org/

  21. The CAIDA Dataset, http://www.caida.org/data (2006–2009)

Download references

Author information

Authors and Affiliations

  1. Institute of Telecommunications, UTP University of Science and Technology, ul. Kaliskiego 7, 85-789, Bydgoszcz, Poland

    Tomasz Andrysiak & Łukasz Saganowski

Authors
  1. Tomasz Andrysiak
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Łukasz Saganowski
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Tomasz Andrysiak .

Editor information

Editors and Affiliations

  1. Department of Systems, Wrocław University of Technology, Wroclaw, Poland

    Robert Burduk

  2. Department of Systems and Computer, Wrocław University of Technology, Wroclaw, Poland

    Konrad Jackowski

  3. Department of Systems and Computer, Wrocław University of Technology, Wroclaw, Poland

    Marek Kurzyński

  4. Dept. of Systems and Computer Networks, Wrocław University of Technology, Wroclaw, Poland

    Michał Woźniak

  5. Department of Systems, Wrocław University of Technology, Wroclaw, Poland

    Andrzej Żołnierek

Rights and permissions

Reprints and permissions

Copyright information

© 2016 Springer International Publishing Switzerland

About this paper

Cite this paper

Andrysiak, T., Saganowski, Ł. (2016). DDoS Attacks Detection by Means of Statistical Models. In: Burduk, R., Jackowski, K., Kurzyński, M., Woźniak, M., Żołnierek, A. (eds) Proceedings of the 9th International Conference on Computer Recognition Systems CORES 2015. Advances in Intelligent Systems and Computing, vol 403. Springer, Cham. https://doi.org/10.1007/978-3-319-26227-7_75

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-26227-7_75

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-26225-3

  • Online ISBN: 978-3-319-26227-7

  • eBook Packages: EngineeringEngineering (R0)

Publish with us

Policies and ethics

Search

Navigation