A review on statistical approaches for anomaly detection in DDoS attacks

Abstract

ABSTRACTDistributed Denial-of-Service (DDoS) attack is one of the most common and effective type of attacks aiming to deny or weaken the service providing of its victim(s). The attack detection systems for non-distributed attacks find a source node with large number of sending packets. DDoS attacks are difficult to be detected or prevented and many researchers have focused on them recently. Some aspects such as attacks with low traffic rates, losing the sequential anomaly durations, and the large volume of analysis samples prolong the detection process. Anomaly detection methods in computer networks are based on statistical, soft computing, data mining, machine learning, and data stream algorithms. The statistical methods, which are reviewed by this article, monitor the receiving traffic in different time periods, and analyze how they are distributed. The memory consumption, computational overhead, attack detection accuracy, detecting the source/destination of the attack, and detection speed are some of the factors affecting the performance of DDoS attack detection systems. The results of this study indicate that among all the above factors, the accuracy and attack detection speed are the most important factors in statistical attack detection systems especially if the detection system acts on the victim’s side.