An Overview of Distributed Denial of Service Traffic Detection Approaches

Ivan Cvitić,Dragan Peraković,Siniša Husnjak,Marko Periša

doi:10.7307/ptt.v31i4.3082

Abstract

The availability of information and communication (IC) resources is a growing problem caused by the increase in the number of users, IC services, and the capacity constraints. IC resources need to be available to legitimate users at the required time. The availability is of crucial importance in IC environments such as smart city, autonomous vehicle, or critical infrastructure management systems. In the mentioned and similar environments the unavailability of resources can also have negative consequences on people's safety. The distributed denial of service (DDoS) attacks and traffic that such attacks generate, represent a growing problem in the last decade. Their goal is to disable access to the resources for legitimate users. This paper analyses the trends of such traffic which indicates the importance of its detection methods research. The paper also provides an overview of the currently used approaches used in detection system and model development. Based on the analysis of the previous research, the disadvantages of the used approaches have been identified which opens the space and gives the direction for future research. Besides the mentioned this paper highlights a DDoS traffic generated through Internet of things (IoT) devices as an evolving threat that needs to be taken into consideration in the future studies.

Highlights

The development of public, packet-oriented, communication network (Internet) followed by the increasing number of users and information and communication (IC) services has resulted in an increase of the amount of transferred data [1, 2]
Distributed denial of service attacks and distributed denial of service (DDoS) traffic generated through such attacks represent a continuous threat to business based on IC technology
Despite a large number of studies, the intensity and volume of DDoS-generated traffic are continuously increasing, with the generated traffic being increasingly based on infrastructure layer protocols

Summary

Introduction

The development of public, packet-oriented, communication network (Internet) followed by the increasing number of users and IC services has resulted in an increase of the amount of transferred data [1, 2]. There are many factors that have the potential to negatively affect the availability of IC resources and can be classified according to the source activity (internal and external) and the agent (human, environment and technology) [5] One of these factors whose trend has been steadily increasing over the last ten years is the network-oriented DDoS attack, or DDoS traffic as a means of attack implementation [6]. DDoS traffic is causing a number of difficulties in electronic business, such as complete unavailability or degradation of service quality Such state of service can have negative implication on the targeted organization reflected in the reputation loss, user loss and in economic loss

Objectives

Methods

Findings

Discussion

Conclusion