Interactive Detection and Classification of DDoS Attacks Using ESVM

Abstract

Distributed Denial of Service (DDoS) attack is a continuous critical threat to the internet. Application layer DDoS Attack is derived from the lower layers. Application layer based DDoS attacks use legitimate HTTP requests after establishment of TCP three way hand shaking and overwhelms the victim resources, such as sockets, CPU, memory, disk, database bandwidth. Network layer based DDoS attacks sends the SYN, UDP and ICMP requests to the server and exhausts the bandwidth. An anomaly detection mechanism is proposed in this paper to detect DDoS attacks using Enhanced Support Vector Machine (ESVM). The Application layer DDoS Attack such as HTTP Flooding, DNS Spoofing and Network layer DDoS Attack such as Port Scanning, TCP Flooding, UDP Flooding, ICMP Flooding, Land Flooding. Session Flooding are taken as test samples for ESVM. The Normal user access behavior attributes is taken as training samples for ESVM. The traffic from the testing samples and training samples are Cross Validated and the better classification accuracy is obtained. Application and Network layer DDoS attacks are classified with classification accuracy of 99 % with ESVM. Keywords— Anomaly detection, DDoS, Enhanced Support VectorMachine (ESVM), Intrusion detection, String kernels.