Flooding Attacks Detection in Backbone Traffic Using Power Divergence

Ali Makke (1) , Osman Salem (1) , Mohamad Assaad (2) , Hassine Moungla (1) , Ahmed Mehaoua (1)

1 LIPADE - EA 2517 - Laboratoire d'Informatique Paris Descartes
2 CIDRE - Confidentialité, Intégrité, Disponibilité et Répartition

Flooding attacks detection in traffic of backbone networks requires generally the analysis of a huge amount of data with high accuracy and low complexity. In this paper, we propose a new scheme to detect flooding attacks in high speed networks. The proposed mechanism is based on the application of Power Divergence measures over Sketch data structure. Sketch is used for random aggregation of traffic, and Power Divergence is applied to detect deviations between currentand established probability distributions of network traffic. We focus on tuning the parameter of Power Divergence to optimize the performance. We evaluate our approach us- ing real Internet traffic traces, obtained from MAWI trans- Pacific wide transit link between USA and Japan. Our re- sults show that the proposed approach outperforms existing solutions in terms of detection accuracy and false alarm ratio.

Domaines: Réseaux et télécommunications [cs.NI]

Ali Makke, Osman Salem, Mohamad Assaad, Hassine Moungla, Ahmed Mehaoua. Flooding Attacks Detection in Backbone Traffic Using Power Divergence. 2012. ⟨hal-00812989⟩