DDoS attack detection by using packet features

Abstract

DDoS attacks have been in internet life for a long time and most of hosts are still vulnerable for DDoS attacks. Complete detection and prevention of DDoS attacks is almost impossible, since their working method. Especially, if you are observing a network, not only one host, detecting DDoS attack can be much harder. To detect DDoS attacks existence, we used 11 features. We rst used only threshold value of each features to detect DDoS attacks. Then, we used RMS (Root Mean Square) to improve our detection rates. We found di erent features are the best for Syn ood attack detection and UDP Flood attack detection. The hardest issue for working on DDoS attacks is lack of publicly available datasets. We used UCLA dataset (University of California, Los Angeles), NUST datasets (National University of Sciences and Technology) and we composed 2 more datasets in Bogazici University to work on. In total, we applied our methods on 5 different datasets from 3 di erent institutes. Then, we compared our results with other similar studies. Our analysis showed that the best feature to detect TCP Syn ood attack is "SYN/ACK ratio" and the best feature to detect UDP ood is " ow generating rate".