• KSII Transactions on Internet and Information Systems
    Monthly Online Journal (eISSN: 1976-7277)

A DoS Detection Method Based on Composition Self-Similarity


Abstract

Based on the theory of local-world network, the composition self-similarity (CSS) of network traffic is presented for the first time in this paper for the study of DoS detection. We propose the concept of composition distribution graph and design the relative operations. The (R/S)^d algorithm is designed for calculating the Hurst parameter. Based on composition distribution graph and Kullback Leibler (KL) divergence, we propose the composition self-similarity anomaly detection (CSSD) method for the detection of DoS attacks. We evaluate the effectiveness of the proposed method. Compared to other entropy based anomaly detection methods, our method is more accurate and with higher sensitivity in the detection of DoS attacks.


Statistics

Show / Hide Statistics

Statistics (Cumulative Counts from December 1st, 2015)
Multiple requests among the same browser session are counted as one view.
If you mouse over a chart, the values of data points will be shown.


Cite this article

[IEEE Style]
Z. Jian-Qi, F. Feng, C. Kim, Y. Ke-xin and L. Yan-Heng, "A DoS Detection Method Based on Composition Self-Similarity," KSII Transactions on Internet and Information Systems, vol. 6, no. 5, pp. 1463-1478, 2012. DOI: 10.3837/tiis.2012.05.012.

[ACM Style]
Zhu Jian-Qi, Fu Feng, Chong-kwon Kim, Yin Ke-xin, and Liu Yan-Heng. 2012. A DoS Detection Method Based on Composition Self-Similarity. KSII Transactions on Internet and Information Systems, 6, 5, (2012), 1463-1478. DOI: 10.3837/tiis.2012.05.012.