A Proposal to Distinguish DDoS Traffic in Flash Crowd Environments

View Sample PDF

Author(s): Anderson Aparecido Alves da Silva (SENAC, Brazil & IPT, Brazil & UNIP, Brazil & USP, Brazil), Leonardo Santos Silva (IPT, Brazil), Erica Leandro Bezerra (USP, Brazil), Adilson Eduardo Guelfi (UNOESTE, Brazil), Claudia de Armas (USP, Brazil), Marcelo Teixeira de Azevedo (USP, Brazil)and Sergio Takeo Kofuji (USP, Brazil)
Copyright: 2022
Volume: 16
Issue: 1
Pages: 16
Source title: International Journal of Information Security and Privacy (IJISP)
Editor(s)-in-Chief: Yassine Maleh (Sultan Moulay Slimane University, Morocco)and Ahmed A. Abd El-Latif (Menoufia University, Egypt)
DOI: 10.4018/IJISP.2022010104

Keywords: Information Science Reference / Information Security & Privacy / IT Security and Ethics / Security & Forensics

Purchase

View A Proposal to Distinguish DDoS Traffic in Flash Crowd Environments on the publisher's website for pricing and purchasing information.

Abstract

A Flash Crowd (FC) event occurs when network traffic increases suddenly due to a specific reason (e.g. e-commerce sale). Despite its legitimacy, this kind of situation usually decreases the network resource performance. Furthermore, attackers may simulate FC situations to introduce undetected attacks, such as Distributed Denial of Service (DDoS), since it is very difficult to distinguish between legitimate and malicious data flows. To differentiate malicious and legitimate traffic we propose applying zero inflated count data models in conjunction with the Correlation Coefficient Flow (CCF) method – a well-known method used in FC situations. Our results were satisfactory and improve the accuracy of CCF method. Furthermore, since the environment toggles between normal and FC situations, our method has the advantage of working in both situations.

The IRMA Community

Research IRM

A Proposal to Distinguish DDoS Traffic in Flash Crowd Environments

Purchase

Abstract

Related Content

IRMA Sponsors