Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a question about how to calculate features selected in [ 1 ]. It assumes that the impact of DoS attack on features are nSrcs=nDsts=1, nPkts/sec>a, nSYN/Pkts>b, ... (Table 1 of [ 1 ])

Number of sources (nSrcs) and number of destination (nDsts) and other features are calculated for each aggregated flow according to destination IP (IPdst) in this case, in a time slot. (Section 5.1 of [ 1 ])

But how is it possible for a web server which receives lots of flows from different sources (nSrcs>1) to match with the mentioned DoS criteria. Maybe I don't understand what aggregation means here.

Reference: [ 1 ] Pedro Casas, Johan Mazel, Philippe Owezarski, Unsupervised Network Intrusion Detection Systems: Detecting the Unknown without Knowledge, Computer Communications, 2012.

Edit: Available at here. (This manuscript differs from the published one a little bit)

Edit: I asked the author, and answered this way:

"Everything is wrong with your reasonning as you consider basic traffic figures and not statistical figures. First, you need to learn about what an anomaly or a DoS attack is. Then, you have to learn about traffic statistics in the Internet... There are many papers on this written during the two last decades. Read them first."

what are statistical figures of network traffic?

share|improve this question

closed as not a real question by schroeder, Scott Pack, Gilles, Terry Chia, AviD Nov 23 '12 at 8:08

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

2  
I doubt you will get many answers to this if we have to pay $40 to read the study you are linking to. I suggest you put enough information in your question that it can be answered. –  GdD Nov 21 '12 at 10:14
1  
3  
Yasser - can you clarify what your question is actually asking. It doesn't appear you are asking about calculating features, but I couldn't understand what you are asking. –  Rory Alsop Nov 21 '12 at 13:44
    
I asked how nSrcs is calculated. If I aggregated flows that are sent to a webserver according to IPdst, then always nSrcs>1. So never DoS attack condition is satisfied. –  Yas Nov 21 '12 at 16:45
4  
Can you articulate that in English - I still can't understand, and I'm guessing the downvotes and close votes are for that reason. –  Rory Alsop Nov 21 '12 at 18:25

2 Answers 2

In table 1 of the paper, the authors describe the characteristics of different types of attacks. Some of them have nSrcs=1, some don't. Specifically, what they classify as a DOS attack has NSrcs=1.

You ask "but what if there are two sources?". Well, then you have what they classify as a DDOS, where the definition includes nSrcs > 1.

Now, in practical information security we don't use those exact definitions (we consider DDOS as a subset of DOS, and to have more attributes than just nSrcs>1), which perhaps explains your confusion, but if they need to classify attacks that way for their paper, then fair enough.

Practical classifications of anything are, inevitably, likely to be a bit mushy around the edges, and need tightening up if you're going to do some maths with them.

share|improve this answer

If you are asking: "With regards to IDS monitoring, what are "traffic statistics" and where can I learn about them? (whitepapers etc)"... then I think the answer you seek is in the whitepaper itself. And there is a picture that illustrates this concept on the top of page 3.

2. Related Work & Contributions

/Snip...

The problem of network anomaly detection has been extensively studied during the last decade. Most approaches analyze statistical variations of traffic volume descriptors (e.g., no. of packets, bytes, or new flows) and/or par- ticular traffic features (e.g., distribution of IP addresses and ports), using either single link measurements or net- work wide data. A non-exhaustive list of standard meth- ods includes the use of signal processing techniques (e.g., ARIMA modeling, wavelets-based filtering) on single-link traffic measurements [9], Kalman filters [12] for network- wide anomaly detection, and Sketches applied to IP-flows [14, 15].

[9] P. Barford, J. Kline, D. Plonka, and A. Ron, “A Signal Analysis of Network Traffic Anomalies”, in Proc. ACM IMW, 2002.

[12] A. Soule, K. Salamatian, and N. Taft, “Combining Filtering and Statistical Methods for Anomaly Detection”, in Proc. ACM IMC, 2005.

[14] B. Krishnamurthy, S. Sen, Y. Zhang, and Y. Chen, “Sketch- based Change Detection: Methods, Evaluation, and Applica- tions”, in Proc. ACM IMC, 2003.

[15] G. Dewaele, K. Fukuda, P. Borgnat, P. Abry, and K. Cho, “Ex- tracting Hidden Anomalies using Sketch and non Gaussian Multi- resolution Statistical Detection Procedures”, in Proc. LSAD, 2007.

If you find links for any of those whitepapers, kindly add them as a comment to this answer; I'd be curious about reading them.

share|improve this answer
    
Surprisingly, this part that you quote here is not in the published version of this paper that I got from sciencedirect.com. and also the references. –  Yas Nov 22 '12 at 19:04
    
@YasserMZadeh - I got this from the link you posted : hal.archives-ouvertes.fr/docs/00/73/62/78/PDF/… (how did you find that link) –  makerofthings7 Nov 22 '12 at 19:07
    
I didn't find it. David Wachtfogel found it as you see in the comments below my question. I was wondering how he could find either. –  Yas Nov 22 '12 at 19:14
    
I tried this and got it as the first result from google: "{TITLE OF PAPER}+manuscript" –  Yas Nov 22 '12 at 19:26
    

Not the answer you're looking for? Browse other questions tagged or ask your own question.