Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

As I learned, there is this technique in which the number of bytes/packets/frames of aggregated traffic is being checked to see if they deviate from a normal behavior. Then the time slot of that anomaly is searched for if there is any DoS attack within and or for flows that caused the problem (root cause analysis).

Could you suggest a paper that does the first part, to detect anomaly (DoS,..) by checking its deviation from normal behavior.

I know simple threshold would work, but i want to know the next best idiot approach to understand better myself and implement it before heading toward wavelet and kalman filter!

share|improve this question
3  
You have 5 questions open, all on a similar topic, none of which have an accepted answer. Please go back and accept answers where they have been helpful. You can do so by clicking the tick icon to the left of the question. Furthermore, you're continuously asking very similar questions, most of which are borderline off-topic here, since they deal with data mining and trend analysis rather than actual security concepts. On top of that, this question seems to be a paper recommendation, which is not a good fit for StackExchange. Please take more care to consider the site requirements in future. – Polynomial Nov 26 '12 at 13:09
Thanks. Now I have 2 open question. I am studying about anomaly detection. What should I ask? This one is about DoS. The papers I read are published in computer and security field. Data mining is itself a mathematical problem. So every problem should be asked from math section? The best answer for a question is the one answered in a paper if such a paper exists. I can't understand why this doesn't fit here. – Yasser MZadeh Nov 27 '12 at 7:26
The fact that it's focused on DoS attacks is incidental; I could ask "How do I get my staff to stop complaining about password complexity requirements?" and it'd be off topic because it's a workplace question. Just because you're including a security term in your question doesn't mean it's about security. Your question would probably be better on Stats.SE, as long as you focus on the mathematical parts you're interested in. – Polynomial Nov 27 '12 at 8:55
Thanks for your suggestion. I will consider Stats.SE the next time. But the user D.W. answered one of my questions. He kindly read two papers and didn't complain about it being off-topic, or it being mathematical. – Yasser MZadeh Nov 27 '12 at 10:28
A user giving you an answer doesn't mean it's on-topic. In fact, D.W. was kind enough to give you an answer despite it being off-topic. Future questions about statistical analysis will likely be closed though. – Polynomial Nov 27 '12 at 10:31

1 Answer

up vote 1 down vote accepted

I'd think the next best thing to a simple threshold would be to have some more intelligent resets in your threshold counting. Certainly things like constantly repeating or nonsensical packets should trigger a warning sooner. Out side of that, a lot depends on if you are worried about DoS or DDoS. I don't know that you could do much better than a well defined threshold for simple DoS. DDoS would require actually comparing normal traffic to current traffic and looking for differences in the patterns they fit. That gets far too complicated for an answer here really quickly though looking in to things like Baysian filtering might be another possibility in addition to the wavelet and kalman filtering you mentioned.

share|improve this answer
It seems there are "adaptive threshold algorithm" and "cumulative sum (CUSUM) algorithm" for change point detection used for SYN flooding attacks, here "Application of anomaly detection algorithms for detecting SYN flooding attacks, Vasilios A. Siris, Fotini Papagalou, 2006." – Yasser MZadeh Nov 27 '12 at 8:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.