What data should be collected if i want to bind two different DDoS-attacks?

In example i want to build a model, which will calculate the similarity of two DDoS-attacks.

The basic metrics should be:

  • Similar IP`s;
  • Similar attack rate and power;
  • Similar attack type;

Is there any other metrics that can be taken into account?

  • I think you have a chicken/egg problem here. You want to calculate whether 2 things are the same, but to do that you want to measure the things that are the same? But how would you determine what you are looking for? It's either a wording problem or a conceptual problem. I think what you need to do is to look at how existing attacks work and use those characteristics. – schroeder Mar 1 '19 at 12:01
  • How are you defining what is "similar"? When will you be satisfied that you successfully found that 2 things were actually similar? That's going to determine what to look for. For instance, if by "similar" you mean launched by the same attacker? If that's the point of similarity, then none of what you listed would help. – schroeder Mar 1 '19 at 12:02
  • Yes, i want to determine if the two attacks were launched by the same attacker(not in case for the similar person who pays for attack, but in terms of the same botnet that was used for attack). – Giuseppe Baldinini Mar 1 '19 at 13:40
  • Then the only metric that you could possibly use is the list of IPs and hope that the different attacks overlap enough to confidently attribute. If you are looking for a botnet, then you are looking for devices. Device metrics are what you are looking for. Any botnet can execute many different types of attacks with different rates. Also note that the same device can be a part of multiple botnets. – schroeder Mar 1 '19 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.