Skip to main content

Advertisement

Springer Nature Link
Log in

A statistical class center based triangle area vector method for detection of denial of service attacks

  • Published:
Cluster Computing Aims and scope Submit manuscript

Abstract

Denial of service (DoS) attack is the menace to private cloud computing environment that denies services provided by cloud servers leading to huge business losses. Efficient DoS attack detection mechanisms are demanded which necessitates the extraction of features for its best performance. The lacuna in the existing feature extraction based detection systems is the sensitiveness of initial cluster center which leads to high false alarm rate and low accuracy. In this paper, this issue is addressed by proposing a class center based triangle area vector (CCTAV) method which computes the mean of target classes individually and extracts the correlation between features. Mahalanobis distance measure is used for profile construction and DoS attacks detection. The proposed CCTAV method is tested with five publicly available datasets and compared with existing methods. It is noticed that the proposed statistical method reduces the complexity of feature extraction and enhances the attack detection process. The proposed approach is evaluated by conducting tenfold cross validation to compute 95% confidence interval. It is evident that the accuracy obtained for all the datasets are within the confidence interval. Further, the proposed CCTAV method provides significant results compared to the state-of-the-art attack detection methods.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Subscribe and save

Springer+ Basic
€32.70 /Month
  • Get 10 units per month
  • Download Article/Chapter or eBook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Price includes VAT (France)

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6
Fig. 7

Similar content being viewed by others

References

  1. Somani, G., Gaur, M.S., Sanghi, D., Conti, M., Buyya, R.: Ddos attacks in cloud computing: issues, taxonomy, and future directions. Comput. Commun. 107, 30 (2017). https://doi.org/10.1016/j.comcom.2017.03.010

    Article  Google Scholar 

  2. Velliangiri, S., Premalatha, J.: Intrusion detection of distributed denial of service attacks in cloud. Cluster Comput. (2017). https://doi.org/10.1007/s10586-017-1149-0

    Article  Google Scholar 

  3. Yu, S., Tian, Y., Guo, S., Wu, D.O.: Can we beat ddos attacks in clouds? IEEE Trans. Parallel Distrib. Syst. 25(9), 2245 (2014). https://doi.org/10.1109/TPDS.2013.181

    Article  Google Scholar 

  4. Iot is a new backdoor for ddos attacks. https://www.grtcorp.com (2018).

  5. P. Kasinathan, C. Pastrone, M.A. Spirito, M. Vinkovits, Denial of service detection in 6LoWPAN based Internet of things. In: 2013 IEEE 9th international conference on wireless and mobile computing, networking and communications (WiMob) (IEEE, 2013), pp. 600–607.

  6. Akamai [State of the Internet]/Security q3 2017 Report. https://www.prnewswire.com (2017)

  7. Hoque, N., Bhuyan, M.H., Baishya, R.C., Bhattacharyya, D.K., Kalita, J.K.: Network attacks: taxonomy, tools and systems. J. Netw. Comput. Appl. 40, 307 (2014). https://doi.org/10.1016/j.jnca.2013.08.001

    Article  Google Scholar 

  8. Tan, Z., Jamdagni, A., He, X., Nanda, P., Liu, R.P.: A system for denial-of-service attack detection based on multivariate correlation analysis. IEEE Trans. Parallel Distrib. Syst. 25(2), 447 (2014). https://doi.org/10.1109/TPDS.2013.146

    Article  Google Scholar 

  9. Derhab, A., Bouras, A.: Multivariate correlation analysis and geometric linear similarity for real-time intrusion detection systems. Secur. Commun. Netw. 8(7), 1193 (2015). https://doi.org/10.1002/sec.1074

    Article  Google Scholar 

  10. Weller-Fahy, D.J., Borghetti, B.J., Sodemann, A.A.: A survey of distance and similarity measures used within network intrusion anomaly detection. IEEE Commun. Surv. Tutor. 17(1), 70 (2015). https://doi.org/10.1109/COMST.2014.2336610

    Article  Google Scholar 

  11. Buczak, A.L., Guven, E.: A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Commun. Surv. Tutor. 18(2), 1153 (2016). https://doi.org/10.1109/COMST.2015.2494502

    Article  Google Scholar 

  12. Prasad, K.M., Reddy, A.R.M., Rao, K.V.: Defad: ensemble classifier for ddos enabled flood attack defense in distributed network environment. Cluster Comput. 21(4), 1765 (2018). https://doi.org/10.1007/s10586-018-2808-5

    Article  Google Scholar 

  13. Taheri, R., Javidan, R., Shojafar, M., Conti, M., et al.: Can machine learning model with static features be fooled: an adversarial machine learning approach. Cluster Comput. (2020). https://doi.org/10.1007/s10586-020-03083-5

    Article  Google Scholar 

  14. Doriguzzi-Corin, R., Millar, S., Scott-Hayward, S., Martinez-del Rincon, J., Siracusa, D.: Lucid: a practical, lightweight deep learning solution for ddos attack detection. IEEE Trans. Netw. Serv. Manage. (2020). https://doi.org/10.1109/TNSM.2020.2971776

    Article  Google Scholar 

  15. Tsai, C.F., Lin, C.Y.: A triangle area based nearest neighbors approach to intrusion detection. Pattern Recogn. 43(1), 222 (2010). https://doi.org/10.1016/j.patcog.2009.05.017

    Article  MATH  Google Scholar 

  16. Lin, W.C., Ke, S.W., Tsai, C.F.: Cann: an intrusion detection system based on combining cluster centers and nearest neighbors. Knowl. Based Syst. 78, 13 (2015). https://doi.org/10.1016/j.knosys.2015.01.009

    Article  Google Scholar 

  17. Moustafa, M., Slay, J., Creech, G.: Novel geometric area analysis technique for anomaly detection using trapezoidal area estimation on large-scale networks. IEEE Trans. Big Data (2017). https://doi.org/10.1109/TBDATA.2017.2715166

    Article  Google Scholar 

  18. Bhuyan, M.H., Bhattacharyya, D.K., Kalita, J.K.: Network anomaly detection: methods, systems and tools. IEEE Commun. Surv. Tutor. 16(1), 303 (2014). https://doi.org/10.1109/SURV.2013.052213.00046

    Article  Google Scholar 

  19. Zlomislic, V., Fertalj, K., Sruk, V.: Denial of service attacks, defences and research challenges. Cluster Comput. 20(1), 661 (2017). https://doi.org/10.1007/s10586-017-0730-x

    Article  Google Scholar 

  20. Zargar, S.T., Joshi, J., Tipper, D.: A survey of defense mechanisms against distributed denial of service (ddos) flooding attacks. IEEE Commun. Surv. Tutor. 15(4), 2046 (2013). https://doi.org/10.1109/SURV.2013.031413.00127

    Article  Google Scholar 

  21. Somani, G., Gaur, M.S., Sanghi, D., Conti, M.: Ddos attacks in cloud computing: collateral damage to non-targets. Comput. Netw. 109, 157 (2016). https://doi.org/10.1016/j.comnet.2016.03.022

    Article  Google Scholar 

  22. Yan, Q., Yu, F.R., Gong, Q., Li, J.: Software-defined networking (sdn) and distributed denial of service (ddos) attacks in cloud computing environments: a survey, some research issues, and challenges. IEEE Commun. Surv. Tutor. 18(1), 602 (2016). https://doi.org/10.1109/COMST.2015.2487361

    Article  Google Scholar 

  23. Bharot, N., Verma, P., Sharma, S., Suraparaju, V.: Distributed denial-of-service attack detection and mitigation using feature selection and intensive care request processing unit. Arab. J. Sci. Eng. 43(2), 959 (2018). https://doi.org/10.1007/s13369-017-2844-0

    Article  Google Scholar 

  24. M. Tavallaee, E. Bagheri, W. Lu, A.A. Ghorbani: A detailed analysis of the KDD Cup 99 dataset. In Computational Intelligence for Security and Defense Applications, 2009. CISDA 2009. IEEE Symposium on (IEEE, 2009), pp. 53–58. 10.1109/CISDA.2009.5356528

  25. Iglesias, F., Zseby, T.: Analysis of network traffic features for anomaly detection. Mach. Learn. 101(13), 59 (2015). https://doi.org/10.1007/s10994-014-5473-9

    Article  MathSciNet  Google Scholar 

  26. Moustafa, N., Slay, J.: The evaluation of network anomaly detection systems: statistical analysis of the unsw-nb15 data set and the comparison with the kdd99 data set. Inf. Secur. J. 25(13), 18 (2016). https://doi.org/10.1080/19393555.2015.1125974

    Article  Google Scholar 

  27. Cicids 2017. https://www.unb.ca/cic/datasets/ids-2017.html (2017)

  28. Cse-cic-ids 2018. https://www.unb.ca/cic/datasets/ids-2018.html (2018)

  29. Tan, Z., Jamdagni, A., He, X., Nanda, P., Liu, R.P., Hu, J.: Detection of denial-of-service attacks based on computer vision techniques. IEEE Trans. Comput. 64(9), 2519 (2015). https://doi.org/10.1109/TC.2014.2375218

    Article  MathSciNet  MATH  Google Scholar 

  30. Celebi, M.E., Kingravi, H.A., Vela, P.A.: A comparative study of efficient initialization methods for the k-means clustering algorithm. Expert Syst. Appl. 40(1), 200 (2013). https://doi.org/10.1016/j.eswa.2012.07.021

    Article  Google Scholar 

  31. Guo, C., Zhou, Y., Ping, Y., Zhang, Z., Liu, G., Yang, Y.: A distance sum-based hybrid method for intrusion detection. Appl. Intell. 40(1), 178 (2014). https://doi.org/10.1007/s10489-013-0452-6

    Article  Google Scholar 

  32. Jin, S., Yeung, D.S., Wang, X.: Network intrusion detection in covariance feature space. Pattern Recogn. 40(8), 2185 (2007). https://doi.org/10.1016/j.patcog.2006.12.010

    Article  MATH  Google Scholar 

  33. Deza, M.M., Deza, E.: Encyclopedia of Distances, pp. 1–583. Springer, New York (2009)

    Book  Google Scholar 

  34. H.H. Chang, M.C. Lee, N. Chen, C.L. Chien, W.J. Lee: Feature extraction based Hellinger distance algorithm for non-intrusive aging load identification in residential buildings. In: Industry Applications Society Annual Meeting, 2015 IEEE (IEEE, 2015), pp. 1–8. 10.1109/IAS.2015.7356778

  35. Z. Tan, A. Jamdagni, X. He, P. Nanda, R.P. Liu: Multivariate correlation analysis technique based on Euclidean distance map for network traffic characterization. In: International Conference on Information and Communications Security (Springer, 2011), pp. 388–398

  36. Jamdagni, A., Tan, Z., He, X., Nanda, P., Liu, R.P.: Repids: a multi tier real-time payload-based intrusion detection system. Comput. Netw. 57(3), 811 (2013). https://doi.org/10.1016/j.comnet.2012.10.002

    Article  Google Scholar 

  37. Han, J., Pei, J., Kamber, M.: Data Mining: Concepts and Techniques. Elsevier, Amsterdam (2011)

    MATH  Google Scholar 

  38. I. Sharafaldin, A.H. Lashkari, A.A. Ghorbani: Toward generating a new intrusion detection dataset and intrusion traffic characterization. In ICISSP (2018), pp. 108–116

  39. Cormen, T.H., Leiserson, C.E., Rivest, R.L., Stein, C.: Introduction to Algorithms. MIT Press, Cambridge (2009)

    MATH  Google Scholar 

  40. A. Javaid, Q. Niyaz, W. Sun, M. Alam: A deep learning approach for network intrusion detection system. In Proceedings of the 9th EAI International Conference on Bio-inspired Information and Communications Technologies (formerly BIONETICS) (2016), pp. 21–26

  41. Benmessahel, I., Xie, K., Chellal, M.: A new evolutionary neural networks based on intrusion detection systems using multiverse optimization. Appl. Intell. 48(8), 2315 (2018). https://doi.org/10.1007/s10489-017-1085-y

    Article  Google Scholar 

  42. Idhammad, M., Afdel, K., Belouch, M.: Semi-supervised machine learning approach for ddos detection. Appl. Intell. 48(10), 3193 (2018). https://doi.org/10.1007/s10489-018-1141-2

    Article  Google Scholar 

  43. Ng, B.A., Selvakumar, S.: Deep radial intelligence with cumulative incarnation approach for detecting denial of service attacks. Neurocomputing 340, 294 (2019). https://doi.org/10.1016/j.neucom.2019.02.047

    Article  Google Scholar 

  44. Kdd cup features. https://www.aldapa.eus/res/README.pdf

Download references

Author information

Authors and Affiliations

  1. Department of Computer Science and Engineering, National Institute of Technology, Tiruchirappalli, Tamil Nadu, 620 015, India

    N. G. Bhuvaneswari Amma

  2. Department of Computer Science and Engineering, National Institute of Technology, Tiruchirappalli and Indian Institute of Information Technology, Una, Himachal Pradesh, 177 005, India

    S. Selvakumar

Authors
  1. N. G. Bhuvaneswari Amma
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. S. Selvakumar
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to N. G. Bhuvaneswari Amma.

Additional information

Publisher's Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Appendices

Appendix

Illustration of proposed method

Table 7 Features used for Illustration
Full size table
Table 8 Sample data
Full size table

This section illustrates the proposed method. For illustrative purpose, only six features as tabulated in Table 7 [44] have been used. The sample data used for illustration is tabulated in Table 8. \(R1\) to \(R13\) represent the records, \(F1\) to \(F6\) represent the features, and Class denotes the target classes. The first step is to compute the CCs for the five classes of the sample data. The CCs for the five classes are computed and tabulated in Table 9. \({C}_{1}\), \({C}_{2}\), \({C}_{3}\), \({C}_{4}\), and \({C}_{5}\) are the CCs for the target classes such as Normal, Back, Neptune, Smurf, and Teardrop respectively. Once the CCs are known, then the TAV for each record is computed. The TAV is a vector that consists of 10 triangle areas. The TAV of record, \({R}_{1}\) is shown as follows:\(\left[{R}_{1}{C}_{1}{C}_{2}, {R}_{1}{C}_{1}{C}_{3},{R}_{1}{C}_{1}{C}_{4}, {R}_{1}{C}_{1}{C}_{5}, {R}_{1}{C}_{2}{C}_{3},{R}_{1}{C}_{2}{C}_{4}, {R}_{1}{C}_{2}{C}_{5},{R}_{1}{C}_{3}{C}_{4}, {R}_{1}{C}_{3}{C}_{5},{R}_{1}{C}_{4}{C}_{5}\right].\)

Table 9 Class centers
Full size table
Table 10 Triangle points of \({R}_{1}{C}_{1}{C}_{2}\)
Full size table
Table 11 Threshold computation
Full size table
Table 12 Test cases
Full size table
Table 13 Normalized values of test cases
Full size table
Fig. 8
figure 8

Triangle \({R}_{1}{C}_{1}{C}_{2}\)

Full size image
Fig. 9
figure 9

TAV of record, \({R}_{1}\)

Full size image
Fig. 10
figure 10

Mean TAV of normal records

Full size image
Fig. 11
figure 11

TAV of test case 1

Full size image
Fig. 12
figure 12

TAV of test case 2

Full size image

The first triangle area of record, \({R}_{1}\) as depicted in Fig. 8, i.e., \({R}_{1}{C}_{1}{C}_{2}\) is computed. The triangle points of \({R}_{1}{C}_{1}{C}_{2}\), i.e., \({R}_{1}\), \({C}_{1}\), and \({C}_{2}\) are tabulated in Table 10. The points \(\left({C}_{1}, {C}_{2}\right)\), \(\left({C}_{2}, {R}_{1}\right)\), and \(\left({C}_{1}, {R}_{1}\right)\) are for the sides of the triangle \({S}_{1}\), \({S}_{2}\), and \({S}_{3}\) respectively. The values obtained for three sides of the triangle \({S}_{1}\), \({S}_{2}\), and \({S}_{3}\) are 1.3173, 1.4119, and 0.1374 respectively. The perimeter of the triangle is 2.8666, the semi-perimeter of the triangle is 1.4333, and the triangle area obtained for \({R}_{1}{C}_{1}{C}_{2}\) is 0.0679. Similarly, the three sides of the triangle, perimeter of the triangle, semi-perimeter of the triangle, and the triangle area are obtained for the other 9 triangles. Then, the obtained TAV of \({R}_{1}\) is as follows: [0.0679 0.1025 1.1674 0.0952 1.1473 1.3352 0.0825 0.8647 0.3782 1.0170], which is shown in Fig. 9.

The mean of TAVs of normal traffic is computed and shown in Fig. 10. The profile is generated for detection using the mean TAV of normal records. The generated profile comprises of computed mean, -4.0175 × 108 and the standard deviation, 8.9723 × 108. The threshold, \(Thresh\) for the sample data is computed using the generated profile and tabulated in Table 11 for both the positive range and negative range. The computed profile is tested with two test cases and the test cases are tabulated in Table 12. The values of the test cases are normalized using min–max normalization and the normalized values of the test cases are shown in Table 13. The TAV of test case1 and test case2 are shown in Figs. 11 and 12 respectively. The MahD between TAV of test case1 and mean TAV of normal records is 1.1291 × 104 which lies within the \(Thresh\) and hence it is detected as \(Normal\). The MahD between TAV of test case2 and mean TAV of normal records is -3.9192 × 109–1.9073 × 10−6i which lies beyond the \(Thresh\) and hence it is detected as \(Attack\).

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Bhuvaneswari Amma, N.G., Selvakumar, S. A statistical class center based triangle area vector method for detection of denial of service attacks. Cluster Comput 24, 393–415 (2021). https://doi.org/10.1007/s10586-020-03120-3

Download citation

  • Received:

  • Revised:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s10586-020-03120-3

Keywords

Search

Navigation