Visual Analysis and Detection of Network Flood Attacks through Two-Layer Density
- Publication Type:
- Conference Proceeding
- Proc. of 3rd IEEE Int. Conference on Computer Science and Network Technology (ICCSNT-13), 2014, pp. 625 - 629
- Issue Date:
Flood attack patterns have variability depending on the network environment. It has been necessitated that the need for visual analysis within an Intrusion Detection System (IDS) is to identify these flood-attack patterns. The challenges are how to increase the accuracy of detection and how to visualize and present flood attack patterns in networks for early detection. In this paper, we propose a Two-Layer density model for flood attack detection. The first density layer describes sending-density and receiving-density in analyzing Internet traffic. The second density layer describes attack-density and normal-density in analyzing local network traffic at a victim site. Several visualization techniques are used to facilitate the detection process. The experiments demonstrate that the Two-Layer density model has significantly improved the accuracy of the detection of flood attacks and provides users with a better understanding of the nature of flood attacks.
Please use this identifier to cite or link to this item: