Visual Analysis and Detection of Network Flood Attacks through Two-Layer Density

Publisher:
IEEE
Publication Type:
Conference Proceeding
Citation:
Proc. of 3rd IEEE Int. Conference on Computer Science and Network Technology (ICCSNT-13), 2014, pp. 625 - 629
Issue Date:
2014-12-01
Full metadata record
Files in This Item:
Filename Description Size
Thumbnail2013-ICCSNT.pdf Published version667.37 kB
Adobe PDF
Flood attack patterns have variability depending on the network environment. It has been necessitated that the need for visual analysis within an Intrusion Detection System (IDS) is to identify these flood-attack patterns. The challenges are how to increase the accuracy of detection and how to visualize and present flood attack patterns in networks for early detection. In this paper, we propose a Two-Layer density model for flood attack detection. The first density layer describes sending-density and receiving-density in analyzing Internet traffic. The second density layer describes attack-density and normal-density in analyzing local network traffic at a victim site. Several visualization techniques are used to facilitate the detection process. The experiments demonstrate that the Two-Layer density model has significantly improved the accuracy of the detection of flood attacks and provides users with a better understanding of the nature of flood attacks.
Please use this identifier to cite or link to this item: