Visual analysis and detection of network flood attacks through Two-Layer density approach

Publication Type:
Conference Proceeding
Proceedings of 2013 3rd International Conference on Computer Science and Network Technology, ICCSNT 2013, 2014, pp. 625 - 629
Issue Date:
Filename Description Size
Thumbnail2013-ICCSNT.pdf Published version667.37 kB
Adobe PDF
Full metadata record
© 2013 IEEE. Flood attack patterns have variability depending on the network environment. It has been necessitated that the need for visual analysis within an Intrusion Detection System (IDS) is to identify these flood-attack patterns. The challenges are how to increase the accuracy of detection and how to visualize and present flood attack patterns in networks for early detection. In this paper, we propose a Two-Layer density model for flood attack detection. The first density layer describes sending-density and receiving-density in analyzing Internet traffic. The second density layer describes attack-density and normal-density in analyzing local network traffic at a victim site. Several visualization techniques are used to facilitate the detection process. The experiments demonstrate that the Two-Layer density model has significantly improved the accuracy of the detection of flood attacks and provides users with a better understanding of the nature of flood attacks.
Please use this identifier to cite or link to this item: