Source-Side Detection of DRDoS Attack Request with Traffic-Aware Adaptive Threshold

Sinh-Ngoc NGUYEN
Van-Quyet NGUYEN
Giang-Truong NGUYEN
JeongNyeo KIM
Kyungbaek KIM

IEICE TRANSACTIONS on Information and Systems   Vol.E101-D    No.6    pp.1686-1690
Publication Date: 2018/06/01
Publicized: 2018/03/12
Online ISSN: 1745-1361
DOI: 10.1587/transinf.2018EDL8020
Type of Manuscript: LETTER
Category: Information Network
DRDoS request detection,  source-side detection,  software defined network,  traffic-aware adaptive threshold,  

Full Text: PDF>>
Buy this Article

Distributed Reflective Denial of Services (DRDoS) attacks have gained huge popularity and become a major factor in a number of massive cyber-attacks. Usually, the attackers launch this kind of attack with small volume of requests to generate a large volume of attack traffic aiming at the victim by using IP spoofing from legitimate hosts. There have been several approaches, such as static threshold based approach and confirmation-based approach, focusing on DRDoS attack detection at victim's side. However, these approaches have significant disadvantages: (1) they are only passive defences after the attack and (2) it is hard to trace back the attackers. To address this problem, considerable attention has been paid to the study of detecting DRDoS attack at source side. Because the existing proposals following this direction are supposed to be ineffective to deal with small volume of attack traffic, there is still a room for improvement. In this paper, we propose a novel method to detect DRDoS attack request traffic on SDN(Software Defined Network)-enabled gateways in the source side of attack traffic. Our method adjusts the sampling rate and provides a traffic-aware adaptive threshold along with the margin based on analysing observed traffic behind gateways. Experimental results show that the proposed method is a promising solution to detect DRDoS attack request in the source side.