International Journal of Computer Network and Information Security (IJCNIS)
IJCNIS Vol. 6, No. 9, 8 Aug. 2014
Cover page and Table of Contents: PDF (size: 589KB)
C₂DF: High Rate DDOS filtering method in Cloud Computing
Full Text (PDF, 589KB), PP.43-50
Views: 0 Downloads: 0
Author(s)
Index Terms
Cloud Computing, Cloud Security, Distributed Denial-of-Service (DDOS), Filtering, C2DF
Abstract
Distributed Denial of Service (DDOS) attacks have become one of the main threats in cloud environment. A DDOS attack can make large scale of damages to resources and access of the resources to genuine cloud users. Old-established defending system cannot be easily applied in cloud computing due to their relatively low competence and wide storage. In this paper we offered a data mining and neural network technique, trained to detect and filter DDOS attacks. For the simulation experiments we used KDD Cup dataset and our lab datasets. Our proposed model requires small storage and ability of fast detection. The obtained results indicate that our model has the ability to detect and filter most type of TCP attacks. Detection accuracy was the metric used to evaluate the performance of our proposed model. From the simulation results, it is visible that our algorithms achieve high detection accuracy (97%) with fewer false alarms.
Cite This Paper
Pourya Shamsolmoali, M.Afshar Alam, Ranjit Biswas, "C2DF: High Rate DDOS filtering method in Cloud Computing", International Journal of Computer Network and Information Security(IJCNIS), vol.6, no.9, pp.43-50, 2014. DOI:10.5815/ijcnis.2014.09.06
Reference
[1]M. Armbrust, Michael Armbrust, Armando Fox, Rean Griffith, Anthony D. Joseph, Randy Katz, Andy Konwinski, Gunho Lee, David Patterson, Ariel Rabkin, Ion Stoica, Matei Zaharia. A view of cloud computing. Communication of ACM, 53(4), (2010), pages: 50–58.
[2]Doua, W., Chen, Q., Chen, J. A confidence-based filtering method for DDoS attack defence in cloud environment. Future Generation Computer Systems, 29(7), (2013), pages: 1838–1850.
[3]Lo, Chi-Chun., Huang, Chun-Chieh., Ku, Joy. A Cooperative Intrusion Detection System Framework for Cloud Computing Networks. In proceeding of International Conference on Parallel Processing, (2010), pages: 280-284.
[4]Du, P., Nakao, A. OverCourt: DDoS mitigation through credit-based traffic segregation and path migration. Computer Communications, 33(18), (2010). 2164–2175.
[5]Raj Kumar, P. A., Selvakumar, S. M2KMIX: Identifying the Type of High Rate Flooding Attacks using a Mixture of Expert Systems. International journal of Computer Network and Information Security, 4(1), (2012), pages: 1-16.
[6]Lent, R. Evaluating a migration-based response to DoS attacks in a system of distributed auctions. Computers & Security, 3(1), (2 0 1 2), pages: 327-343.
[7]Chonka, A., Abawajy, J. Detecting and Mitigating HX-DoS attacks against Cloud Web Services. IEEE Conference on Network-Based Information Systems, (2012), pages: 429-434.
[8]Chonka, A., Singh, J., Zhou, W. Chaos Theory Based Detection against Network Mimicking DDOS Attacks. IEEE Communications Letters, 13(9) (2009)pages: 717-719.
[9]Chonka, A. Xiang, Y. Zhou, W. Huang, X. Protecting Cloud Web Services from HX-DoS attacks using Decision Theory. IEEE conference on communications: advanced internet and cloud, (2012) pages 85-91.
[10]Raj Kumar, P. A., Selvakumar, S. Distributed denial of service attack detection using an ensemble of neural classifier. Computer Communications, 34(11), (2011), pages: 1328–1341.
[11]Varalakshmi, P., Thamarai Selvi, S. Thwarting DDoS attacks in grid using information divergence. Future Generation Computer Systems, 29(1), (2013), pages:429–441.
[12]Chonka, A., Xiang, Y., Zhou, W. Alessio Bonti. Cloud security defence to protect cloud computing against HTTP-DOS and XML-DOS attacks. Journal of Network and Computer Applications, 34(4), (2011), pages: 1097-1107.
[13]Walfish, M., Balakrishnan, H., Karger, D., Shenker, S. Dos: fighting fire with fire. ACM Workshop on Hot Topics in Networks (HotNets), (2005).
[14]Specht, S. M., Lee, R. B. Distributed Denial of Service: Taxonomies of Attacks, Tools, and Countermeasures. IN Proceedings of the International Workshop on Security in Parallel and Distributed System, (2004), pages: 543–550.
[15]Raj Kumar, P. A., Selvakumar, S. Detection of distributed denial of service attacks using an ensemble of adaptive and hybrid neuro-fuzzy systems, Computer Communications, 36(3), (2013), pages: 303–319.
[16]Raj Kumar, P. A., Selvakumar, S. M2KMIX: Identifying the Type of High Rate Flooding Attacks using a Mixture of Expert Systems. International journal of Computer Network and Information Security, 4(1), (2012), pages: 1-16.
[17]Mirkovic, J., Reiher, P. Taxonomy of DDoS attack and DDoS Defence Mechanisms, ACM SIGCOMM Computer Communication Review, 34(2), (2004), pages: 39–53.
[18]Varalakshmi, P., Thamarai Selvi, S., Javed Ashraf, A., Karthick, K. B-tree based trust model for resource selection in grid. In proceeding of Signal Processing Communications and Networking, (2007), Pages: 222–227.
[19]Kim, S., Narasimha Reddy, A.L. Statistical techniques for detecting traffic anomalies through packet header data, IEEE/ACM Transactions on Networking, 16(3), (2008), pages: 562–575.
[20]Modi, C., Patel, D., Borisaniya, B., Patel H., Patel, A., Rajarajan, M. A survey of intrusion detection techniques
in Cloud. Journal of Network and Computer Applications, 6(1), (2013), pages: 42–57.
[21]Li, M., Li, M. An Adaptive Approach for Defending against DDoS Attacks. Mathematical Problems in Engineering, (2010).
[22]Lu, K., Wu, D., Fan, J., Todorovic, S., Antonio Nucci. Robust and efficient detection of DDoS attacks for large-scale internet. International Journal of Computer and Telecommunications Networking, 51(18), (2007), pages: 5036–5056.
[23]Kim, W., Jeong, Ok-Ran, Kim, C., So, J. The dark side of the Internet: Attacks, costs and responses. Information Systems, 36(3), (2011), pages: 675–705.
[24]Netwag Tool, http://ntwag.sourceforge.net/.
[25]Khorshed,Md.T., Shawkat Ali, A. B. M., Wasimi, S. A. A survey on gaps, threat remediation challenges and some thoughts for proactive attack detection in cloud computing. Future Generation Computer Systems, 6(28), (2012), pages: 833-851.
[26]Frank, E., Witten, I.H. Generating accurate rule sets without global optimization. In Proceedings of International Conference on Machine Learning, (1998), pages: 144-151.
[27]Platt, J.C. Fast training of support vector machines using sequential minimal optimization. Advances in kernel methods, MIT Press (1999), pages: 185 – 208.
[28]Quinlan, J.R. Book review: C4. 5 Programs for Machine Learning, 16(3), (1994), pages: 235-240.
[29]Lopez, R., Onate, E. A variational formulation for the multilayer perceptron. Lecture Notes in Computer Science, In proceeding of Artificial Neural Networks, 4131, (2006), pages: 159–168.
[30]Bauer, E., Kohavi, R. An Empirical Comparison of Voting Classification Algorithms: Bagging, Boosting, and Variants. Machine learning, 36, (1999), pages: 105-139.