![](bgb.png)
In summary, based on the fractal dimension
histograms in Figure 19 the best separability can be
provided if the aggregated number of destination
addresses (shown in Figure 19 (b)) and the
aggregated number of source ports (shown in Figure
19 (c)) are both monitored. The other signal
parameters provide no additional information and
have generally lower separability of normal network
traffic from attack traffic.
7 CONCLUSIONS
This paper presented an approach to detecting
Distributed Denial of Service attacks using fractal
analysis of the phase space trajectories of the
incoming network traffic. The paper demonstrated
the key differences in behavior of attack traffic and
normal network traffic when analyzed in phase
space. The paper demonstrated the differences in the
characteristics of port and addresses flooding
attacks, and also demonstrated a negative correlation
of the aggregated number of bytes relative to the
aggregated number of ports or addresses referenced.
The paper demonstrates these concepts on actual
network traffic incoming to the University of
Michigan-Flint when it was under a test attack from
the University of Michigan-Ann Arbor.
The results highlighted in the paper demonstrate
there is significant separability between normal
traffic and network traffic when analyzing the
aggregated number of source ports and the
aggregated number of destination addresses. The
paper defined an optimal set of values for the key
parameters related to analyzing these signals in
phase space, namely: (i) the length of the
aggregation window, (ii) the length of the data
analysis window, (iii) the length of low-pass filter,
and (iv) the time lag between samples used to build
the phase space trajectories. These values can be
used to develop an embedded DDOS detection
algorithm in network routers. The paper
demonstrated the efficacy of using the Information
Dimension measure for detecting the changes in the
fractal nature of the phase space trajectories of the
normal and attack traffic. Future work will be
directed at implementing a detection and attack
packet removal algorithm based on the fractal
dimension of the incoming signals and developing
complete Receiver Operating Characteristics (ROC)
curves.
ACKNOWLEDGEMENTS
The authors would like to thank Dr. Stephen Turner,
Anthony Wingett from the Computer Science,
Engineering, and Physics department, and Josh
Weber and the entire University of Michigan-Flint
Information Technology Services organization for
assisting in the data collection process.
REFERENCES
Hu, J. Gao, and N. S. Rao, 2007. Defending against
internet worms using a phase space method from
chaos theory. In SPIE Proceedings # 6570, Data
Mining, Intrusion Detection, Information Assurance,
and Data Networks Security, SPIE.
M. Li, Y-Y Zhang, and W. Zhao, 2008. A practical
method for weak stationarity test of network traffic
with long-range dependence. In Proceedings of the 8th
WSEAS International Conference on Multimedia
Systems and Signal Processing, IEEE.
H. Liangxiu, C. Zhiwei, C. Chunbo, and G. Chuanshan,
2002. A new multifractal network traffic model. In
Chaos, Solitons and Fractals, Elsevier.
M. Masugo, 2002. Multi-fractal analysis of IP-network
traffic based on a hierarchical clustering approach. In
Communications in Nonlinear Science and Numerical
Simulation, Elsevier.
M. Li and W. Zhao, 2008. Detection of variations of local
irregularity of traffic under DDOS flood attack. In
Mathematical Problems in Engineering, Hindawi.
D. Gregg, W. Blackert, D. Heinbuch, and D. Furnanage,
2001. Assessing and quantifying denial of service
attacks. In Proceedings IEEE Military
Communications Conference, IEEE.
M. Li, 2006. Change trend of averaged Hurst parameter of
traffic under DDOS flood attacks. In Computers &
Society.
A. Piskozub, 2002. Denial of service and distributed
denial of service attacks, In Proceedings of
International Conference on Modern Problems of
Radio Engineering, Telecommunications and
Computer Science, IEEE.
Y. Xiang, Y. Lin, W. L. Lei, and S. J. Huang, 2004.
Detecting DDOS attack based on network self-
similarity. In IEE Proc. Communications, IEE.
L. Limwiwatkul and A. Rungsawang, 2004. Distributed
denial of service detection using TCP/IP header and
traffic measurement analysis. In Proc. International
Symposium on Communications and Information
Technologies, IEEE.
A. Mitrokotsa and C. Douligeris, 2005. Detecting denial of
service attacks using emergent self-organizing maps.
In Proc. IEEE International Symposium on Signal
Processing and Information Technology, IEEE.
G. Oke, G. Loukas, and E. Gelenbe, 2007. Detecting
denial of service attacks Bayesian classifiers and
SECRYPT 2011 - International Conference on Security and Cryptography
88