Detecção de DDoS através da análise da quantificação da recorrência baseada na extração de características dinâmicas e clusterização adaptativa

Abstract

The high number of Distributed Denial of Service (DDoS) attacks has demanded innovative solutions to guarantee the reliability and availability of Internet services. In this sense, different methods have been used to analyze network traffic in search of denial-of-service attacks, such as neural networks, decision trees, principal component analysis and others. However, few of them explore dynamic characteristics to classify network traffic and none explore the adaptive clustering. This work proposes a new method, called TRAFFICbyAQR, which uses Recurrence Quantification Analysis based on the extraction of dynamic characteristics to express traffic behavior. The method is combined with the adaptive clustering algorithm (A-Kmeans) to perform better attack traffic classification. The experiments were done using the CAIDA, UCLA and CTU-13 databases and have demonstrated the good accuracy of the method and the low number of false alarms.