یک رویکرد عملی برای تشخیص حملات محروم سازی از سرویس توزیع شده
ترجمه نشده

یک رویکرد عملی برای تشخیص حملات محروم سازی از سرویس توزیع شده

عنوان فارسی مقاله: یک رویکرد عملی برای تشخیص حملات محروم سازی از سرویس توزیع شده با استفاده از یک روش تشخیص ترکیبی
عنوان انگلیسی مقاله: A practical approach to detection of distributed denial-of-service attacks using a hybrid detection method
مجله/کنفرانس: کامپیوتر و مهندسی برق - Computers & Electrical Engineering
رشته های تحصیلی مرتبط: مهندسی کامپیوتر
گرایش های تحصیلی مرتبط: امنیت اطلاعات، مهندسی نرم افزار، برنامه نویسی کامپیوتر
کلمات کلیدی فارسی: امنیت شبکه، حمله محروم سازی از سرویس، ميانگين موزون متحرك نمايي ، CUSUM، آنتروپی Packet
کلمات کلیدی انگلیسی: Network security، Denial of service attack، Exponential weighted moving average، CUSUM، Packet entropy
نوع نگارش مقاله: مقاله پژوهشی (Research Article)
نمایه: Scopus - Master Journal List - JCR
شناسه دیجیتال (DOI): https://doi.org/10.1016/j.compeleceng.2018.11.004
دانشگاه: School of Computing University Union Belgrade, 6/6 Knez Mihailova, Belgrade, Serbia
ناشر: الزویر - Elsevier
نوع ارائه مقاله: ژورنال
نوع مقاله: ISI
سال انتشار مقاله: 2019
ایمپکت فاکتور: 2/762 در سال 2018
شاخص H_index: 49 در سال 2019
شاخص SJR: 0/443 در سال 2018
شناسه ISSN: 0045-7906
شاخص Quartile (چارک): Q2 در سال 2018
فرمت مقاله انگلیسی: PDF
تعداد صفحات مقاله انگلیسی: 13
وضعیت ترجمه: ترجمه نشده است
قیمت مقاله انگلیسی: رایگان
آیا این مقاله بیس است: خیر
کد محصول: E11297
فهرست انگلیسی مطالب

Abstract


1- Introduction


2- Related work


3- The proposed detection method


4- Test scenario


5- Discussion of results


6- Conclusion


References

نمونه متن انگلیسی مقاله

Abstract


This paper presents a hybrid method for the detection of distributed denial-of-service (DDoS) attacks that combines feature-based and volume-based detection. Our approach is based on an exponential moving average algorithm for decision-making, applied to both entropy and packet number time series. The approach has been tested by performing a controlled DDoS experiment in a real academic network. The network setup and test scenarios including both high-rate and low-rate attacks are described in the paper. The performance of the proposed method is compared to the performance of two methods that are already known in the literature. One is based on the counting of SYN packets and is used for detection of SYN flood attacks, while the other is based on a CUSUM algorithm applied to the entropy time series. The results show the advantage of our approach compared to methods that are based on either entropy or number of packets only.


Introduction


Modern technological society is greatly dependent on Internet technology and online services. Internet services have ecome a non-exclusive part of everyday routine. Many of us check our e-mail as the first thing we do in the morning. This kind of service dependence has made room for a new kind of manipulation and has introduced attacks on network services. Denial of Service (DoS) attacks are among these attacks. Their goal is to make a targeted service unavailable by overloading service provider resources with false requests. With resources depleted, the service provider is not able to serve legitimate users. Nowadays, DoS is a commonly-used attacking method which inflicts significant financial loss on its targets [1]. According to [2,3] there are different types of DoS attacks. At the application level, attack detection is usually done by pattern recognition in the content of received packets. When a malicious pattern is detected, DoS prevention is achieved by blacklisting the IP address of the sender. To bypass this protection and to increase the efficiency of such attacks, attackers usually use distributed attacks (DDoS) by sending malicious packets from different source IP addresses, computers, networks or even continents. At present, detection of application-based attacks is very inefficient as a large number of packets has to be deeply inspected to recognize an attack pattern. We are tackling this problem at a much lower, network (or in some cases transport) layer, where deep packet analysis is not required.

  • اشتراک گذاری در

دیدگاه خود را بنویسید:

تاکنون دیدگاهی برای این نوشته ارسال نشده است

یک رویکرد عملی برای تشخیص حملات محروم سازی از سرویس توزیع شده
نوشته های مرتبط
مقالات جدید
لوگوی رسانه های برخط

logo-samandehi

پیوندها