A cascade architecture for DoS attacks detection based on the wavelet transform

Article type: Research Article

Authors: Dainotti, Alberto^{; *} | Pescapé, Antonio | Ventre, Giorgio

Affiliations: University of Napoli “Federico II”, Napoli, Italy. E-mails: alberto@unina.it, pescape@unina.it, giorgio@unina.it

Correspondence: [*] Corresponding author: Alberto Dainotti, University of Napoli “Federico II”, Via Claudio 21, 80125 Napoli, Italy. Tel.: +39 081 7683821; Fax: +39 081 7683816; E-mail: alberto@unina.it.

Abstract: In this paper we propose an automated system able to detect volume-based anomalies in network traffic caused by Denial of Service (DoS) attacks. We designed a system with a two-stage architecture that combines more traditional change point detection approaches (Adaptive Threshold and Cumulative Sum) with a novel one based on the Continuous Wavelet Transform. The presented anomaly detection system is able to achieve good results in terms of the trade-off between correct detections and false alarms, estimation of anomaly duration, and ability to distinguish between subsequent anomalies. We test our system using a set of publicly available attack-free traffic traces to which we superimpose anomaly profiles obtained both as time series of known common behaviors and by generating traffic with real tools for DoS attacks. Extensive test results show how the proposed system accurately detects a wide range of DoS anomalies and how the performance indicators are affected by anomalies characteristics (i.e. amplitude and duration). Moreover, we separately consider and evaluate some special test-cases.

Keywords: Anomaly, detection, attack, wavelet

DOI: 10.3233/JCS-2009-0350

Journal: Journal of Computer Security, vol. 17, no. 6, pp. 945-968, 2009