Detecting network cyber-attacks using an integrated statistical approach

Benamar Bouyeddou, Fouzi Harrou, Benamar Kadri, Ying Sun

Research output: Contribution to journalArticlepeer-review

16 Scopus citations


Anomaly detection in the Internet of Things (IoT) is imperative to improve its reliability and safety. Detecting denial of service (DOS) and distributed DOS (DDOS) is one of the critical security challenges facing network technologies. This paper presents an anomaly detection mechanism using the Kullback–Leibler distance (KLD) to detect DOS and DDOS flooding attacks, including transmission control protocol (TCP) SYN flood, UDP flood, and ICMP-based attacks. This mechanism integrates the desirable properties of KLD, the capacity to quantitatively discriminate between two distributions, with the sensitivity of an exponential smoothing scheme. The primary reason for exponentially smoothing KLD measurements (ES–KLD) is to aggregate all of the information from past and actual samples in the decision rule, making the detector sensitive to small anomalies. Furthermore, a nonparametric approach using kernel density estimation has been used to set a threshold for ES-KLD decision statistic to uncover the presence of attacks. Tests on three publicly available datasets show improved performances of the proposed mechanism in detecting cyber-attacks compared to other conventional monitoring procedures.
Original languageEnglish (US)
JournalCluster Computing
StatePublished - Nov 7 2020

Bibliographical note

KAUST Repository Item: Exported on 2020-11-17


Dive into the research topics of 'Detecting network cyber-attacks using an integrated statistical approach'. Together they form a unique fingerprint.

Cite this