Detection of smurf flooding attacks using Kullback-Leibler-based scheme

Benamar Bouyeddou; Fouzi Harrou; Ying Sun; Benamar Kadri

doi:10.1109/CATA.2018.8398647

Detection of smurf flooding attacks using Kullback-Leibler-based scheme

Benamar Bouyeddou^*, Fouzi Harrou, Ying Sun, Benamar Kadri

^*Corresponding author for this work

Computer, Electrical and Mathematical Sciences and Engineering

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

21 Scopus citations

Abstract

Reliable and timely detection of cyber attacks become indispensable to protect networks and systems. Internet control message protocol (ICMP) flood attacks are still one of the most challenging threats in both IPv4 and IPv6 networks. This paper proposed an approach based on Kullback-Leibler divergence (KLD) to detect ICMP-based Denial Of service (DOS) and Distributed Denial Of Service (DDOS) flooding attacks. This is motivated by the high capacity of KLD to quantitatively discriminate between two distributions. Here, the three-sigma rule is applied to the KLD distances for anomaly detection. We evaluated the effectiveness of this scheme by using the 1999 DARPA Intrusion Detection Evaluation Datasets.

Original language	English (US)
Title of host publication	2018 4th International Conference on Computer and Technology Applications, ICCTA 2018
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	11-15
Number of pages	5
ISBN (Electronic)	9781538669952
DOIs	https://doi.org/10.1109/CATA.2018.8398647
State	Published - Jun 27 2018
Event	4th International Conference on Computer and Technology Applications, ICCTA 2018 - Istanbul, Turkey Duration: May 3 2018 → May 5 2018

Publication series

Name	2018 4th International Conference on Computer and Technology Applications, ICCTA 2018

Conference

Conference	4th International Conference on Computer and Technology Applications, ICCTA 2018
Country/Territory	Turkey
City	Istanbul
Period	05/3/18 → 05/5/18

Bibliographical note

Publisher Copyright:
© 2018 IEEE.

Keywords

DARPA99 dataset
ICMP flood
KL distance
anomaly detection
cyber-attack

ASJC Scopus subject areas

Artificial Intelligence
Computer Networks and Communications
Computer Science Applications
Software

Access to Document

10.1109/CATA.2018.8398647

Cite this

Bouyeddou, B., Harrou, F., Sun, Y., & Kadri, B. (2018). Detection of smurf flooding attacks using Kullback-Leibler-based scheme. In 2018 4th International Conference on Computer and Technology Applications, ICCTA 2018 (pp. 11-15). (2018 4th International Conference on Computer and Technology Applications, ICCTA 2018). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/CATA.2018.8398647

Bouyeddou, Benamar ; Harrou, Fouzi ; Sun, Ying et al. / Detection of smurf flooding attacks using Kullback-Leibler-based scheme. 2018 4th International Conference on Computer and Technology Applications, ICCTA 2018. Institute of Electrical and Electronics Engineers Inc., 2018. pp. 11-15 (2018 4th International Conference on Computer and Technology Applications, ICCTA 2018).

@inproceedings{683986b356c1443291c3a9186e6c628c,

title = "Detection of smurf flooding attacks using Kullback-Leibler-based scheme",

abstract = "Reliable and timely detection of cyber attacks become indispensable to protect networks and systems. Internet control message protocol (ICMP) flood attacks are still one of the most challenging threats in both IPv4 and IPv6 networks. This paper proposed an approach based on Kullback-Leibler divergence (KLD) to detect ICMP-based Denial Of service (DOS) and Distributed Denial Of Service (DDOS) flooding attacks. This is motivated by the high capacity of KLD to quantitatively discriminate between two distributions. Here, the three-sigma rule is applied to the KLD distances for anomaly detection. We evaluated the effectiveness of this scheme by using the 1999 DARPA Intrusion Detection Evaluation Datasets.",

keywords = "DARPA99 dataset, ICMP flood, KL distance, anomaly detection, cyber-attack",

author = "Benamar Bouyeddou and Fouzi Harrou and Ying Sun and Benamar Kadri",

note = "Publisher Copyright: {\textcopyright} 2018 IEEE.; 4th International Conference on Computer and Technology Applications, ICCTA 2018 ; Conference date: 03-05-2018 Through 05-05-2018",

year = "2018",

month = jun,

day = "27",

doi = "10.1109/CATA.2018.8398647",

language = "English (US)",

series = "2018 4th International Conference on Computer and Technology Applications, ICCTA 2018",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "11--15",

booktitle = "2018 4th International Conference on Computer and Technology Applications, ICCTA 2018",

address = "United States",

}

Bouyeddou, B, Harrou, F , Sun, Y & Kadri, B 2018, Detection of smurf flooding attacks using Kullback-Leibler-based scheme. in 2018 4th International Conference on Computer and Technology Applications, ICCTA 2018. 2018 4th International Conference on Computer and Technology Applications, ICCTA 2018, Institute of Electrical and Electronics Engineers Inc., pp. 11-15, 4th International Conference on Computer and Technology Applications, ICCTA 2018, Istanbul, Turkey, 05/3/18. https://doi.org/10.1109/CATA.2018.8398647

Detection of smurf flooding attacks using Kullback-Leibler-based scheme. / Bouyeddou, Benamar; Harrou, Fouzi ; Sun, Ying et al.
2018 4th International Conference on Computer and Technology Applications, ICCTA 2018. Institute of Electrical and Electronics Engineers Inc., 2018. p. 11-15 (2018 4th International Conference on Computer and Technology Applications, ICCTA 2018).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Detection of smurf flooding attacks using Kullback-Leibler-based scheme

AU - Bouyeddou, Benamar

AU - Harrou, Fouzi

AU - Sun, Ying

AU - Kadri, Benamar

PY - 2018/6/27

Y1 - 2018/6/27

N2 - Reliable and timely detection of cyber attacks become indispensable to protect networks and systems. Internet control message protocol (ICMP) flood attacks are still one of the most challenging threats in both IPv4 and IPv6 networks. This paper proposed an approach based on Kullback-Leibler divergence (KLD) to detect ICMP-based Denial Of service (DOS) and Distributed Denial Of Service (DDOS) flooding attacks. This is motivated by the high capacity of KLD to quantitatively discriminate between two distributions. Here, the three-sigma rule is applied to the KLD distances for anomaly detection. We evaluated the effectiveness of this scheme by using the 1999 DARPA Intrusion Detection Evaluation Datasets.

AB - Reliable and timely detection of cyber attacks become indispensable to protect networks and systems. Internet control message protocol (ICMP) flood attacks are still one of the most challenging threats in both IPv4 and IPv6 networks. This paper proposed an approach based on Kullback-Leibler divergence (KLD) to detect ICMP-based Denial Of service (DOS) and Distributed Denial Of Service (DDOS) flooding attacks. This is motivated by the high capacity of KLD to quantitatively discriminate between two distributions. Here, the three-sigma rule is applied to the KLD distances for anomaly detection. We evaluated the effectiveness of this scheme by using the 1999 DARPA Intrusion Detection Evaluation Datasets.

KW - DARPA99 dataset

KW - ICMP flood

KW - KL distance

KW - anomaly detection

KW - cyber-attack

UR - http://www.scopus.com/inward/record.url?scp=85050192647&partnerID=8YFLogxK

U2 - 10.1109/CATA.2018.8398647

DO - 10.1109/CATA.2018.8398647

M3 - Conference contribution

AN - SCOPUS:85050192647

T3 - 2018 4th International Conference on Computer and Technology Applications, ICCTA 2018

SP - 11

EP - 15

BT - 2018 4th International Conference on Computer and Technology Applications, ICCTA 2018

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 4th International Conference on Computer and Technology Applications, ICCTA 2018

Y2 - 3 May 2018 through 5 May 2018

ER -

Bouyeddou B, Harrou F , Sun Y, Kadri B. Detection of smurf flooding attacks using Kullback-Leibler-based scheme. In 2018 4th International Conference on Computer and Technology Applications, ICCTA 2018. Institute of Electrical and Electronics Engineers Inc. 2018. p. 11-15. (2018 4th International Conference on Computer and Technology Applications, ICCTA 2018). doi: 10.1109/CATA.2018.8398647

Detection of smurf flooding attacks using Kullback-Leibler-based scheme

Abstract

Publication series

Conference

Bibliographical note

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this