Traffic Flooding Attack Detection on SNMP MIB Using SVM


The KIPS Transactions:PartC, Vol. 15, No. 5, pp. 351-358, Oct. 2008
10.3745/KIPSTC.2008.15.5.351,   PDF Download:

Abstract

Recently, as network flooding attacks such as DoS/DDoS and Internet Worm have posed devastating threats to network services, rapid detection and proper response mechanisms are the major concern for secure and reliable network services. However, most of the current Intrusion Detection Systems(IDSs) focus on detail analysis of packet data, which results in late detection and a high system burden to cope with high-speed network environment. In this paper we propose a lightweight and fast detection mechanism for traffic flooding attacks. Firstly, we use SNMP MIB statistical data gathered from SNMP agents, instead of raw packet data from network links. Secondly, we use a machine learning approach based on a Support Vector Machine(SVM) for attack classification. Using MIB and SVM, we achieved fast detection with high accuracy, the minimization of the system burden, and extendibility for system deployment. The proposed mechanism is constructed in a hierarchical structure, which first distinguishes attack traffic from normal traffic and then determines the type of attacks in detail. Using MIB data sets collected from real experiments involving a DDoS attack, we validate the possibility of our approaches. It is shown that network attacks are detected with high efficiency, and classified with low false alarms.


Statistics
Show / Hide Statistics

Statistics (Cumulative Counts from September 1st, 2017)
Multiple requests among the same browser session are counted as one view.
If you mouse over a chart, the values of data points will be shown.


Cite this article
[IEEE Style]
J. H. Yu, J. S. Park, H. S. Lee, M. S. Kim, D. H. Park, "Traffic Flooding Attack Detection on SNMP MIB Using SVM," The KIPS Transactions:PartC, vol. 15, no. 5, pp. 351-358, 2008. DOI: 10.3745/KIPSTC.2008.15.5.351.

[ACM Style]
Jae Hak Yu, Jun Sang Park, Han Sung Lee, Myung Sup Kim, and Dai Hee Park. 2008. Traffic Flooding Attack Detection on SNMP MIB Using SVM. The KIPS Transactions:PartC, 15, 5, (2008), 351-358. DOI: 10.3745/KIPSTC.2008.15.5.351.