Graph-based fuzzy approach against DDoS attacks1

Abstract

While internet technologies have been evolving day by day, threats against them have been increasing with the same pace. One of the most serious and commonly executed attack type is Distributed Denial of Service (DDoS) attacks. Despite there are many security mechanisms against this type of attack, there is still need for new solutions due to the occurred DDoS attacks worldwide. In this work, a DDoS attack detection approach based on fuzzy logic and entropy is proposed. Network is modelled as a graph and graph-based features are used for discriminating attack traffic from attack-free traffic. Fuzzy-c-means clustering is applied based on these features in order to show the tendencies of IP addresses or port numbers to be in a same cluster or not. Based on this uncertainty, attack and attack-free traffic are modelled. In detection phase, fuzzy membership function is used. This algorithm is tested on the real data collected from Bogaziçi University network.