Denial-of-service attack

Application layer DDoS attack

World Wide Web

Overhead (engineering)

Social psychology

Support vector machine

Computer security

Real-time computing

Abnormality

Operating system

The Internet

Anomaly detection

Data mining

Computer science

Trinoo

Computer network

Psychology

Artificial intelligence

Intrusion detection system

Journal of Physics Conference Series

Most of the detection methods against DDoS attacks are based on periodic detection, which leads to high communication overhead, untimely detection, and slow attack response. This paper proposes a passive abnormality detection approach. First, we record the two flow-table characteristics of the regular switches. Then, based on dynamic threshold method and Grubbs outlier test method, we make a determination of abnormal switches. This method reduces the amount of data duplication and regular traffic collection. Moreover, we use Support Vector Machine (SVM) algorithm to evaluate the performance of the passive anomaly detection method. The experiment results show a better performance than active period DDoS attack detection approaches.

A passive DDoS attack detection approach based on abnormal analysis in SDN environment