User Behaviour Modelling Based DDoS Attack Detection


Cepheli O., Buyukcorak S., Karabulut Kurt G. Z.

22nd IEEE Signal Processing and Communications Applications Conference (SIU), Trabzon, Turkey, 23 - 25 April 2014, pp.2186-2189 identifier

  • Publication Type: Conference Paper / Full Text
  • City: Trabzon
  • Country: Turkey
  • Page Numbers: pp.2186-2189

Abstract

Distributed Denial of Service (DDoS) attacks are one of the most important threads in network systems. Due to the distributed nature, DDoS attacks are very hard to detect, while they also have the destructive potential of classical denial of service attacks. In this study, a novel 2-step system is proposed for the detection of DDoS attacks. In the first step an anomaly detection is performed on the destination IP traffic. If an anomaly is detected on the network, the system proceeds into the second step where a decision on every user is made due to the behaviour models. Hence, it is possible to detect attacks in the network that diverges from users' behavior model.