Download - Academy Publisher

Step4 calculate the new subordinate-matrixU in each
time window through formula
k
u = 1/ ∑ ( d / d )
ij ij rl
l=
1
2/( m−1)
Step5 Loop computations step3 and step4 until the
cluster rule function is less than a threshold
value. The value is the cluster result. Cluster rule
m 2
function is J ( U, V) u d ( x , v )
n
m ij ij j i
j= 1 i=
1
c
= ∑∑ .
Through the above calculation step the deviation of
membership of every sample point could be determined
in its time window. According to the rule of the
maximum deviation of membership in fuzzy date set, it
should be determined that which cluster center every
sample point belongs to so as to make sure whether there
are DDoS attacks in current network.
Table 1 DDoS attack detection result in different duration
1 min 5 min
Attack tools Detection rate Error rate Residual rate Detection rate Error rate Residual rate
SYN Flood 100% 0% 0% 100% 0% 0%
Stacheldraht 96.53% 1.05% 2.42% 99.33% 0.54% 0.13%
Trinoo 98.92% 0.41% 0.67% 99.69% 0.13% 0.18%
TFN2K 97.20% 2.45% 0.35% 98.65% 1.12% 0.23%
Ⅲ. EXPERIMENT
Attack detection experiment platform is built in
some campus network, the target host is in the network
computer center, the operating system is Windows 2000
server, and WWW and FTP service are also used, attack
hosts are distributed in this campus network. When the
attack detection experiment is under way, the network
traffic and packets of the target host would be collected
and lasted for two weeks, then the collected network
traffic value and packets would used as training samples
to generate the threshold model of network traffic and
detection model of packet connection status. DDoS attack
tools include TFN2K, Stacheldraht, SYN Flood, Trinoo.
DDoS attacks in this experiment will be detected in
different duration.
From the analysis of DDoS attacks in this
experiment, it is found that this system has a high
detection efficiency, the detection rate of it could reach
more than 97%. moreover, with the increase in the
duration of DDoS attacks, higher is the attack detection
rate of this system. The function test result of this
system shows that it could meet the daily detection
needs well.
Ⅳ. CONCLUSIONS
This paper, aiming at the characteristics of difficult
detection and prevention as to DDoS attacks, proposes a
detection model based on data mining. This model could
receive the currently normal network traffic model with
data mining algorithm. Once network traffic appears
abnormal, this model could detect the packets maintaining
in abnormal traffic duration. In this way the system load
will be greatly reduced and its real-time can be improved.
Through the test in LAN, this system is able to effectively
detect DDoS attacks in real time.
ACKNOWLEDGMENT
This work is supported by Economic Commence
Market Application Technology Foundation Grant by
2007gdecof004.
REFERENCES
[1] Meyer L, and Penzhorn WT. “Denial of service and
distributed denial of service-today and tomorrow,”In: Proc.
of the IEEE 7th AFRICON Conf. Vol.2,pp.959-964,2004.
[2] Wang HN, Zhang DL, and Shin KG. “Detecting SYN
floodingattacks,”In:Proc.of the 21st Annual Joint Conf. of
the IEEE Computer and Communications
Societies,Vol.3,pp.1530-1539,2002.
[3] Gao Neng, Feng Deng-Guo, and Xiang Ji. “A Data-Mining
Based DoS Dectection Technique,” Chinese Journal of
Computers,Vol.29, pp.944-951,2005.
[4] Li J, and Manikopoulos C. “Early statistical anomaly
intrusion detection of DOS attacks using MIB traffic
parameters,”In:Proc.of the IEEE Systems,Man and
Cybernetics Society,Information Assurance
Workshop,pp.53-59,2003.
[5] Kim YW, Lau WC, Chuah MC, and Chao HJ.
“Packetscore:Statistical-Based overload control against
distributed denial-of-service a ttacks,”In:Proc.of the 23rd
Annual Joint Conf.of the IEEE Computer and
Communications Societies,Vol.4,pp.2594-2604,2004.
[6] SUN Ji-Gui, and LIU Jie. “Clustering Algorithms Research,”
Journal of Software,Vol.19,pp.48-61,2008.
[7] YANG De-Gang. “Research of the Network Intrusion
Detection Based on Fuzzy Clustering,” Computer Science,
Vol.32, pp.86-91,2005.
65