2013-A System for Denial-of-Service Attack Detection Based on Multivariate Correlation Analysis

A System for Denial-of-Service Attack Detection Based on Multivariate Correlation Analysis

Abstract

          Interconnected systems, such as Web servers, database servers, cloud computing servers etc, are now under threads fromnetwork attackers. As one of most common and aggressive means, Denial-of-Service (DoS) attacks cause serious impact on thesecomputing systems. In this paper, we present a DoS attack detection system that uses Multivariate Correlation Analysis (MCA) foraccurate network traffic characterization by extracting the geometrical correlations between network traffic features. Our MCA-basedDoS attack detection system employs the principle of anomaly-based detection in attack recognition. This makes our solution capableof detecting known and unknown DoS attacks effectively by learning the patterns of legitimate network traffic only. Furthermore, atriangle-area-based technique is proposed to enhance and to speed up the process of MCA. The effectiveness of our proposeddetection system is evaluated using KDD Cup 99 dataset, and the influences of both non-normalized data and normalized data onthe performance of the proposed detection system are examined. The results show that our system outperforms two other previouslydeveloped state-of-the-art approaches in terms of detection accuracy