
View/ Open
diab_et_al_2021 (3.624Mb)
Download
Publication date
2021Rights
(c) 2021 John Wiley and Sons. Full-text reproduced in accordance with the publisher's self-archiving policy.Peer-Reviewed
YesOpen Access status
GreenAccepted for publication
2021-03-14
Metadata
Show full item recordAbstract
With the rapid growth of security threats in computer networks, the need for developing efficient security‐warning systems is substantially increasing. Distributed denial‐of‐service (DDoS) and DoS attacks are still among the most effective and dreadful attacks that require robust detection. In this work, we propose a new method to detect TCP DoS/DDoS attacks. Since analyzing network traffic is a promising approach, our proposed method utilizes network traffic by decomposing the TCP traffic into control and data planes and exploiting the dynamic time warping (DTW) algorithm for aligning these two planes with respect to the minimum Euclidean distance. By demonstrating that the distance between the control and data planes is considerably small for benign traffic, we exploit this characteristic for detecting attacks as outliers. An adaptive thresholding scheme is implemented by adjusting the value of the threshold in accordance with the local statistics of the median absolute deviation (MAD) of the distances between the two planes. We demonstrate the efficacy of the proposed method for detecting DoS/DDoS attacks by analyzing traffic data obtained from publicly available datasets.Version
Accepted manuscriptCitation
Diab DM, AsSadhan B, Binsalleeh H et al (2021) Denial of service detection using dynamic time warping'. International Journal of Network Management. Accepted for publication. e2159.Link to Version of Record
https://doi.org/10.1002/nem.2159Type
Articleae974a485f413a2113503eed53cd6c53
https://doi.org/10.1002/nem.2159