An Empirical Investigation of DDoS and Flash Event Detection Using Shannon Entropy, KOAD and SVM Combined

In the world of internet and communication technologies where our personal and business lives are inextricably tied to internet enabled services and applications, Distributed Denial of Service (DDoS) attacks continue to adversely affect the availability of these services and applications. Many frameworks have been presented in academia and industry to predict, detect and defend against DDoS attacks. The available solutions try to protect online services from DDoS attacks, but as yet there is no best-practice method that is widely-accepted in the community. Differentiating DDoS attacks from similar looking legitimate Flash Events (FE) wherein huge numbers of legitimate users try to access a specific internet based service or application, is another challenging issue in the field. This paper proposes a novel hybrid DDoS and FE detection scheme taking three isolated approaches including Kernel Online Anomaly Detection (KOAD), Support Vector Machine (SVM) and Information Theory. We applied our proposed approach on simulated DDoS attacks, real FEs and normal network traffic. The results indicate that information theory works well in combination with machine learning algorithms to detect and discriminate DDoS and FE traffic in terms of both false positive and detection rates.