Traffic Flooding Attack Detection on SNMP MIB Using SVM

KIPS Journal C (2001 ~ 2012) , Vol. 15C, No.5, pp.351-358, May 2008
10.3745/KIPSTC.2008.15C.5.351, Full Text

Abstract

Recently, as network flooding attacks such as DoS/DDoS and Internet Worm have posed devastating threats to network services, rapid detection and proper response mechanisms are the major concern for secure and reliable network services. However, most of the current Intrusion Detection Systems(IDSs) focus on detail analysis of packet data, which results in late detection and a high system burden to cope with high-speed network environment. In this paper we propose a lightweight and fast detection mechanism for traffic flooding attacks. Firstly, we use SNMP MIB statistical data gathered from SNMP agents, instead of raw packet data from network links. Secondly, we use a machine learning approach based on a Support Vector Machine(SVM) for attack classification. Using MIB and SVM, we achieved fast detection with high accuracy, the minimization of the system burden, and extendibility for system deployment. The proposed mechanism is constructed in a hierarchical structure, which first distinguishes attack traffic from normal traffic and then determines the type of attacks in detail. Using MIB data sets collected from real experiments involving a DDoS attack, we validate the possibility of our approaches. It is shown that network attacks are detected with high efficiency, and classified with low false alarms.


Statistics

Show / Hide Statistics

Statistics (Cumulative Counts from October 15, 2016)

Multiple requests among the same browser session are counted as one view. If you mouse over a chart, the values of data points will be shown.


Cite this paper

[KIPS Transactions Style]
J. H. Yu, J. S. Park, H. S. Lee, M. S. Kim, and D. H. Park, "Traffic Flooding Attack Detection on SNMP MIB Using SVM," KIPS Journal C (2001 ~ 2012) , Vol.15C, No.5, pp.351-358, 2008, DOI: 10.3745/KIPSTC.2008.15C.5.351.

[IEEE Style]
Jae Hak Yu, Jun Sang Park, Han Sung Lee, Myung Sup Kim, and Dai Hee Park, "Traffic Flooding Attack Detection on SNMP MIB Using SVM," KIPS Journal C (2001 ~ 2012) , vol. 15C, no. 5, pp. 351-358, 2008. DOI: 10.3745/KIPSTC.2008.15C.5.351.

[ACM Style]
Yu, J. H., Park, J. S., Lee, H. S., Kim, M. S., and Park, D. H. 2008. Traffic Flooding Attack Detection on SNMP MIB Using SVM. KIPS Journal C (2001 ~ 2012) , 15C, 5, (2008), 351-358. DOI: 10.3745/KIPSTC.2008.15C.5.351.