Scale matters: a Comparative Study of Datasets for DDoS Attack Detection in CSP Infrastructure

Denial of Service (DoS) and Distributed Denial of Service (DDoS) are attacks designed to take down a service by exhausting its resources. Lots of research have been carried in the past decades to design efficient algorithms that can detect these attacks. However, most of the literature on DoS and DDoS detection consider the protection of a small or medium size businesses network. Usually, these networks consist in several workstations and servers protected by few firewalls that can analyze all incoming network traffic. So that the research on DoS and DDoS can be reproduced and analyzed, several datasets, reflecting this network infrastructures have been proposed in the literature. However, more and more businesses are migrating their services to the cloud and are renting servers from Cloud Service Providers (CSP). If the CSP wants to protect its customers from DoS and DDoS attacks, it must perform detection on its infrastructure. This kind of infrastructure is in no way comparable to the ones usually found in the literature. In this paper, we propose to compare publicly available state-of-the-art datasets with real network traffic captured on the infrastructure of a world-scale CSP and discuss their relevance in the context of detecting volumetric DDoS attacks on CSP infrastructure.