FastDetict: A Data Mining Engine for predecting and preventing DDoS attacks

One imperative mission of the Department of Homeland Security (DHS) is to prevent, combat, and mitigate extensive and sophisticated Distributed Denial of Service (DDoS) attacks in early stages. The problem with DDoS attacks is that they can cripple even the most established and largest organizations through generating a huge amount of traffic that will cause the network to crash. A Denial of Service (DoS) attack is considered to be one of the cyber attacks where the perpetrator seeks to make a single machine or network resources unavailable to its legitimate users. On the other hand, DDos attacks are launched from multiple connected devices that are distributed across the Internet. Unlike single-source DoS attacks, DDoS assaults tend to target the network infrastructure in an attempt to saturate the system with huge volumes of traffic. Over time, attackers have shown creativity and ingenuity in ways to perform DDoS attacks ranging from - attacks using Rapid Scanning Tree Protocol (RSTP) which is a layer2 attack, attacks using Internet Protocol (IP) on layer3 or using TCP/UDP on layer4 and scripting attacks on layer7 using the most basics of JavaScript. To prevent DDoS attack, we proposed a data mining engine framework to control the dynamic priority assignment of communication processes and automatically downgrade or upgrade open connection processes according to their resource usage history and the dynamism in the whole system. All remote communication requests will be clustered based on their history of resource usage such as CPU time, memory size, and network bandwidth.