Statistical measures: Promising features for time series based DDoS attack detection

The pervasive use of communication technologies increases the demand for high quality and reliable services which guarantees the availability of a communication system. However, providing the availability of services is a challenging issue due to the existence of Distributed Denial of Service (DDoS) attacks. In DDoS attacks, an attacker, who masquerade itself as a legitimate user, tries to increase in the volume of traffic to degrade the Quality of Service of a communication between hosts and the server. Although intrusion detection systems are used to detect DDoS attacks, they are impotent of detection since packets similar to normal ones are dispatched by the attacker. Therefore, transferring from conventional packet-based analysis methods to time series based (flow-based) algorithms would be a better and promising alternative to spot DDoS attacks. In this study, we use kurtosis and skewness measures of a time series to investigate the performance of these parameters for distinguishing a DDoS attack from a normal traffic.