Detecting DDoS Attacks Using the Analysis of Network Traffic as Dynamical System

This paper presents a new algorithm for DDoS attacks detection based on analysis of network traffic as a dynamical system. We applied author's approach that enables to describe relations between traffic characteristics in different time slices using casual Hilbert operator. The algorithm consists of operations for: (1) converting the primary network traffic characteristics (data packets headers) into intermediate and secondary informative characteristics required for creating traffic classification rules; (2) forming traffic patterns in the form of histograms of secondary informative characteristics; (3) attacks detection and histogram-based modeling classification based on Bayesian decision theory.