Fractal Analysis based Detection of DoS/LDoS Network Attacks

Numerous research point to the fractal (self-similar) nature of network traffic. Self-similarity appears in strong traffic autocorrelation and long-term dependence. This leads to the fact that the consistency of correlation structures does not disappear even when observed on a large time scale. Using methods of fractal analysis makes it possible to identify structural features caused by abnormal changes, that are unusual for legitimate user traffic. These changes include various kinds of DoS attacks, which effective recognition and elimination is a challenging and important issue. The article explores detection of conventional network Denial of Service attacks (HTTP flood, ICMP flood, SYN flood) and Low-rate Denial of Service (LDoS) attacks by evaluating the fractal properties of traffic. The Hurst parameter was chosen as a measure of traffic self-similarity and implementation of R/S analysis method was made to perform its evaluation. Experimental research of traffic samples with an attack was conducted using this algorithm. Experiment results allow concluding that the fractal approach can be used to detect intrusions into computer networks in near real-time.