Efficient Method for Discriminating Flash Event from DoS Attack during Internet Protocol Traceback using Shark Smell Optimization Algorithm

Internet Protocol (IP) traceback tool can wrongly identify a Flash event (FE) flow as a Denial of Service (DoS) attack when tracing a DoS attack source because of the symptomatic similarities between them. IP traceback scheme should be able to differentiate FE from DoS attack to avoid higher false error during a DoS attack traceback process. Discrimination policy was introduced into IP traceback scheme to address this challenge, but the discrimination policy may not work effectively when the attack packets from a DoS attack is very large. This work proposed improvement to the discrimination policy implementation by improving the method of the statistical analysis of the attack packets distribution on each node along the path to select a more accurate attack path segment. The results of different tests carried out show significant improvement on the scheme in analyzing very large values of the attack packets discrimination parameters.