Detection of Denial-of-Service Attacks with SNMP/RMON

In this study, a Denial of Service (DoS) attack scenario is examined using Ethernet switch that supports Remote Monitoring (RMON) and Simple Network Management Protocol (SNMP). Detecting DoS attacks may require special software or appliance based firewall devices, but they are not economical. Therefore, manageable network devices supporting SNMP protocol can be employed for DOS attack detection. They give traffic information such as the byte and packet count level network usage, packet size, and packet transmission error events. These can be polled through RMON, which is a special Management Information Base (MIB). In this study, using RMON data polled from the switch, machine learning algorithms are used to detect DoS attacks that achieve a high detection rate and low false alarm rate based on our traffic in our laboratory environment.