LeCAM: A novel metric for detecting DDoS attacks

Presently in the technological era, Internet is the sole medium to access and run web based services such as a business, banking, education, e-commerce, weather forecasting, etc. Because of the increasing usage of such services and dependency on the Internet, many types of malware threats have emerged over the time that affects the timely delivery of these services. Distributed Denial of Service (DDoS) attack is one of such crucial threats. Many researchers have proposed diversified DDoS detection approaches using information theory based entropy and divergence detection metrics in the past. This paper proposes to use a novel LeCam divergence metric to detect different types of DDoS attacks based on flow similarity between the network traffic flows. The effectiveness of the proposed approach is corroborated using widely used benchmarked MIT Lincoln and CAIDA datasets along with DDoSTB dataset. The results show that the novel LeCam Divergence metric is more effective as compared to the traditional Kullbeck-Leibler, Bhattacharyya and Pearson Divergence measures.