Detection of Variations of Local Irregularity of Traffic under DDOS Flood Attack

Abstract

The aim of distributed denial-of-service (DDOS) flood attacks is to overwhelm the attacked site or to make its service performance deterioration considerably by sending flood packets to the target from the machines distributed all over the world. This is a kind of local behavior of traffic at the protected site because the attacked site can be recovered to its normal service state sooner or later even though it is in reality overwhelmed during attack. From a view of mathematics, it can be taken as a kind of short-range phenomenon in computer networks. In this paper, we use the Hurst parameter (H) to measure the local irregularity or self-similarity of traffic under DDOS flood attack provided that fractional Gaussian noise (fGn) is used as the traffic model. As flood attack packets of DDOS make the H value of arrival traffic vary significantly away from that of traffic normally arriving at the protected site, we discuss a method to statistically detect signs of DDOS flood attacks with predetermined detection probability and false alarm probability.

1. Introduction

IP Networks are subject to electronic attacks [1]. An intrusion detection system (IDS) collects information from a variety of systems and network sources to analyze the information of attack signs. A network-based IDS monitors the traffic on its network as a data source [2]. For distributed denial-of-service (DDOS) flood attack, an intruder bombs attack packets upon a site (victim) with a huge amount of traffic the sources of which are distributed over the world [3]. Hence the pattern of traffic under DDOS flood attack may suddenly differ significantly from the normal pattern of the arrival traffic. From the perspective of dynamical aspects for limited time interval in physics [4], one may regard this sudden change as a specific “pulse.” Though DDOS flood attack may not be a sole factor to make traffic pattern vary significantly, we assume that secure officers can distinguish significant variation of monitored traffic pattern caused by other known factors (e.g., normally heavy traffic) from DDOS flood attack. Without confusions causing, the term abnormal traffic used in this paper specifically implies a traffic series that has significant variation of traffic pattern caused by DDOS flood attack.

In this research, we ponder two fundamental issues in detection. One is feature extraction of monitored traffic time series. The other is detection scheme that can be used to assure predetermined detection probability (𝑃_𝑑) and false alarm probability (𝑃_𝑓). The first issue will be discussed in Section 2 from a view of feature extraction of traffic based on self-similarity of traffic. The second will be dissertated in Section 3 based on statistical detection. Section 4 will explain the performance analysis of the present detection system. A case study is demonstrated in Section 5. Discussions are given in Section 6, which is followed by conclusions.

2. Feature Extraction of Traffic

2.1. Self-Similar Traffic

Computer scientists in the last decade discovered that traffic is a type of fractal time series. It has the properties of self-similarity, long memory, and multiscales (see e.g., [5]). A commonly used model in traffic engineering is fractional Gaussian noise (fGn) (see e.g., [6–8]).

Let 𝐵(𝑡),𝑡∈(0,∞) be Wiener Brownian motion. Let 𝐵_𝐻(𝑡) be fractional Brownian motion with the Hurst parameter 𝐻∈(0,1) [9]. Let Γ(⋅) be Gamma function. Then by using fractional calculus, 𝐵_𝐻(𝑡) is expressed by 𝐵_𝐻(𝑡)−𝐵_𝐻1(0)=Γ(𝐻+1/2){⁰_−∞[(𝑡−𝑢)^𝐻−0.5−(−𝑢)^𝐻−0.5]dB(𝑢)+^𝑡₀(𝑡−𝑢)^𝐻−0.5dB(𝑢)}. (2.1)

Let 𝐺(𝑡) be the increment series of 𝐵_𝐻(𝑡): 𝐺(𝑡)=𝐵_𝐻(𝑡+𝑎)−𝐵_𝐻(𝑡), (2.2) where a is a real number. Then 𝐺(𝑡) is fGn [9]. The autocorrelation function (ACF) of fGn in the discrete case is given by 𝜎𝜌(𝜏)=²2[||𝜏|+1|^2𝐻−2|𝜏|^2𝐻+||𝜏|−1|^2𝐻], (2.3a) where 𝜎²=Γ(2−𝐻)cos(𝜋𝐻)/𝜋𝐻(2𝐻−1) is the intensity of fGn [10]. The normalized ACF of fGn is given by 1𝑅(𝜏)=2[||𝜏|+1|^2𝐻−2|𝜏|^2𝐻+||𝜏|−1|^2𝐻]. (2.3b) The relationship between the fractal dimension of fGn and H is given by 𝐷=2−𝐻. (2.4)

Approximating the right side of (2.3b) with the second-order differential of 0.5(𝜏)^2𝐻, see [9, H15, page 350], for 𝜏≥0, yields 0.5[(𝜏+1)^2𝐻−2𝜏^2𝐻+(𝜏−1)^2𝐻]≈𝐻(2𝐻−1)𝜏^2𝐻−2. (2.5)

Let y and R be a traffic series and its ACF, respectively. Then according to (2.5), 𝑅(𝜏)∼𝑐𝜏^2𝐻−2,𝐻∈(0.5,1), (2.6) where ~ implies the asymptotical equivalence under the limit 𝜏→∞ and 𝑐>0 is a constant [11].

The ACF (2.5) is nonsummable for 𝐻>0.5, implying long-range dependence (LRD). Hence H is a measure of LRD of traffic. It is kindly noted that LRD of traffic does not mean that DDOS attacking is a long-range phenomenon. On the contrary, DDOS attacking and its detection are short-range phenomena since both sides, namely, an attacker and its opponent, are engaged with each other during a short period of time. Such a battle makes local irregularity of traffic vary dramatically [12].

Without losing generality, we consider traffic series y in the discrete case. By dividing y into nonoverlapping blocks of size L and averaging over each block, we obtain another series given by 𝑦(𝑖)^(𝐿)=1𝐿^(𝑖+1)𝐿_{𝑗=𝑖𝐿}𝑦(𝑗). (2.7) According to the analysis in [5, 9, 11], in the fGn sense, one has Var(𝑦^(𝐿))=𝐿^2𝐻−2Var(𝑦), (2.8) where Var implies the variance operator. Thus the self-similarity is measured by H.

A series encountered in engineering is usually of finite length. Let y be a series of P length. Divide it into N nonoverlapping sections. Each section is divided into M nonoverlapping segments. Divide each segment into K nonoverlapping blocks. Each block is of L length. Let 𝑦(𝑖)_𝑚^(𝐿)(𝑛) be the series with aggregated level L in the mth segment of the nth section (𝑚=0,1,…,𝑀−1;𝑛=0,1,…,𝑁−1). Let 𝐻_𝑚(𝑛) be the H value of 𝑦(𝑖)_𝑚^(𝐿)(𝑛). Let 𝑟(𝑘;𝐻_𝑚(𝑛)) be the measured ACF of 𝑦(𝑖)_𝑚^(𝐿)(𝑛) in the normalized case. The theoretic ACF form corresponding 𝑦(𝑖)_𝑚^(𝐿)(𝑛) in the fGn sense is given by 𝑅(𝑘;𝐻_𝑚(𝑛))=0.5[||𝑘|+1|^{2𝐻𝑚(𝑛)}−2|𝑘|^{2𝐻𝑚(𝑛)}+||𝑘|−1|^{2𝐻𝑚(𝑛)}]. (2.9) The above expression exhibits the multifractal property of traffic as can be seen from [13].

Let 𝐽(𝐻_𝑚(𝑛))=_𝑘[𝑅(𝑘;𝐻_𝑚(𝑛))−𝑟(𝑘;𝐻_𝑚(𝑛))]² (2.10) be the cost function. Then one has 𝐻_𝑚(𝑛)=argmin𝐽[𝐻_𝑚(𝑛)]. (2.11) Averaging 𝐻_𝑚(𝑛) in terms of index m yields 1𝐻(𝑛)=𝑀^𝑀−1_𝑚=0𝐻_𝑚(𝑛), (2.12) representing the H estimate of the series in the nth section.

Usually, 𝐻(𝑛₁)≠𝐻(𝑛₂) for 𝑛₁≠𝑛₂. However, stationarity of traffic time series implies that 𝐻(𝑛) at a specific site is a number falling within a certain confidence interval [5, Paragraph 5, Section 5, page 966]. In practical terms, a normality assumption for 𝐻(𝑛) is quite accurate in most cases for 𝑀>10 regardless of probability distribution function of H [14]. Thus we take 𝐻_𝑥=𝐸[𝐻(𝑛)] (2.13) as a mean estimate of H of x, where E is the mean operator. It can be taken as a template of H of x for the purpose of statistical detection. The appendix gives a case of the H estimation of a real-traffic series to clarify the reasonableness of H in featuring traffic time series.

2.2. Characterizing Traffic Time Series with 𝐻

Let x be normal traffic time series. Normally, the site serves x peacefully though x may sometimes be unpleasantly delayed because of the normal traffic jam. The arrival traffic x is contributed by many connections distributed all over the world. Figure 1 shows x contributed by traffic from d connections. From previous discussions, we see that x can be characterized by the Hurst parameter and we denote it as 𝐻_𝑥.

Figure 1 

Normal traffic at input of a server.

Assume that the site is intruded by DDOS flood attacking. Then actual arrival traffic (abnormal traffic) consists of normal traffic x and attack traffic a, see Figure 2, where a is contributed by e connections. We use 𝐻_𝑦 as a feature of y.

Figure 2 

Illustration of abnormal traffic.

3. Detection Method and System Structure

To explain our detection principle, we introduce three terms. Correctly recognizing an abnormal sign is termed detection; failing to recognize it, miss; mistakenly recognizing a normal as abnormal is a false alarm.

Let 𝜉=‖𝐻_𝑥−𝐻_𝑦‖. Then 𝜉 represents the deviation of H of monitored traffic time series. Let 𝑉>0 be the threshold. Then the detection hypotheses are as follows. 𝜉>𝑉, implies detection, while 𝜍=‖𝐻_𝑥−𝐻_𝑥𝑙‖>𝑉 represents false alarm, where 𝐻_𝑥𝑙 stands for H which is not used as the template but obtained when there is no attacking. Clearly, 𝜉 and 𝜁 are random variables. Mathematically, there are many distance measures available [15–17], but the following works well: 𝜉=𝐸[_𝑘|𝐻_𝑦𝐻_𝑥𝐻−log^𝑦𝐻_𝑥−1|]. (3.1)

According to the previous discussions, we give the system diagram in Figure 3. The measured arrival traffic first passes through an H estimator. The result of H estimator goes to template database to produce the template 𝐻_𝑥. In addition, it outputs an online estimate of 𝐻_𝑦. 𝐻_𝑥 and 𝐻_𝑦 are compared in the distance detector. The comparison result 𝜉 is fed into threshold detector to compare with a given threshold V. In the stage of decision analysis, the output of the threshold detector is analyzed and its output gives a sign of detection according to preset detection probability and false alarm probability.

Figure 3 

System diagram.

4. Performance Analysis

With the partition explained in Section 2, we see that there is a value of 𝜉 representing the deviation of H of y in each segment. Therefore, in each section, 𝜉 is a random sequence of M length. Denote 𝜉 as the expectation of 𝜉 in each section. Then 𝜉 is a random sequence of N length. In the case of 𝑁≥10,𝜉 well obeys Gaussian distribution [14]. For the simplicity, we still denote 𝜉 as 𝜉.

4.1. Detection Probability

Let 𝜇_𝜉 and 𝜎²_𝜉 be the expectation and the variance of 𝜉, respectively. Then 𝜉∼𝑁(𝜇_𝜉,𝜎²_𝜉1)=√2𝜋𝜎_𝜉𝑒^{−(𝜉−𝜇𝜉)2/2𝜎2𝜉}. (4.1) Let Φ(𝑡)=^𝑡_−∞1√𝑒2𝜋^−𝑡2/2𝑑𝑡. (4.2) Then detection probability is given by 𝑃_𝑑=𝑃{𝑉<𝜉<∞}=^∞_{(𝑉−𝜇𝜉)/𝜎𝜉}1√𝑒2𝜋^−𝑡2/2𝑑𝑡=1−Φ[𝑉−𝜇_𝜉𝜎_𝜉]. (4.3)

4.2. False Alarm Probability

Let 𝜇_𝜁 and 𝜎²_𝜍 be the mean and the variance of 𝜁. Then false alarm probability is given by 𝑃_𝑓=𝑃{𝑉<𝜁<∞}=^∞_{(𝑉−𝜇𝜍)/𝜎𝜍}1√𝑒2𝜋^−𝑡2/2𝑑𝑡=1−Φ[𝑉−𝜇_𝜁𝜎_𝜁]. (4.4)

4.3. Miss Probability

Let 𝑃_𝑚 be miss probability. Then 𝑃_𝑚=𝑃{−∞<𝜉<𝑉}=^{(𝑉−𝜇𝜉)/𝜎𝜉}_−∞1√𝑒2𝜋^−𝑡2/2𝑑𝑡=Φ[𝑉−𝜇_𝜉𝜎_𝜉]. (4.5)

Generally, 𝜇_𝜁=0. Besides, the numeric computation in data processing can be arranged such that 𝜎_𝜁=𝜎_𝜉=𝜎. In this case, three probabilities are given by 𝑃_𝑑=^∞_{(𝑉−𝜇𝜉)/𝜎}1√𝑒2𝜋^−𝑡2/2𝑑𝑡=1−Φ[𝑉−𝜇_𝜉𝜎𝑃],_𝑓=^∞_𝑉/𝜎1√𝑒2𝜋^−𝑡2/2𝑉𝑑𝑡=1−Φ(𝜎𝑃),_𝑚=^{(𝑉−𝜇𝜉)/𝜎}_−∞1√𝑒2𝜋^−𝑡2/2𝑑𝑡=1−Φ[𝑉−𝜇_𝜉𝜎]. (4.6) Figures 4–6 show the curves of three distributions, respectively. As 𝑃_𝑑+𝑃_𝑚=1, high 𝑃_𝑑 implies low 𝑃_𝑚 and vice versa.

Figure 4 

Detection probability.

Figure 5 

Miss probability.

Figure 6 

False alarm probability.

4.4. Threshold and Detection Region

As can be seen from the previous discussions, the selection of a threshold value is crucial to our system. In fact, given a false alarm probability f, we want to find the threshold 𝑉_𝑓 such that 𝑃(𝑉_𝑓)≤𝑓. Clearly, 𝑉_𝑓≥−𝜎Φ⁻¹(𝑓). (4.7) If 𝑓=0 and when the selected precision is 4, we obtain 𝑉_𝑓≥4𝜎. (4.8) Given a detection probability d, we want to find the threshold 𝑉_𝑑 such that 𝑃_𝑑(𝑉_𝑑)≥𝑑. Clearly,𝑉_𝑑≤𝜇_𝜉−𝜎Φ⁻¹(𝑑),if𝜇_𝜉−𝜎Φ⁻¹(𝑑)>0. (4.9) In the case of 𝑑=1,𝑉_𝑑≤𝜇_𝜉−4𝜎,if𝜇_𝜉−4𝜎>0. (4.10) Therefore, when −𝜎Φ⁻¹(𝑓)<𝜇_𝜉−𝜎Φ⁻¹(𝑑) and 𝑉∈[−𝜎Φ⁻¹(𝑓),𝜇_𝜉−𝜎Φ⁻¹(𝑑)],𝑃_𝑑≥𝑑 and 𝑃_𝑓≤𝑓 are assured. That is, 𝑃_𝑑𝑃≥𝑑,_𝑓≤𝑓,if𝑉∈[−𝜎Φ⁻¹(𝑓),𝜇_𝜉−𝜎Φ⁻¹(𝑑)],𝜇_𝜉−𝜎Φ⁻¹(𝑑)>0. (4.11) In the case of 𝑑=1 and 𝑓=0, 𝑃_𝑑𝑃=1,_𝑓=0,if𝑉∈[4𝜎,𝜇_𝜉−4𝜎],𝜇_𝜉−4𝜎>0. (4.12) The constraint of (4.12) is given by 𝜇_𝜉>8𝜎.

Obviously, the detection region is the intersection of three probability functions. Under the condition of 𝜇_𝜉=80 and 𝜎=10, the detection region is shown in Figure 7.

Figure 7 

Intersection of three probability distributions: detection region.

5. A Case Study

Suppose the template 𝐻₀=0.7671 as described in the appendix. Assume that the confidence level is 99.9999%. Thus we suppose 𝑦^′s𝐻∈(0.5000,0.7669) or (0.7673,0.9900) during the transition process of intrusion. In this case study, 1000 points of 𝐻s in (0.5000,0.7669) or (0.7673,0.9900) are randomly selected to simulate the abnormal traffic deviating from the normal one. The error sequence is indicated in Figure 8. By the numeric computation, we obtain 𝜇_𝜉=210.3011 and 𝜎=7.7490. Therefore, we obtain the probability distributions for detection, false alarm and miss as shown in Figure 9. Under the conditions of 𝑃_𝑑=1 and 𝑃_𝑓=0, we obtain 𝑉_min=30.9951 and 𝑉_max=179.3052. Hence when we select 𝑉∈[30.9951,179.3052], we have 99.9999% confidence to say that 𝑃_𝑑=1 and 𝑃_𝑓=0 are assured, which can be easily observed from Figure 9.

Figure 8 

Random variable 𝜉.

Figure 9 

Case study: detection region.

6. Discussions

Since Yahoo servers were successfully attacked in 2001, the issue of detecting DDOS flood attacking has been paid much attention to. Various methods and systems have been proposed, see, for example, [18–25]. As known, traffic under DDOS flood attack must be significantly different from that of normal one [25]. Otherwise, DDOS flood attack would have no effect. From this point of view, the value of H of traffic under DDOS flood attacks is considerably different from that of normal one, see [12] for details.

For a stationary random time series of finite length, ACF and power spectrum density (PSD) function are commonly used in engineering for feature extraction in statistical classifications [16, 17]. However, the PSD of traffic does not exist in the domain of ordinary functions since it has long memory [8]. To avoid such a difficulty in mathematics, consequently, ACF of traffic is considered for feature extraction in our early work [25]. This paper focuses on detection of local variations of traffic based on the self-similarity of traffic. Thus it suggests a new method that substantially develops the work of [25], from the point of view of traffic pattern matching, because feature extraction of traffic time series by using a single parameter H makes pattern matching more efficient.

7. Conclusions

We have discussed the characterization of the local irregularity of traffic by 𝐻(𝑛). We have explained a principle of statistical detection to capture signs of DDOS flood attacking with predetermined detection probability and false alarm probability based on the variation of the local irregularity of traffic.

Appendix

Demonstration of 𝐻 Estimation of a Real-Traffic Series

This appendix gives a demonstration with a real-traffic series, named LBL-PKT-4 [26, 27]. Denote 𝑥(𝑖) as the series of LBL-PKT-4, indicating the number of bytes in the ith packet. The length of that series is 1.3 million. The first 1024 points of that series is plotted in Figure 10(a). Divide 𝑥(𝑖) into 32 nonoverlapping sections. Computing H in each section yields 𝐻(𝑛)(𝑛=0,1,…,31) as shown in Figure 10(b). Its histogram is indicated in Figure 10(c).

Figure 10: Verification of statistical invariable H. (a) A real-traffic time series; (b) estimate 𝐻(𝑛); (c) histogram of 𝐻(𝑛).

According to (2.13), we have 𝐻_𝑥=0.7671. The confidence interval with 95% confidence level is [0.7670,0.7672]. Hence we have 95% confidence to say that the H estimate in each section of that series takes 𝐻_𝑥=0.7671 as its approximation with fluctuation not greater than 1×10⁻⁴. Further, it is easy to obtain that the confidence interval with 99.9999% confidence level is [0.7669, 0.7673]. Hence we have 99.9999% confidence to say that the H estimate in each section of that series takes 𝐻_𝑥=0.7671 as its approximation with fluctuation not greater than 2×10⁻⁴.

Acknowledgments

This work was supported in part by the National Natural Science Foundation of China under the project Grant no. 60573125. Wei Zhao’s work was also partially supported by the NSF (USA) under Contracts no. 0808419, 0324988, 0721571, and 0329181. Any opinions, findings, conclusions, and/or recommendations in this paper, either expressed or implied, are those of the authors and do not necessarily reflect the views of the agencies listed above.