Research Article

A Multivariant Stream Analysis Approach to Detect and Mitigate DDoS Attacks in Vehicular Ad Hoc Networks

Table 2

Algorithm rules and its explanation.

Rules Explanation

Generate rule (Gr) = , Si, Ap, Ahc, Attl, The algorithm will generate the rules according to the Ti, Si, Ap, Ahc, Attl, and Apf. The generated rule will be stored in the set.
Add to rule set (Rs) =

MASV = The average payload is being used it is because various sources share the bandwidth and the bandwidth utilization is depending on the packet frequency as well. Similarly, the TTL value depends on the hop count.

Masw = The denominator (24) is the entire time value, which is split into the number of the time window. For example, if the class splits time (24) into 1 hour then we will get a 24-time window.

Compute similarity measure MASMTo compute the similarity, the computed value will be considered. However, computed value for the received packet should fall within the measure of rules that are available for the specific time window. The algorithm must compute the distance between the rules and the features extracted for received packets.
=

If MASM < MASW && MASM<>Ri.FeaturesRI. The feature means the feature that is used to detect DDoS attacks. The algorithm has many features in the rule such as time, source, average payload, average TTL, and average hop count. The MASM and MASW are computed according to the mentioned features only. Based on that the decision will be taken.