Journal of Jilin University(Engineering and Technology Edition) ›› 2020, Vol. 50 ›› Issue (5): 1894-1904.doi: 10.13229/j.cnki.jdxbgxb20190448

Previous Articles    

Statistical based distributed denial of service attack detection research in internet of things

Hong-song CHEN(),Jing-jiu CHEN   

  1. School of Computer and Communication Engineering, University of Science and Technology Beijing, Beijing 100083, China
  • Received:2019-05-10 Online:2020-09-01 Published:2020-09-16

RICH HTML

 5   

PDF (PC)

597

Abstract:

To solve the problem of large-scale Distributed Denial of Service (DDoS) attack detection in Internet of Things (IoT) simulation environment, the Docker virtualized container technology is used to construct the IoT traffic simulation platform. First, four different types of attack traffic are generated by simulating Mirai botnet and executing commands, and normal traffic is generated by manual click and IoT experiment box auto execution. Then, statistical analysis is carried out on the original traffic to generate two different levels of datasets: packet-level and second-level. Third, three statistical analysis methods and indicators are proposed, including segmented HURST exponent, sliding-window based entropy and sliding-window based confidence interval. Finally, the DDoS attack traffic detection rules are generated by the training dataset. The experimental results show that the sliding-window based confidence interval abnormal traffic detection method can achieve an accuracy of 72.11%.

Key words: statistical analysis, abnormal traffic detection, distributed denial of service, attack simulation, internet of things simulation

CLC Number: 

  • TP309

Fig.1

Structure chart of traffic collection platform for IoT simulation environment"

Fig.2

Structure chart of IoT experiment box"

Table 1

Parameter of DDoS attack traffic simulation"

攻击名称攻击流量 生成工具Docker 数量时间/s频次/(次·s-1)

TCP ACK

泛洪攻击

Mirai僵尸网络

模拟软件

201030

TCP SYN

泛洪攻击

Mirai僵尸网络

模拟软件

201030

HTTP GET

泛洪攻击

Mirai僵尸网络

模拟软件

201203

慢速HTTP

头部攻击

SlowHTTPTest

工具模拟

201203

Fig.3

Relationships of different level datasets"

Table 2

Description of second-level dataset in IoT experimental envrionment"

项目训练集样本测试集样本
个数采集 时间/s个数采集 时间/s
慢速HTTP头部攻击325879263707
TCP SYN泛洪攻击12618164185
TCP ACK泛洪攻击6623978262
HTTP GET泛洪攻击215364157375
人工模拟51016163861715
IoT实验箱55113444511006

Table 3

Description of overall dataset"

数据集训练集正常样本数训练集异常样本数测试集正常样本数测试集异常样本数
包级23 136122 23631 428122 958
秒级1 061732837562

Fig.4

Statistic based abnormal traffic detection pipeline"

Fig.5

20 features HURST value comparison of different kind of traffic in second-level training dataset"

Fig.6

Top 5 features HURST value comparison of different kind of network traffic in second-level training dataset"

Fig.7

Top 5 features HURST value comparison of different kind of traffic in second-level test dataset"

Fig.8

Top 5 features HURST value comparison in second-level training dataset when time window is 20"

Fig.9

Top 5 features HURST value comparison in second-level test dataset when time window is 20"

Fig.10

Sliding-window based entropy comparison of different features in second-level training dataset"

Fig.11

Sliding-window based entropy comparison of different features in second-level test dataset"

Fig.12

Prediction accuracy of sliding-window based confidence interval abnormal traffic detection algorithm in second level training dataset"

Fig.13

Prediction accuracy of sliding-window based confidence interval abnormal traffic detection algorithm at different window size"

Fig.14

Prediction accuracy of sliding-window based confidence interval abnormal traffic detection algorithm at different confidence level"

Fig.15

Prediction accuracy of sliding-window based confidence interval abnormal traffic detection algorithm in second level testing dataset"

1 Kolias C, Kambourakis G, Stavrou A, et al. DDoS in the IoT: mirai and other botnets[J]. Computer, 2017, 50(7): 80-84.
2 Hilton S. Dyn analysis summary of friday october 21 attack Dyn[EB/OL]. [2016-10-01].
3 Sahi A, Lai D, Li Y, et al. An efficient DDoS TCP flood attack detection and prevention system in a cloud environment[J]. IEEE Access, 2017（5）: 6036-6048.
4 Gurulakshmi K, Nesarani A. Analysis of IoT bots against DDOS attack using machine learning algorithm[C]∥2018 2nd International Conference on Trends in Electronics and Informatics(ICOEI), Tirunelveli, 2018: 1052-1057.
5 Doshi R, Apthorpe N, Feamster N. Machine learning DDoS detection for consumer internet of things devices[C]∥2018 IEEE Security and Privacy Workshops(SPW), San Francisco, CA, 2018: 29-35.
6 Özçelik M, Chalabianloo N, Gür G. Software-Defined edge defense against IoT-based DDoS[C]∥2017 IEEE International Conference on Computer and Information Technology(CIT), Helsinki, 2017: 308-313.
7 Mishra A, Dixit A. Resolving threats in IoT: ID spoofing to DDoS[C]∥2018 9th International Conference on Computing, Communication and Networking Technologies(ICCCNT), Bangalore, 2018: 1-7.
8 Ben S N, Biondi F, Bontchev V, et al. Detection of mirai by syntactic and behavioral analysis[C]∥2018 IEEE 29th International Symposium on Software Reliability Engineering(ISSRE), Memphis, TN, USA, 2018: 224-235.
9 Agrawal N, Tapaswi S. Low rate cloud DDoS attack defense method based on power spectral density analysis[J]. Information Processing Letters, 2018, 138: 44-50.
10 Hirakawa T, Ogura K, Bista B B, et al. A defense method against distributed slow HTTP DoS attack[C]∥2016 19th International Conference on Network-Based Information Systems(NBiS), Ostrava, 2016: 152-158.
11 Muraleedharan N, Janet B. Behaviour analysis of HTTP based slow denial of service attack[C]∥2017 International Conference on Wireless Communications, Signal Processing and Networking(WiSPNET), Chennai, 2017: 1851-1856.
12 Ahmed M E, Ullah S, Kim H. Statistical application fingerprinting for DDoS attack mitigation[J]. IEEE Transactions on Information Forensics and Security, 2019, 14(6): 1471-1484.
13 Kolias C, Kambourakis G, Stavrou A, et al. Intrusion detection in 802.11 networks: empirical evaluation of threats and a public dataset[J]. IEEE Communications Surveys & Tutorials, 2016, 18(1): 184-208.
14 Charles E. KDD Cup 1999: computer network intrusion detection[EB/OL]. [1999-09-01].
15 李金明, 王汝传. 基于Hurst参数的DoS/DDoS攻击实时检测技术研究[J]. 计算机工程与应用, 2007, 43(6): 20-23.
Li Jin-ming, Wang Ru-chuan. DoS/DDoS attack detection based on Hurst parameter[J]. Computer Engineering and Applications, 2007, 43(6): 20-23.
16 徐江平. 基于统计分析的分布式流量异常检测应用研究[D]. 成都： 电子科技大学通信与信息工程学院, 2015.
Xu Jiang-ping. Research on distributed traffic anomaly detection based on statistical analysis[D]. Chengdu: School of Communication and Information Engineering, University of Electronic Science and Technology of China, 2015.
[1] WANG Tian-hao, WANG Zhong-fu, WANG Yu-meng, YANG Kai-yu, GAO Yin-han, MA Xi-lai. Statistic analysis of cable bundle crosstalk based on polynomial chaos expansion [J]. 吉林大学学报(工学版), 2017, 47(5): 1568-1576.
[2] Li Hong-ping，Pei Yu-long，Yang Zhong-liang . Factors influencing free flow speed on expressway [J]. 吉林大学学报(工学版), 2007, 37(04): 772-776.
Viewed
Full text


Abstract

Cited
  Shared   
  Discussed   
No Suggested Reading articles found!
Copyright © Journal of Jilin University(Engineering and Technology Edition), All Rights Reserved.
Tel: +86-431-85095297　Fax: +86-431-85094074　E-mail: xbgxb@jlu.edu.cn
Powered by Beijing Magtech Co. Ltd