Cover Image

Identification of distributed denial of services anomalies by using combination of entropy and sequential probabilities ratio test methods

One of the most dangerous kinds of attacks affecting computers is a distributed denial of services (DDoS) attack. The main goal of this attack is to bring the targeted machine down and make their services unavailable to legal users. This can be accomplished mainly by directing many machines to send...

Full description

Saved in:
Bibliographic Details
Main Authors: Ali, Basheer Husham, Sulaiman, Nasri, Al-Haddad, Syed Abdul Rahman, Atan, Rodziah, Mohd Hassan, Siti Lailatul, Alghrairi, Mokhalad Khaleel
Format: Article
Language:English
Published: Multidisciplinary Digital Publishing Institute 2021
Online Access:http://psasir.upm.edu.my/id/eprint/97599/1/ABSTRACT.pdf
http://psasir.upm.edu.my/id/eprint/97599/
https://www.mdpi.com/1424-8220/21/19/6453
Tags: Add Tag
No Tags, Be the first to tag this record!
id my.upm.eprints.97599
record_format eprints
spelling my.upm.eprints.975992022-11-25T08:24:47Z http://psasir.upm.edu.my/id/eprint/97599/ Identification of distributed denial of services anomalies by using combination of entropy and sequential probabilities ratio test methods Ali, Basheer Husham Sulaiman, Nasri Al-Haddad, Syed Abdul Rahman Atan, Rodziah Mohd Hassan, Siti Lailatul Alghrairi, Mokhalad Khaleel One of the most dangerous kinds of attacks affecting computers is a distributed denial of services (DDoS) attack. The main goal of this attack is to bring the targeted machine down and make their services unavailable to legal users. This can be accomplished mainly by directing many machines to send a very large number of packets toward the specified machine to consume its resources and stop it from working. We implemented a method using Java based on entropy and sequential probabilities ratio test (ESPRT) methods to identify malicious flows and their switch interfaces that aid them in passing through. Entropy (E) is the first technique, and the sequential probabilities ratio test (SPRT) is the second technique. The entropy method alone compares its results with a certain threshold in order to make a decision. The accuracy and F-scores for entropy results thus changed when the threshold values changed. Using both entropy and SPRT removed the uncertainty associated with the entropy threshold. The false positive rate was also reduced when combining both techniques. Entropy-based detection methods divide incoming traffic into groups of traffic that have the same size. The size of these groups is determined by a parameter called window size. The Defense Advanced Research Projects Agency (DARPA) 1998, DARPA2000, and Canadian Institute for Cybersecurity (CIC-DDoS2019) databases were used to evaluate the implementation of this method. The metric of a confusion matrix was used to compare the ESPRT results with the results of other methods. The accuracy and f-scores for the DARPA 1998 dataset were 0.995 and 0.997, respectively, for the ESPRT method when the window size was set at 50 and 75 packets. The detection rate of ESPRT for the same dataset was 0.995 when the window size was set to 10 packets. The average accuracy for the DARPA 2000 dataset for ESPRT was 0.905, and the detection rate was 0.929. Finally, ESPRT was scalable to a multiple domain topology application. Multidisciplinary Digital Publishing Institute 2021 Article PeerReviewed text en http://psasir.upm.edu.my/id/eprint/97599/1/ABSTRACT.pdf Ali, Basheer Husham and Sulaiman, Nasri and Al-Haddad, Syed Abdul Rahman and Atan, Rodziah and Mohd Hassan, Siti Lailatul and Alghrairi, Mokhalad Khaleel (2021) Identification of distributed denial of services anomalies by using combination of entropy and sequential probabilities ratio test methods. Sensors, 21 (19). pp. 1-17. ISSN 1424-8220 https://www.mdpi.com/1424-8220/21/19/6453 10.3390/s21196453
institution Universiti Putra Malaysia
building UPM Library
collection Institutional Repository
continent Asia
country Malaysia
content_provider Universiti Putra Malaysia
content_source UPM Institutional Repository
url_provider http://psasir.upm.edu.my/
language English
description One of the most dangerous kinds of attacks affecting computers is a distributed denial of services (DDoS) attack. The main goal of this attack is to bring the targeted machine down and make their services unavailable to legal users. This can be accomplished mainly by directing many machines to send a very large number of packets toward the specified machine to consume its resources and stop it from working. We implemented a method using Java based on entropy and sequential probabilities ratio test (ESPRT) methods to identify malicious flows and their switch interfaces that aid them in passing through. Entropy (E) is the first technique, and the sequential probabilities ratio test (SPRT) is the second technique. The entropy method alone compares its results with a certain threshold in order to make a decision. The accuracy and F-scores for entropy results thus changed when the threshold values changed. Using both entropy and SPRT removed the uncertainty associated with the entropy threshold. The false positive rate was also reduced when combining both techniques. Entropy-based detection methods divide incoming traffic into groups of traffic that have the same size. The size of these groups is determined by a parameter called window size. The Defense Advanced Research Projects Agency (DARPA) 1998, DARPA2000, and Canadian Institute for Cybersecurity (CIC-DDoS2019) databases were used to evaluate the implementation of this method. The metric of a confusion matrix was used to compare the ESPRT results with the results of other methods. The accuracy and f-scores for the DARPA 1998 dataset were 0.995 and 0.997, respectively, for the ESPRT method when the window size was set at 50 and 75 packets. The detection rate of ESPRT for the same dataset was 0.995 when the window size was set to 10 packets. The average accuracy for the DARPA 2000 dataset for ESPRT was 0.905, and the detection rate was 0.929. Finally, ESPRT was scalable to a multiple domain topology application.
format Article
author Ali, Basheer Husham
Sulaiman, Nasri
Al-Haddad, Syed Abdul Rahman
Atan, Rodziah
Mohd Hassan, Siti Lailatul
Alghrairi, Mokhalad Khaleel
spellingShingle Ali, Basheer Husham
Sulaiman, Nasri
Al-Haddad, Syed Abdul Rahman
Atan, Rodziah
Mohd Hassan, Siti Lailatul
Alghrairi, Mokhalad Khaleel
Identification of distributed denial of services anomalies by using combination of entropy and sequential probabilities ratio test methods
author_facet Ali, Basheer Husham
Sulaiman, Nasri
Al-Haddad, Syed Abdul Rahman
Atan, Rodziah
Mohd Hassan, Siti Lailatul
Alghrairi, Mokhalad Khaleel
author_sort Ali, Basheer Husham
title Identification of distributed denial of services anomalies by using combination of entropy and sequential probabilities ratio test methods
title_short Identification of distributed denial of services anomalies by using combination of entropy and sequential probabilities ratio test methods
title_full Identification of distributed denial of services anomalies by using combination of entropy and sequential probabilities ratio test methods
title_fullStr Identification of distributed denial of services anomalies by using combination of entropy and sequential probabilities ratio test methods
title_full_unstemmed Identification of distributed denial of services anomalies by using combination of entropy and sequential probabilities ratio test methods
title_sort identification of distributed denial of services anomalies by using combination of entropy and sequential probabilities ratio test methods
publisher Multidisciplinary Digital Publishing Institute
publishDate 2021
url http://psasir.upm.edu.my/id/eprint/97599/1/ABSTRACT.pdf
http://psasir.upm.edu.my/id/eprint/97599/
https://www.mdpi.com/1424-8220/21/19/6453
_version_ 1751538274832220160
score 13.211869

Similar Items