Distributed Denial of Service Attack Detection

<p>Distributed Denial of Service (DDoS) attacks on web applications has been a persistent threat. Successful attacks can lead to inaccessible service to legitimate users in time and loss of business reputation. Most research effort on DDoS focused on network layer attacks. Existing approaches on application layer DDoS attack mitigation have limitations such as the lack of detection ability for low rate DDoS and not being able to detect attacks targeting resource files. In this work, we propose DDoS attack detection using concepts from information retrieval and machine learning. We include two popular concepts from information retrieval: Term Frequency (TF)-Inverse Document Frequency (IDF) and Latent Semantic Indexing (LSI). We analyzed web server log data generated in a distributed environment. Our evaluation results indicate that while all the approaches can detect various ranges of attacks, information retrieval approaches can identify attacks ongoing in a given session. All the approaches can detect three well known application level DDoS attacks (trivial, intermediate, advanced). Further, these approaches can enable an administrator identifying new pattern of DDoS attacks.</p>

Name thesis:degree_name

Master of Science in Information Technology (MSIT)

Level thesis:degree_level

Thesis

Discipline thesis:degree_discipline

Information Technology

Year dc:date.available

2020

Author dc:creator

• Blue, Travis

Contributors dc:contributor

• Hossain Shahriar
• Chi Zhang
• Seyedamin Pouriyeh

• Latent Semantic Index
• Term-Frequency
• Inverse Document Frequency
• Information Security

Repository record dc:identifier

https://digitalcommons.kennesaw.edu/msit_etd/6

OAI identifier oai:identifier

oai:digitalcommons.kennesaw.edu:msit_etd-1007