1. DDoS flooding attack detection through a step-by-step investigation
IEEE 2011
Jae-Hyun Jun, Hyunju Oh, Sung-Ho Kim
許哲鳴
Page 1/16

2. Outline Introduction Principle of entropy
DDoS attack detection method by using entropy
The result of experiment
Conclusion
Page 2/16

3. Introduction Distributed Denial of Service (DDoS)
Need an efficient real-time detection.
Entropy-based detection mechanism
Page 3/16

4. Entropy(熵) Entropy H is defined as
Pi is the probability mass function which is a chance to be observed during random period.
If entropy decreases, uncertainty decreases.
Page 4/16

5. DDoS attack detection method by using entropy
Page 5/16

6. DDoS attack detection method by using entropy
Step 1:
Volume threshold
If collected traffic amount during time window is
over volume threshold (T1), it judges as first danger
and it sends them to next detecting step
Page 6/16

7. DDoS attack detection method by using entropy
Step 2:
entropy threshold (T2) of destination IP address.
Entropy decreases: If traffic in router are heading
to some certain IP address. Danger!
Entropy increases: If traffic in router are heading
to many destination IP address.
Page 7/16

8. DDoS attack detection method by using entropy
Step 3:
entropy threshold (T3) of transmission port number.
Entropy decreases: If a packet has few
transmission numbers.
Entropy increases: If a packet has various
transmission numbers. Danger!
Page 8/16

9. DDoS attack detection method by using entropy
Step 4
To compare the packet creation rate threshold (T4)
per second
Page 9/16

10. The result of experiment
Create normal traffic for web service
Time widow = 6 seconds
Create DDoS attack
Page 10/16

11. The result of experiment
Volume threshold T1 = 1500
Traffic amount flow in router_5 when DDoS attack
Page 11/16

12. The result of experiment
threshold T2 = 0.4
The entropy of traffic destination IP address flowed in router_5
when DDoS attack happens
Page 12/16

13. The result of experiment
threshold T3 = 0.8
The entropy of source port number of traffic judged the second danger
Page 13/16

14. The result of experiment
threshold T4 = 60
Packet creation rate
Page 14/16

15. The result of experiment
The traffic came to sever after applying DDoS attack detection method by using entropy
Page 15/16

16. Conclusion
The detection method based on entropy is better than the detection method based on volume.
There will be more necessity to study detection method with entropy.
Page 16/16