엔트로피를 이용한 분산 서비스 거부 공격 탐지에 효과적인 특징 생성 방법 연구
An Effective Feature Generation Method for Distributed Denial of Service Attack Detection using Entropy
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
Malicious bot programs, the source of distributed denial of service attack, are widespread and the number of PCs which were infected by malicious bot program are increasing geometrically thesedays. The continuous distributed denial of service attacks are happened constantly through these bot PCs and some financial incident cases have found lately. Therefore researches to response distributed denial of service attack are necessary so we propose an effective feature generation method for distributed denial of service attack detection using entropy. In this paper, we apply our method to both the DARPA 2000 datasets and also the distributed denial of service attack datasets that we composed and generated ourself in general university. And then we evaluate how the proposed method is useful through classification using bayesian network classifier.
Abstract
Malicious bot programs, the source of distributed denial of service attack, are widespread and the number of PCs which were infected by malicious bot program are increasing geometrically thesedays. The continuous distributed denial of service attacks are happened constantly through these bot PCs and some financial incident cases have found lately. Therefore researches to response distributed denial of service attack are necessary so we propose an effective feature generation method for distributed denial of service attack detection using entropy. In this paper, we apply our method to both the DARPA 2000 datasets and also the distributed denial of service attack datasets that we composed and generated ourself in general university. And then we evaluate how the proposed method is useful through classification using bayesian network classifier.
참고문헌 (22)
- GJ Park, "Internet security incident trends and analysis", Korea Internet Security Center, ~ (2009)
- Mindi McDowell, "Understanding denial of service attacks", US-CERT, Cyber Security ST04-015, ~ (2004)
- MH Lee, "Internet and security issue", National Internet Development Agency of Korea, 1 (2009)
- C.E.Shannon, "The mathematical theory of communication" (1963), University of Illinois Press
- Laura Feinstein, "Statistical approaches to DDoS attack detection and Response", IEEE Computer Society, ~ (2003)
- Liying Li, "DDoS attack detection algorithms based on entropy computing", ICICS Electronic Edition, 452~466 (2007)
- KS Lee, "DDoS attack detection method using cluster analysis", ScienceDirect Expert Systems with Application 34, ~ (2008)
- J.H.Ward Jr., "Hierarchical grouping to optimize an objective function", Journal of the American Statistical Association, 58, pp.236~244 (1963)
- Cubic clustering criterion, "SAS Institute Inc.", SAS, 56~, pp.Technical Report A-108 (1983)
- Ping DU, "IP packet size entropy-based scheme for detection of DoS", DDoS attacks, 2008, pp.E91-D(5), ~
- N.Friedman, "Bayesian network classifiers", Machine Learning, 29, pp.131~163 (1997)
- T.Joachims, "Making large-scale support vector machine learning practical,Advances in kernel methods:support vector learning", pp.169~184 (1999), MIT Press
- CH Park, "Efficient linear and nonlinear feature extraction and its application to fingerprint classification", University of Minnesota, 129~ (2004)
- 정만현, "커널 기반 데이터를 이용한 효율적인 서비스 거부 공격 탐지 방법에 관한 연구", 정보보호학회논문지, 19(1), pp.71~80 (2009), 한국정보보호학회
- B Cha, "Network-based anomaly intrusion detection improvement by bayesian network and indirect relation", Lecture Notes in Computer Science, 141~148 (2007)
- S Benferhat, "Novel and anomalous behavior detection using bayesian network classifiers", International Conference on Security and Cryptography (2008)
- "MIT/LL 2000 DARPA Intrusion Detection Scenario Specific Data Sets"[URL]
- 한찬규, "엔트로피 기반의 이상징후 탐지 시스템", 정보과학회논문지 : 정보통신, 36(3), pp.173~183 (2009), 한국정보과학회
- TH Kim, "Detecting DDoS attacks using dispersible traffic matrix and weighted moving average", Advances in Information Security and Assurance, 290~300 (2009)
- S Terry Brugger, "An assessment of the DARPA IDS evaluation dataset using snort", UCDAVIS department of Computer Science, ~ (2007)
- Mark Hall, "The WEKA data mining software", SIGKDD Explorations, 11(1), pp.10~18 (2009)