Distributed denial of service attack detection based on IP Flow Interaction

Distributed denial of service (DDoS) attack is one of the major threats to the current Internet. It is challenging to detect DDoS attacks accurately and quickly. We propose a novel IP Flow Interaction Feature algorithm (FIF) based on multiple features of DDoS attack flows via IP addresses and ports. To increase the detection accuracy in various conditions, we describe the state characteristics of network flows using FIF time series, and a simple but efficient FIF-based DDoS attack detection model (FDAD) is proposed by associating with contextual information in observed FIF time series. Finally, we present a simple alarm evaluation mechanism based on the alarm frequency and time interval. Our analysis and experiment results demonstrate that FIF can well reflect the characteristics of DDoS attack flow and normal flow and can distinguish normal flow from attack flow effectively. FDAD can identify normal flow and abnormal flow with DDoS attack flow quickly, accurately, and reduce false alarm rate drastically.