Detecting DoS and DDoS Attacks Using Chi-Square

In this paper, we propose an agent_based distributed intrusion detection architecture, which detects DoS/DDoS attacks by comparing source IP addresses´ normal and current connection frequencies. First, we collect source IPs´ packet statistics to obtain their normal packet distribution. When current statistics suddenly increase, very often it is an attack. Experimental results show that this approach can effectively detect DoS/DDoS attacks.