Real time detection and classification of DDoS attacks using enhanced SVM with string kernels

Distributed Denial of Service (DDoS) attack is a continuous critical threat to the internet. Application layer DDoS Attack is derived from the lower layers. Application layer based DDoS attacks use legitimate HTTP requests after establishment of TCP three way hand shaking and overwhelms the victim resources, such as sockets, CPU, memory, disk, database bandwidth. Network layer based DDoS attacks sends the SYN, UDP and ICMP requests to the server and exhausts the bandwidth. Normal profile is created from user´s access behavior attributes which is the base line to differentiate DDoS attacks from flash crowd. An anomaly detection mechanism is proposed in this paper to detect DDoS attacks using Enhanced Support Vector Machine (ESVM) with string kernels. Normal user access behavior attributes is used as training samples for ESVM, which produces the model file. Data collected during normal and attack is used as test samples for ESVM. Application and Network layer DDoS attacks are classified with classification accuracy of 99% with ESVM.