Detecting Coordinated Distributed Multiple Attacks

This paper describes results concerning the robustness and generalization capabilities of kernel methods in detecting coordinated distributed multiple attacks (CDMA) using network audit trails. We also evaluate the performance of denial of service detection models built using the key features in detecting a new attack scheme; CDMA. The data is generated by carrying out the attack (CDMA) in a closed environment at New Mexico Tech Information Assurance Laboratory. We use traditional support vector machines (SVM), biased support vector machine (BSVM) and leave-one-out model selection for support vector machines (looms) for model selection. We also evaluate the impact of kernel type and parameter values on the accuracy of a support vector machine (SVM) performing CDMA classification. We show that classification accuracy varies with the kernel type and the parameter values; thus, with appropriately chosen parameter values, CDMA can be detected by SVMs and BSVMs with higher accuracy and lower rates of false alarms.