Predicting Number of Attackers Using Regression Anlaysis

Anomaly based DDoS detection involves deviation from thresholds set in normal condition. This deviation can be used for estimating number of attackers. We use ns-2 as simulation test bed for launching DDoS attacks using well known DDoS attack tools with varied number of attackers. A new relationship is established between estimated number of attackers and drift from normal value using Regression. Error in relationship is graphically depicted by highlighting number of false positives/negatives. An Internet type topology is used to test our scheme.