Application of Hurst parameter and fuzzy logic for denial of service attack detection

Normal legitimate network traffic on both LANs and wide area IP networks has self-similarity feature i.e. scale invariance property. Superimposition of legitimate traffic and high intensity non-self-similar traffic results into degradation in self-similarity of normal traffic. Rescaled range method is used to calculate Hurst parameter and its deviation from normal value. Two inputs and one output fuzzy logic block is used to determine the intensity of Denial of Service (DoS) attack. In order to detect self-similarity, we have used synthetic self-similar data generated using Fractional Gaussian Noise process and to identify existence of Denial of Service, DARPA IDS evaluation dataset is used. C code for statistical method is implemented on DSP Processor TMS320C6713 platform.