Detecting DDoS Attack Based on Empirical Mode Decomposition

The paper proposes to apply Empirical Mode Decomposition (EMD) to network traffic signal. Then the corresponding intrinsic mode functions (IMFs) are obtained to calculate their Hurst index based on which the influence to the IMF Hurst after DDoS attack was analyzed. Finally, it makes a judgment on whether a DDoS attack happened or not by solving the IMF Hurst index of the unsure sequence. Experimental results show that, compared with the original signal Hurst index assay, this method can increase detection precision and CI, reduce the rate of false positives and false negative. The method behaves well in distinguishing attacked traffic from normal ones.