![](/images/graphics-bg.png)
CCID: Cross-Correlation Identity Distinction Method for Detecting Shrew DDoS
Joint Authors
Yi, Ping
Zou, Futai
Zhu, Ting
Huang, Cheng
Yao, Yao
Wang, Wei
Source
Wireless Communications and Mobile Computing
Issue
Vol. 2019, Issue 2019 (31 Dec. 2019), pp.1-9, 9 p.
Publisher
Hindawi Publishing Corporation
Publication Date
2019-02-20
Country of Publication
Egypt
No. of Pages
9
Main Subjects
Information Technology and Computer Science
Abstract EN
This study presents a new method for detecting Shrew DDoS (Distributed Denial of Service) attacks and analyzes the characteristics of the Shrew DDoS attack.
Shrew DDoS is periodic to be suitable for the server’s TCP (Transmission Control Protocol) timer.
It has lower maximum to bypass peak detection.
This periodicity makes it distinguishable from normal data packets.
By proposing the CCID (Cross-Correlation Identity Distinction) method to distinguish the flow properties, it quantifies the difference between a normal flow and an attack flow.
Simultaneously, we calculated the cross-correlation between the attack flow and the normal flow in three different situations.
The server can use its own TCP flow timer to construct a periodic attack flow.
The cross-correlation between Gaussian white noise and simulated attack flow is less than 0.3.
The cross-correlation between single-door function and simulated attack flow is 0.28.
The cross-correlation between actual attack flow and simulated attack flow is more than 0.8.
This shows that we can quantitatively distinguish the attack effects of different signals.
By testing 4 million data, we can prove that it has a certain effect in practice.
American Psychological Association (APA)
Huang, Cheng& Yi, Ping& Zou, Futai& Yao, Yao& Wang, Wei& Zhu, Ting. 2019. CCID: Cross-Correlation Identity Distinction Method for Detecting Shrew DDoS. Wireless Communications and Mobile Computing،Vol. 2019, no. 2019, pp.1-9.
https://search.emarefa.net/detail/BIM-1212233
Modern Language Association (MLA)
Huang, Cheng…[et al.]. CCID: Cross-Correlation Identity Distinction Method for Detecting Shrew DDoS. Wireless Communications and Mobile Computing No. 2019 (2019), pp.1-9.
https://search.emarefa.net/detail/BIM-1212233
American Medical Association (AMA)
Huang, Cheng& Yi, Ping& Zou, Futai& Yao, Yao& Wang, Wei& Zhu, Ting. CCID: Cross-Correlation Identity Distinction Method for Detecting Shrew DDoS. Wireless Communications and Mobile Computing. 2019. Vol. 2019, no. 2019, pp.1-9.
https://search.emarefa.net/detail/BIM-1212233
Data Type
Journal Articles
Language
English
Notes
Includes bibliographical references
Record ID
BIM-1212233