Using DBSCAN clustering algorithm in detecting DDoS attack

Abstract EN

Distributed Denial of Service (DDoS) attack, has become one of the major threats to the Internet.

It makes a victim to deny providing normal services in the Internet by generate huge useless packets by a large number of agents and can easily exhaust the computing and communication resources of a victim .In this paper we develop method to detect DDoS attacks accurately and proactively.

This can be achieved using entropy concept to measure abnormal change in traffic according to the phases of the attack , and then these traffics are clustered using DBSCAN algorithm.

The patterns for DDoS traffic is created based on extracted centroid points from each cluster, which are used in testing phase using Distances-based classification .

This system is characterized processing and analyzing of high-speed network traffic (based on entropy approach ), discovering and accurately identifying new types of DDoS attack to reduce the false alarms (FA) , detecting this attack in real time and making use of pattern in the train stage to increase detection ratio.