New Trends In Computer Networks

JUNGTAEK SEO AND CHEOLHO LEE
National Security Research Institute KT 463-1 Jeonmin-dong, Yuseong-gu, Daejeon, 305 811, Republic of KOREA E-mail: seojt{chlee}@etri.re.kr
TAESHIK SHON AND JONGSUB MOON
CIST, KOREA University 1-Ga, Anam-dong, Sungbuk-Gu, Seoul, Republic of KOREA E-mail: 743zh2k{jsmoon}@korea.ac.kr
The current Internet infrastructure is suffering from various types of Distributed Denial of Service (DDoS) attacks. Internet worms are one of the most crucial problems in the field of computer security today. Worms can be propagated so fast that most Internet services over the world may be disabled by DDoS effects from the self-propagation. In our earlier research, we presented Traffic Rate Analysis (TRA) to analyze the characteristics of network traffic for DDoS attacks. In this research, we propose Support Vector Machine (SVM) approach with TRA to automatically detect DDoS attacks. Experimental results show that SVM can be a highly useful classifier for detecting DDoS attacks.
As we can see in the incidents of Distributed Denial of Service (DDoS) attacks against commercial web sites such as Yahoo, e-Bay, and E*Trade, computing resources connected to the Internet are vulnerable to DDoS attacks [3, 5, 11]. DDoS attacks can temporarily disable the network services or damage systems by flooding a huge number of network packets for several minutes or longer.
Since these DDoS attacks are harmful to almost all networked systems which have limited computing resources (e.g. network bandwidth, memory, CPU, etc), these attacks are regarded as a serious problem, and thus much research is in progress to detect and prevent...