Title :
Detection of anomalous packet traffic via entropy
Author :
Lawniczak, Anna T. ; Wu, Hao ; Di Stefano, Bruno N.
Author_Institution :
Dept. of Math. & Stat., Univ. of Guelph, Guelph, ON
Abstract :
We study if information entropy of packet traffic passing through selected set of routers may detect anomalous packet traffic (e.g., distributed denial-of-service (DDoS) attacks) in a packet switching network (PSN) model. Given a certain PSN model setup (i.e., topology, routing algorithm, and source load value) a ldquonaturalrdquo entropy profile of normal packet traffic monitored at selected routers characterizes normal operation of PSN model. When entropy of packet traffic deviates significantly from this ldquonaturalrdquo profile it means that some anomaly in packet traffic emerges. Our simulations of ping DDoS attacks show that after start of attacks the entropy of packet traffics monitored network-wide at relatively small sets of routers may significantly drop and that it is easier to detect these drops if static routing is used instead of dynamic routing. Thus, for detection of DDoS attacks and other anomalous packet traffic information entropy of packet traffic monitored network-wide at properly selected routers can be a useful tool.
Keywords :
entropy; packet switching; telecommunication network routing; telecommunication security; telecommunication traffic; DDoS attack; anomalous packet traffic; distributed denial-of-service; information entropy; packet switching network; static routing; Computer crime; Cost function; Information entropy; Internet; Monitoring; Network topology; Packet switching; Routing; Telecommunication traffic; Traffic control; detection; distributed denial of service attack; entropy; packet switching network;
Conference_Titel :
Electrical and Computer Engineering, 2009. CCECE '09. Canadian Conference on
Conference_Location :
St. John´s, NL
Print_ISBN :
978-1-4244-3509-8
Electronic_ISBN :
0840-7789
DOI :
10.1109/CCECE.2009.5090107