On the Detection of DDoS Attackers for Large-Scale Networks

The distributed denial of service attacks (DDoS) is one of the major threats to network security that exhausts network bandwidth and resources. The current detection schemes are sensitive to the number of attackers and may lead to a high false positive probability especially for large-scale networks with huge number of attackers. It is notable, however, that in the current DDoS attacks, the flooding rate is usually distributed among many flooding sources to make the detection more difficult. In this paper we propose a more efficient detection scheme for Web service DDoS attackers. The proposed scheme is based on the number of incoming requests to the server with the consideration of the clients activity (active and non-active clients during the detection time). To make our scheme scalable to large-scale networks, the non-adaptive group testing theory is applied to detect attackers using low state overhead. Extensive trace-driven simulation has been conducted on real Web trace to demonstrate the efficiency of the proposed scheme in terms of its false positive, false negative probabilities and also detection time.