A P2P-Based Distributed Detection Scheme against DDoS Attack

The distributed hosts in the Internet are organized into a P2P network by chord protocol for detection. The detection node uses the CUSUMpsilas sensitivity to the slight change to detect the change in the amount of packets to destination address. Upon the abnormality detected, it is broadcast based on the node trust. The response nodes use space similarity algorithm to calculate the similarity between request node and response node. The victim end makes a comprehensive decision whether the DDoS attack happens.The scheme detects DDoS at the source end; it can prevent the DDoS attack by means of forged IP address and random IP address and trace the origin of the attack hosts. The experimental results indicate that our scheme has better performance than CUSUM and time similarity algorithm single deployed. It can reach as high as 96.1% detection rate and with only 6.9% false positives rate.