Detecting Flood Attacks through New Density-Pattern Based Approach

Flood attacks are common threats to Internet, which has necessitated the need for visual analysis within an intrusion detection system to identify these attacks patterns. The challenges are how to increase the accuracy of detection and how to visualize and present the patterns of flood attack for early detection. In this paper, we introduce a Two-Density model that contains two coefficients: sending-density and receiving-density for the network traffic analysis during flood attacks. The attack pattern is established based on these two coefficients which are also displayed in our clustering visualization graph. The experimental results are presented to demonstrate that the proposed new model significantly improves the detection of flood attacks and provides a better understanding of the nature of flood attacks on networks.