SSE Presentation

 Introduction
 Problems caused by DoS attack
 Algorithm for detection
 Breakout detection
 Time series models
 Error rate and Lyapunov Exponent
 Conclusion.
What is Denial of Service(DoS) attack?
A Denial of Service is any type of attack where the attackers
attempt to prevent actual users accessing the services. In a Dos
attack, the attacker usually sends excessive messages asking
the network or server to authenticate the invalid request. Most
Commonly known DoS attack is ping attack. This can be Done
through ping command in linux.
DoS attack often last for days, weeks and monts, making them
extremely destructive to any online organisation.
Amongst other things DoS attack can lead to loss of revenue,
erode consumer trust, cause long term reputation damage in
business. Detection of DoS attack itself is a big problem.
Following content explains about PRK algorithm for detection.
Breakout-detection uses E-divisive with medians which helps
in the points which are highly deviating from the current
scenario at particular instance. This may help us in directly
finding the DoS attack point. This may reduce the time of
applying the whole upcomming process for detection.
The name suggests, it involve working on time based data, to derive
the hidden insights. These are very useful models when you have
serially correlated data. They help in forecating the data and
predicting the furture values. To detect DoS attack dataset is the
information of packet flow which is serially correlated.
The main important time series models are holt winters and
ARIMA(Auto Regression Time Series Model). Apply the models on
sample of data and find the best model for forecasting using RMSE
values and forecast the data.
Calculate error rate by substracting the actual data and
forecasting data. This value is used in lyapunov exponent
calculation. The positive value of luapunov exponent shows
that predected value is deviated from actual value which
shows the chaos nature. Negative values shows the normal
behaviour of the system.
Detection of DoS attack is itself a big problem. We can use
PRK algorithm which uses breakout-detection, Time series
models and lyapunov exponent for the detection of attack
point and helps the packet analisers to detect the attackers.
we can extend this algorithm for detecting DoS attacks on the
fly.
Thank You