title: Effectiveness of entropy-based features in high-and low-intensity DDoS attacks detection

authors: Koay, Abigail

subjects: computer science

abstract: DDoS attack detection using entropy-based features in network traffic has become a popular approach among researchers in the last five years. The use of traffic distribution features constructed using entropy measures has been proposed as a better approach to detect Distributed Denial of Service (DDoS) attacks compared to conventional volumetric methods, but it still lacks in the generality of detecting various intensity DDoS attacks accurately. In this paper, we focus on identifying effective entropy-based features to detect both high- and low-intensity DDoS attacks by exploring the effectiveness of entropy-based features in distinguishing the attack from normal traffic patterns. We hypothesise that using different entropy measures, window sizes, and entropy-based features may affect the accuracy of detecting DDoS attacks. This means that certain entropy measures, window sizes, and entropy-based features may reveal attack traffic amongst normal traffic better than the others. Our experimental results show that using Shannon, Tsallis and Zhou entropy measures can achieve a clearer distinction between DDoS attack traffic and normal traffic than Rényi entropy. In addition, the window size setting used in entropy construction has minimal influence in differentiating between DDoS attack traffic and normal traffic. The result of the effectiveness ranking shows that the commonly used features are less effective than other features extracted from traffic headers.

text: Effectiveness of entropy-based features in high-and low-intensity DDoS attacks detection DDoS attack detection using entropy-based features in network traffic has become a popular approach among researchers in the last five years. The use of traffic distribution features constructed using entropy measures has been proposed as a better approach to detect Distributed Denial of Service (DDoS) attacks compared to conventional volumetric methods, but it still lacks in the generality of detecting various intensity DDoS attacks accurately. In this paper, we focus on identifying effective entropy-based features to detect both high- and low-intensity DDoS attacks by exploring the effectiveness of entropy-based features in distinguishing the attack from normal traffic patterns. We hypothesise that using different entropy measures, window sizes, and entropy-based features may affect the accuracy of detecting DDoS attacks. This means that certain entropy measures, window sizes, and entropy-based features may reveal attack traffic amongst normal traffic better than the others. Our experimental results show that using Shannon, Tsallis and Zhou entropy measures can achieve a clearer distinction between DDoS attack traffic and normal traffic than Rényi entropy. In addition, the window size setting used in entropy construction has minimal influence in differentiating between DDoS attack traffic and normal traffic. The result of the effectiveness ranking shows that the commonly used features are less effective than other features extracted from traffic headers.

year: 2019

title: Submission to Environment Committee on Inquiry on the Natural and Built Environments Bill

authors: Daya-Winterbottom, Trevor

abstract: Making submissions on the NBA exposure draft is difficult in the abstract, and the right to make further submissions on the full text of the Bill (and related legislation) when introduced into Parliament is reserved. For the reasons given below, the NBA exposure draft does not (as currently drafted) achieve the objectives set out in the terms of reference for the Parliamentary inquiry. Some suggested amendments to the NBA exposure draft are made in this submission. While the terms of reference for the Parliamentary inquiry do not include the counterfactual of amending the Resource Management Act 1991 (RMA) to achieve the stated objectives, an informed and critical appraisal of this approach was covered by Simon Upton in his RMLA Salmon Lecture 2020.1

text: Submission to Environment Committee on Inquiry on the Natural and Built Environments Bill Making submissions on the NBA exposure draft is difficult in the abstract, and the right to make further submissions on the full text of the Bill (and related legislation) when introduced into Parliament is reserved. For the reasons given below, the NBA exposure draft does not (as currently drafted) achieve the objectives set out in the terms of reference for the Parliamentary inquiry. Some suggested amendments to the NBA exposure draft are made in this submission. While the terms of reference for the Parliamentary inquiry do not include the counterfactual of amending the Resource Management Act 1991 (RMA) to achieve the stated objectives, an informed and critical appraisal of this approach was covered by Simon Upton in his RMLA Salmon Lecture 2020.1

year: 2021-08-04

title: Location of Te Wahitapu Stream and other possible streams in 1877

authors: de Lange, Willem P.

abstract: Review of evidence to establish, with as much confidence as possible, the path of the Te Wahitapu Stream at Matapouri in 1877. The review also examines if other streams may have been present on or in the vicinity of Te Wahitapu Stream in 1877, and if the 1877 or later tsunami may have latered the course of the boundary stream.

text: Location of Te Wahitapu Stream and other possible streams in 1877 Review of evidence to establish, with as much confidence as possible, the path of the Te Wahitapu Stream at Matapouri in 1877. The review also examines if other streams may have been present on or in the vicinity of Te Wahitapu Stream in 1877, and if the 1877 or later tsunami may have latered the course of the boundary stream.

year: 2009