# Note on Studying Change Point of LRD Traffic Based on Li's Detection of DDoS Flood Attacking

Authors: Zhengmin Xia; Songnian Lu; Junhua Tang
Journal: Mathematical Problems in Engineering
 (2010)

---

## Abstract

Distributed denial-of-service (DDoS) flood attacks remain great threats to the Internet. To ensure network usability and reliability, accurate detection of these attacks is critical. Based on Li's work on DDoS flood attack detection, we propose a DDoS detection method by monitoring the Hurst variation of long-range dependant traffic. Specifically, we use an autoregressive system to estimate the Hurst parameter of normal traffic. If the actual Hurst parameter varies significantly from the estimation, we assume that DDoS attack happens. Meanwhile, we propose two methods to determine the change point of Hurst parameter that indicates the occurrence of DDoS attacks. The detection rate associated with one method and false alarm rate for the other method are also derived. The test results on DARPA intrusion detection evaluation data show that the proposed approaches can achieve better detection performance than some well-known self-similarity-based detection methods.


---

## Body

## 1. Introduction

DDoS flood attacks have been one of the most frequently occurring attacks that badly threaten the stability of the Internet. For DDoS flood attack, an intruder undermines the availability of computer systems or services by exploiting the inherent weakness of the Internet system architecture, and overwhelming the target with a huge amount of traffic flows launched through multiple zombies. The attack process is a relatively simple, yet very powerful technique to attack the Internet resources. Therefore, accurate detection of these attacks is critical to the Internet community.As shown by Leland et al. [1], and supported by a number of later research [2–7], the measurements of local and wide-area network traffic, wire-line and wireless network traffic all demonstrate self-similarity and long range dependence (LRD) characteristics at large time scales. The work in [8] points out that self-similarity of the Internet traffic is attributed to a mixture of the actions of a number of individual users, hardware and software behaviors at their originating hosts, multiplexed through an interconnection network. In other words, this self-similarity always exists regardless of the network type, topology, size, protocol, or the type of services the network is carrying. On the other hand, it is reported in [9–15] that when DDoS attack happens, the self-similarity of network traffic will change significantly. Thus, by monitoring the change of the Hurst parameter, the key parameter to describe the self-similarity of a self-similar process, DDoS attacks may be detected.Much work has been done to detect DDoS attack by recognizing the pattern of self-similarity in the literature. In [16], Li deduced the statistical characteristic of network traffic autocorrelation function under normal condition and DDoS attack and gave the detection threshold based on the preselected detection rate and false alarm rate. In [11], Li quantitatively described the statistics of abnormal traffic and suggested that the Hurst parameter of network traffic under DDoS attack tends to be significantly smaller than that of normal traffic. Li also demonstrated in [11] that the average Hurst parameter of fixed number of normal traffic pieces follows Gaussian distribution at large time scales and when the attack occurs, this statistical property may in general change.Based on Li’s work, we propose a DDoS detection method by monitoring the Hurst variation. Specifically, we use an autoregressive (AR) system to estimate the Hurst parameter of normal traffic. If the actual Hurst parameter varies significantly from the estimation beyond a threshold, we assume that DDoS attack happens. Then we propose two methods to determine the change point of Hurst parameter, that is, to determine the threshold of Hurst variation that is used to distinguish attack traffic from normal traffic. The detection rate associated with one method and false alarm rate for the other method are also derived. The experiment results on Defense Advanced Research Projects Agency (DARPA) data sets indicate that the proposed detection methods are effective in detecting DDoS flood attacks, and can achieve better detection performance than some well-known self-similarity-based detection methods.The rest of this paper is organized as follows. Section2 briefly introduces the concept of self-similarity and the Hurst parameter estimation. Section 3 explains the proposed detection process based on the Hurst variation. Section 4 discusses the two methods for determining the change point of LRD traffic. Section 5 presents the performance evaluation and analysis of the proposed detection methods with traffic data from DARPA, followed by a brief conclusion in Section 6.


## 2. Preliminaries

### 2.1. Self-Similar Network Traffic

Self-similarity means that the sample paths of the processB(t) and those of rescaled version δHB(t/δ), obtained by simultaneously dilating the time axis t by a factor δ>0, and the amplitude axis by a factor δH, cannot be statistically distinguished from each other. Equivalently, it implies that an affine dilated subset of one sample path cannot be distinguished from its whole. H is called the Hurst parameter. For a general self-similar process, H measures the degree of self-similarity.Network traffic arrival process; is a discrete time process, so the discrete time self-similarity definition is given below. LetX={xi,i∈Z+}be a wide-sense stationary discrete stochastic traffic time series with constant mean μ, finite variance σ2, and autocorrelation function r(τ), (τ∈Z+). Let X(m)={xi(m),i,m∈Z+} be an m-order aggregate process of X; then(2.1)xi(m)=xmi-m+1+⋯+xmim.
For each m,X(m) defines a wide-sense stationary stochastic process with autocorrelation function r(m)(τ).Definition 2.1.
A second-order stationary processX is called exact second-order self-similar (ESOSS) with Hurst parameter H=1-β/2, 0<β<1 if the autocorrelation function satisfies
(2.2)r(m)(τ)=r(τ),
where r(τ)=[(τ+1)2-β-2τ2-β+(τ-1)2-β]/2 and m∈Z+.Definition 2.2.
A second-order stationary processX is called asymptotical second-order self-similar (ASOSS) with Hurst parameter H=1-β/2, 0<β<1 if the autocorrelation function satisfies
(2.3)limm→∞r(m)(τ)=r(τ),
where r(τ)=[(τ+1)2-β-2τ2-β+(τ-1)2-β]/2 and m∈Z+.In the field of network traffic theory, it is more practical to use ASOSS.


### 2.2. Hurst Parameter Estimation

To date, several methods have been proposed to estimate the Hurst parameter. Some of the most popular ones include the aggregated variance, local whittle, and the wavelet-based methods [17–21]. In this paper, we use the method proposed by Li [11] to estimate the Hurst parameter of network traffic. The estimation process is summarized as follows. For more information please refer to [11].Letr(τ) be the autocorrelation function of xi. Then
(2.4)r(τ)~cτ(2H-2),
where ~ stands for the asymptotical equivalence under the limit τ→∞, c>0, and H∈(0.5,1).By taking fractional Gaussian noise as an approximate model ofxi, one has
(2.5)σxi(m)2≈m2H-2σxi2,
where σxi(m)2 and σxi2 are the variances of m-order aggregate process xi(m) and xi.Divide the traffic seriesxi into N nonoverlapping sections, and each section is further divided into W nonoverlapping segments. Then the autocorrelation function of the wth segment in the nth section is given by(2.6)r(τ;Hw(n))=0.5[|τ+1|2Hw(n)-2|τ|2Hw(n)+|τ-1|2Hw(n)],
where Hw(n) is the Hurst parameter of the wth segment in the nth section traffic piece. Let J[Hw(n)]=∑τ[r(τ;Hw(n))-r(τ)]2 be the cost function. Then one has(2.7)Hw(n)=argminJ[Hw(n)].AveragingHw(n) in terms of w yields(2.8)H(n)=1W∑w=1WHw(n),
where H(n)(n=1,…,N) represents the Hurst parameter in the nth section.


## 2.1. Self-Similar Network Traffic

Self-similarity means that the sample paths of the processB(t) and those of rescaled version δHB(t/δ), obtained by simultaneously dilating the time axis t by a factor δ>0, and the amplitude axis by a factor δH, cannot be statistically distinguished from each other. Equivalently, it implies that an affine dilated subset of one sample path cannot be distinguished from its whole. H is called the Hurst parameter. For a general self-similar process, H measures the degree of self-similarity.Network traffic arrival process; is a discrete time process, so the discrete time self-similarity definition is given below. LetX={xi,i∈Z+}be a wide-sense stationary discrete stochastic traffic time series with constant mean μ, finite variance σ2, and autocorrelation function r(τ), (τ∈Z+). Let X(m)={xi(m),i,m∈Z+} be an m-order aggregate process of X; then(2.1)xi(m)=xmi-m+1+⋯+xmim.
For each m,X(m) defines a wide-sense stationary stochastic process with autocorrelation function r(m)(τ).Definition 2.1.
A second-order stationary processX is called exact second-order self-similar (ESOSS) with Hurst parameter H=1-β/2, 0<β<1 if the autocorrelation function satisfies
(2.2)r(m)(τ)=r(τ),
where r(τ)=[(τ+1)2-β-2τ2-β+(τ-1)2-β]/2 and m∈Z+.Definition 2.2.
A second-order stationary processX is called asymptotical second-order self-similar (ASOSS) with Hurst parameter H=1-β/2, 0<β<1 if the autocorrelation function satisfies
(2.3)limm→∞r(m)(τ)=r(τ),
where r(τ)=[(τ+1)2-β-2τ2-β+(τ-1)2-β]/2 and m∈Z+.In the field of network traffic theory, it is more practical to use ASOSS.


## 2.2. Hurst Parameter Estimation

To date, several methods have been proposed to estimate the Hurst parameter. Some of the most popular ones include the aggregated variance, local whittle, and the wavelet-based methods [17–21]. In this paper, we use the method proposed by Li [11] to estimate the Hurst parameter of network traffic. The estimation process is summarized as follows. For more information please refer to [11].Letr(τ) be the autocorrelation function of xi. Then
(2.4)r(τ)~cτ(2H-2),
where ~ stands for the asymptotical equivalence under the limit τ→∞, c>0, and H∈(0.5,1).By taking fractional Gaussian noise as an approximate model ofxi, one has
(2.5)σxi(m)2≈m2H-2σxi2,
where σxi(m)2 and σxi2 are the variances of m-order aggregate process xi(m) and xi.Divide the traffic seriesxi into N nonoverlapping sections, and each section is further divided into W nonoverlapping segments. Then the autocorrelation function of the wth segment in the nth section is given by(2.6)r(τ;Hw(n))=0.5[|τ+1|2Hw(n)-2|τ|2Hw(n)+|τ-1|2Hw(n)],
where Hw(n) is the Hurst parameter of the wth segment in the nth section traffic piece. Let J[Hw(n)]=∑τ[r(τ;Hw(n))-r(τ)]2 be the cost function. Then one has(2.7)Hw(n)=argminJ[Hw(n)].AveragingHw(n) in terms of w yields(2.8)H(n)=1W∑w=1WHw(n),
where H(n)(n=1,…,N) represents the Hurst parameter in the nth section.


## 3. DDoS Detection Based on Hurst Variation

Given discrete network traffic trace time seriesX={xi,i∈Z+}, Y={yi,i∈Z+} and Z={zi,i∈Z+}, let X and Y be normal traffic and abnormal traffic, respectively and Z the DDoS flood attack traffic during transition process of attacking. X and Z are uncorrelated [11], so Y can be expressed as Y=X+Z.Figure1 illustrates the components of normal traffic, attack traffic, and abnormal traffic. xi(p) represents the number of bytes sent out by node p at time i for normal network services, zi(q) stands for the number of bytes sent out by node q at time i for DDoS flood attack, and yi is the total traffic the target received at time i.Figure 1
Composition of normal and attack traffic.Based on the theorems in [22], we understand that no matter whether Z is a self-similar process or not, as long as X is a second-order stationary self-similar process, Y will be a self-similar process, but the degree of self-similarity may change. Let rX, rZ, and rY be the autocorrelation functions of X, Z, and Y, respectively. Li in [11] proved that during the transition process of attacking, ∥rY-rX∥ is significant, where rY=rX+rZ. For each value of Hurst parameter in the range of H∈(0.5,1), there is exactly one corresponding autocorrelation function [23]. Therefore, ∥rY-rX∥ is significant means that ∥HY-HX∥ changes significantly when attack occurs, where HY and HX are the Hurst parameters of Y and X, respectively. Based on this observation, we propose a DDoS detection method by monitoring the Hurst variation ΔH=∥HY-HX∥ in this paper. The details of the detection process are explained as follows.After the Hurst parameter estimation of each section using (2.7), we apply autoregressive (AR) model to determine the self-similarity of traffic without attacks. That is,(3.1)Ĥ(n)=∑k=1QbkH(n-k),
where Ĥ(n) is the estimated Hurst parameter of normal traffic section n,Q is the order of AR model, and {bk} are the coefficients of AR model, which can be obtained by using the least-squares method [24]. Other models such as moving average (MA) model and autoregressive moving average (ARMA) model also can be used in our method in the same way.Since the Hurst parameterH(n) without any attack follows Gaussian distribution in most cases for W>10 [11], the probability distribution function of H(n) is given by(3.2)p(H(n))=12πσHe-[H(n)-μH]2/2σH2,
where(3.3)μH=1N∑n=1NH(n),σH2=1N∑n=1N[H(n)-μH]2,
where N is the number of traffic section. μH and σH2 are the mean and variance of the Hurst parameter H(n), respectively.Using linear estimation, the change of self-similarityΔH(n) is given by(3.4)ΔH(n)=Ĥ(n)-H(n)=∑k=1QbkH(n-k)-H(n),
which can be regarded as the sum of independent Gaussian variables. So ΔH(n) also follows Gaussian distribution. The mean and variance of ΔH(n) are obtained by(3.5)μΔH=μH∑k=1Qbk-μH=μH(∑k=1Qbk-1),σΔH2=σH2∑k=1Qbk2+σH2=σH2(∑k=1Qbk2+1).
So the probability distribution function of ΔH(n) is expressed by(3.6)p(ΔH)=12πσΔHe-[ΔH(n)-μΔH]2/2σΔH2.The attack detection can be formulated as the following hypothesis testing problem.(A0)
The change of self-similarityΔH(n) is within a threshold indicating normal network traffic.(A1)
The change of self-similarityΔH(n) is outside the threshold indicating abnormal network traffic caused by DDoS attacks.It can be seen that a proper threshold ofΔH(n) is the key to successfully detect DDoS attacks. The threshold is also the change point of Hurst parameter whereby Hurst variation beyond this point implies DDoS attack. In the next section, we propose two methods for change point detection, one based on order statistic and the other based on maximum likelihood estimate.


## 4. Determining Change Point of LRD Traffic

In the following discussion, the change point of self-similarity is equivalent to the threshold that is used to distinguish attack traffic from normal traffic. We propose two methods to determine the change point and calculate the associated detection rate for one method and false alarm rate for the other method.


### 4.1. Order Statistic-Based Detection

For order statistic-based detection,ΔH(n)(n=1,2,…,N) are first sorted in an increasing order to N reference cells as(4.1)ΔH(1)≤ΔH(2)≤⋯≤ΔH(ς)≤⋯≤ΔH(N).
The detection threshold is obtained by selecting the ζth-order-ranked ΔH(ς) to represent the normal traffic plus measured noise. The input is multiplied to that cell by a scalar factor λ, and the threshold θOS is expressed by(4.2)θOS=λΔH(ς).The traffic in sectionn is considered normal if the change of self-similarity ΔH(n)<θOS; otherwise, the traffic is considered abnormal, indicating possible attacks in that section. ΔH(ς) is a random variable, and its probability distribution function is expressed by(4.3)p[ΔH(ς)]=ς(Nς)[P(ΔH)]ς-1[1-P(ΔH)]N-ςp(ΔH),
where p(ΔH) is the probability distribution function of ΔH(n), and P(ΔH) is the distribution function of ΔH(n).We define the term detection as correctly recognizing an abnormal sign. The detection ratepd is obtained by averaging the conditional probability of detection under the given threshold θOS over all possible values of the threshold. That is,(4.4)pd=∫θOS+∞[∫θOS+∞p(ΔH)dΔH]p[ΔH(ς)]dΔH(ς).Substituting (3.6) and (4.3) into (4.4) yields (4.5)pd=ς(Nς)∫θOS+∞[∫θOS+∞12πσΔHe-[ΔH(n)-μΔH]2/2σΔH2dΔH]×[∫-∞ΔH12πσΔHe-[ΔH(n)-μΔH]2/2σΔH2dΔH]ς-1×[1-∫-∞ΔH12πσΔHe-[ΔH(n)-μΔH]2/2σΔH2dΔH]N-ς12πσΔHe-[ΔH(n)-μΔH]2/2σΔH2dΔH.


### 4.2. Maximum Likelihood Estimate-Based Detection

Considering the independence betweenΔH(n) and ΔH(n′), (n≠n′), the joint probability density function of ΔH is obtained by(4.6)pjoint(ΔH)=∏n=1Np[ΔH(n)]=1(2π)N/2σΔHNe-∑n=1N[ΔH(n)-μΔH]2/2σΔH2.
Taking the natural logarithm on both sides of (4.6), we have(4.7)ln[pjoint(ΔH)]=ln(1(2π)N/2σΔHNe-∑n=1N[ΔH(n)-μΔH]2/2σΔH2)=-(N2ln(2π)+NlnσΔH+12σΔH2∑n=1N[ΔH(n)-μΔH]2).
In order to get the maximum likelihood estimate (MLE) of μΔH and σΔH2, we have(4.8)∂ln[pjoint(ΔH)]∂μΔH=1σΔH2∑n=1N[μΔH-ΔH(n)]=0,∂ln[pjoint(ΔH)]∂σΔH2=12(σΔH2)2∑n=1N[ΔH(n)-μΔH]2N2σΔH2=0.
By solving (4.8), one has(4.9)μΔHMLE=1N∑n=1NΔH(n),σΔHMLE2=1N∑n=1N[ΔH(n)-μΔH-MLE]2.
So the probability distribution function of ΔH(n) is expressed by(4.10)p(ΔHMLE)=12πσΔHMLEe-[ΔH(n)-μΔHMLE]2/2σΔHMLE2.Let the detection threshold beθMLE. The traffic in section n is considered normal if the change of self-similarity ΔH(n)<θMLE; otherwise, the traffic is considered abnormal, indicating possible attacks in that section.Define false alarm as mistakenly recognizing a normal traffic as abnormal traffic. The false alarm ratepf of the proposed detection system is expressed by(4.11)pf=p(θMLE<ΔH(n))=∫θMLE+∞12πσΔHMLEe-[ΔH(n)-μΔHMLE]2/2σΔHMLE2dΔH.
So when given the preselected false alarm rate pf, the detection threshold θMLE is given by(4.12)θMLE=μΔHMLE+Φ(1-pf)σΔHMLE,
where Φ is the standard normal distribution function.


## 4.1. Order Statistic-Based Detection

For order statistic-based detection,ΔH(n)(n=1,2,…,N) are first sorted in an increasing order to N reference cells as(4.1)ΔH(1)≤ΔH(2)≤⋯≤ΔH(ς)≤⋯≤ΔH(N).
The detection threshold is obtained by selecting the ζth-order-ranked ΔH(ς) to represent the normal traffic plus measured noise. The input is multiplied to that cell by a scalar factor λ, and the threshold θOS is expressed by(4.2)θOS=λΔH(ς).The traffic in sectionn is considered normal if the change of self-similarity ΔH(n)<θOS; otherwise, the traffic is considered abnormal, indicating possible attacks in that section. ΔH(ς) is a random variable, and its probability distribution function is expressed by(4.3)p[ΔH(ς)]=ς(Nς)[P(ΔH)]ς-1[1-P(ΔH)]N-ςp(ΔH),
where p(ΔH) is the probability distribution function of ΔH(n), and P(ΔH) is the distribution function of ΔH(n).We define the term detection as correctly recognizing an abnormal sign. The detection ratepd is obtained by averaging the conditional probability of detection under the given threshold θOS over all possible values of the threshold. That is,(4.4)pd=∫θOS+∞[∫θOS+∞p(ΔH)dΔH]p[ΔH(ς)]dΔH(ς).Substituting (3.6) and (4.3) into (4.4) yields (4.5)pd=ς(Nς)∫θOS+∞[∫θOS+∞12πσΔHe-[ΔH(n)-μΔH]2/2σΔH2dΔH]×[∫-∞ΔH12πσΔHe-[ΔH(n)-μΔH]2/2σΔH2dΔH]ς-1×[1-∫-∞ΔH12πσΔHe-[ΔH(n)-μΔH]2/2σΔH2dΔH]N-ς12πσΔHe-[ΔH(n)-μΔH]2/2σΔH2dΔH.


## 4.2. Maximum Likelihood Estimate-Based Detection

Considering the independence betweenΔH(n) and ΔH(n′), (n≠n′), the joint probability density function of ΔH is obtained by(4.6)pjoint(ΔH)=∏n=1Np[ΔH(n)]=1(2π)N/2σΔHNe-∑n=1N[ΔH(n)-μΔH]2/2σΔH2.
Taking the natural logarithm on both sides of (4.6), we have(4.7)ln[pjoint(ΔH)]=ln(1(2π)N/2σΔHNe-∑n=1N[ΔH(n)-μΔH]2/2σΔH2)=-(N2ln(2π)+NlnσΔH+12σΔH2∑n=1N[ΔH(n)-μΔH]2).
In order to get the maximum likelihood estimate (MLE) of μΔH and σΔH2, we have(4.8)∂ln[pjoint(ΔH)]∂μΔH=1σΔH2∑n=1N[μΔH-ΔH(n)]=0,∂ln[pjoint(ΔH)]∂σΔH2=12(σΔH2)2∑n=1N[ΔH(n)-μΔH]2N2σΔH2=0.
By solving (4.8), one has(4.9)μΔHMLE=1N∑n=1NΔH(n),σΔHMLE2=1N∑n=1N[ΔH(n)-μΔH-MLE]2.
So the probability distribution function of ΔH(n) is expressed by(4.10)p(ΔHMLE)=12πσΔHMLEe-[ΔH(n)-μΔHMLE]2/2σΔHMLE2.Let the detection threshold beθMLE. The traffic in section n is considered normal if the change of self-similarity ΔH(n)<θMLE; otherwise, the traffic is considered abnormal, indicating possible attacks in that section.Define false alarm as mistakenly recognizing a normal traffic as abnormal traffic. The false alarm ratepf of the proposed detection system is expressed by(4.11)pf=p(θMLE<ΔH(n))=∫θMLE+∞12πσΔHMLEe-[ΔH(n)-μΔHMLE]2/2σΔHMLE2dΔH.
So when given the preselected false alarm rate pf, the detection threshold θMLE is given by(4.12)θMLE=μΔHMLE+Φ(1-pf)σΔHMLE,
where Φ is the standard normal distribution function.


## 5. Experiments and Analysis

### 5.1. Data Preparation

To evaluate the proposed detection methods, we use two traffic data sets from DARPA 1999 [25]. The DARPA 1999 data sets are from the Information Systems Technology Group, MIT Lincoln Laboratory, under DARPA ITO and Air Force Research Laboratory. These traffic data sets are the first standard for the evaluation of computer network intrusion detection systems. The first traffic set collected from 8:20:00.0 to 11:10:39, 1 March (Monday), 1999, named DARPA1999-week1-Monday-inside, is an attack free series. The second traffic set collected from 8:20:00.0 to 16:24:41.5, 8 March (Monday), 1999, named DARPA1999-week2-Monday-inside, is an attack contained series. 3 types of DDoS attacks are contained in this data set, which are pod, back, and land separately. We rename the first-attack free traffic set as D99-W1-1-i and second attack contained traffic set as D99-W2-1-i for short. The traffic traces for these two data sets are displayed in Figure 2. The merging time scale is 100 ms.Figure 2
The two traffic traces used in the test.


### 5.2. Test Results and Analysis

After the 100 ms merging, the number of data in D99-W1-1-i is 102400 and the number of data in D99-W2-1-i is 290816. Combine these two traffic sets into one and name it as D99. D99 is divided into 64 sections (N=64) and each section is further divided into 12 segments (W=12). So the length of each traffic segment is 512. We use (2.7) to estimate the Hurst parameter Hw(n) of the wth traffic segment in the nth section (w=1,2,…,W and n=1,2,…,N), then average the Hw(n) in terms of w. After that, we obtain the Hurst parameter H(n) in the nth section, as shown in Figure 3.Figure 3
Hurst parameters of traffic D99.We apply AR model with orderQ(Q=10) to estimate the Hurst parameter of the traffic. The Hurst variation ΔH(n) of the nth traffic section is obtained using (3.4). The results are shown in Figure 4.Figure 4
Hurst variation of traffic D99.For the order statistic-based detection method, we first sortΔH(n) in an increasing order and then choose the scale factor λ=1.2. After selecting a value ζ,the detection threshold θOS is calculated according to (4.2). Figure 5 shows the thresholds when ζ is 40, 45, and 50, respectively.Figure 5
Detection thresholds based on order statistic.Form Figure5, we can see that when ζ is smaller (ζ=40), the detection threshold is lower. In this case, more traffic sections will have Hurst variations above the threshold thus more attacks are declared. However, note that a smaller ζ may also introduce more false alarms, mistakenly recognizing more normal traffic as attack traffic.For the maximum likelihood estimate-based detection, we compute the detection thresholdθMLE using (4.12). Figure 6 shows the resulted thresholds when the pre-selected false alarm rate pf is 1%, 5%, and 10%, respectively.Figure 6
Detection thresholds based on maximum likelihood estimate.Form Figure6, we can see that when the pre-selected false alarm rate pf is higher (pf=10%), the resulted threshold is lower. This is in accordance with our expectation because when the pre-selected false alarm rate is high, it is allowed to mistakenly treat some normal traffic as attacks, thus the detection threshold is low.Figure7 shows the detection rate pd versus false alarm rate pf for both of the detection methods. We can see from the figure that both of the two detection methods can achieve reasonable detection rate, but the detection performance of maximum likelihood estimate-based method is better than the order statistic-based method. Meanwhile, we can see that for both detection methods, a minor increase of the pf results in a significant increase in pd when pf is lower than 0.1. Which means if we allow a little bit more false alarm, the detection rate will be significantly improved. We can also observe from Figure 7 that when pd is higher than 0.9, a minor increase in pd will require a significant increase in pf. That is, if we want to improve the detection rate in the range greater than 0.9, we have to tolerate much more false alarms.Figure 7
Detection performance.


### 5.3. Comparison with Existing Detection Methods

In this section, we compare our proposed two detection methods with Allen's method [26] and Ren's method [27], for these are two well-known self-similarity-based detection methods in the literature. Both of these methods define a range of Hurst parameter for normal traffic. For Allen's method, the Hurst range is (0.5, 0.99) and the range is (0.65, 0.85) in Ren's method. Traffic section with a Hurst outside the range is treated as abnormal traffic.Table1 compares the detection performance of Allen's method, Ren's method, and our proposed methods. Ren's detection method achieves higher detection rate pd than Allen's method at the cost of slightly higher false alarm rate pf. We first use the Allen's false alarm rate 34% as the false alarm rate of the proposed two detection methods. The proposed order statistic-based detection method can archive detection rate as high as 87%, and maximum likelihood estimate-based detection method archives detection rate as high as 92%, both higher than the detection rate of Allen's method. Similarly, we use the Ren's false alarm rate 38% as the false alarm rate of the proposed two detection methods. The detection rates of the proposed detection methods are also higher than that of the Ren's method.Table 1
Comparisons of detection performance.
Detection methodpfpdAllen34%80%Order statistic-based detection34%87%Maximum likelihood estimate-based detection34%92%Ren38%89%Order statistic-based detection38%91%Maximum likelihood estimate-based detection38%96%


## 5.1. Data Preparation

To evaluate the proposed detection methods, we use two traffic data sets from DARPA 1999 [25]. The DARPA 1999 data sets are from the Information Systems Technology Group, MIT Lincoln Laboratory, under DARPA ITO and Air Force Research Laboratory. These traffic data sets are the first standard for the evaluation of computer network intrusion detection systems. The first traffic set collected from 8:20:00.0 to 11:10:39, 1 March (Monday), 1999, named DARPA1999-week1-Monday-inside, is an attack free series. The second traffic set collected from 8:20:00.0 to 16:24:41.5, 8 March (Monday), 1999, named DARPA1999-week2-Monday-inside, is an attack contained series. 3 types of DDoS attacks are contained in this data set, which are pod, back, and land separately. We rename the first-attack free traffic set as D99-W1-1-i and second attack contained traffic set as D99-W2-1-i for short. The traffic traces for these two data sets are displayed in Figure 2. The merging time scale is 100 ms.Figure 2
The two traffic traces used in the test.


## 5.2. Test Results and Analysis

After the 100 ms merging, the number of data in D99-W1-1-i is 102400 and the number of data in D99-W2-1-i is 290816. Combine these two traffic sets into one and name it as D99. D99 is divided into 64 sections (N=64) and each section is further divided into 12 segments (W=12). So the length of each traffic segment is 512. We use (2.7) to estimate the Hurst parameter Hw(n) of the wth traffic segment in the nth section (w=1,2,…,W and n=1,2,…,N), then average the Hw(n) in terms of w. After that, we obtain the Hurst parameter H(n) in the nth section, as shown in Figure 3.Figure 3
Hurst parameters of traffic D99.We apply AR model with orderQ(Q=10) to estimate the Hurst parameter of the traffic. The Hurst variation ΔH(n) of the nth traffic section is obtained using (3.4). The results are shown in Figure 4.Figure 4
Hurst variation of traffic D99.For the order statistic-based detection method, we first sortΔH(n) in an increasing order and then choose the scale factor λ=1.2. After selecting a value ζ,the detection threshold θOS is calculated according to (4.2). Figure 5 shows the thresholds when ζ is 40, 45, and 50, respectively.Figure 5
Detection thresholds based on order statistic.Form Figure5, we can see that when ζ is smaller (ζ=40), the detection threshold is lower. In this case, more traffic sections will have Hurst variations above the threshold thus more attacks are declared. However, note that a smaller ζ may also introduce more false alarms, mistakenly recognizing more normal traffic as attack traffic.For the maximum likelihood estimate-based detection, we compute the detection thresholdθMLE using (4.12). Figure 6 shows the resulted thresholds when the pre-selected false alarm rate pf is 1%, 5%, and 10%, respectively.Figure 6
Detection thresholds based on maximum likelihood estimate.Form Figure6, we can see that when the pre-selected false alarm rate pf is higher (pf=10%), the resulted threshold is lower. This is in accordance with our expectation because when the pre-selected false alarm rate is high, it is allowed to mistakenly treat some normal traffic as attacks, thus the detection threshold is low.Figure7 shows the detection rate pd versus false alarm rate pf for both of the detection methods. We can see from the figure that both of the two detection methods can achieve reasonable detection rate, but the detection performance of maximum likelihood estimate-based method is better than the order statistic-based method. Meanwhile, we can see that for both detection methods, a minor increase of the pf results in a significant increase in pd when pf is lower than 0.1. Which means if we allow a little bit more false alarm, the detection rate will be significantly improved. We can also observe from Figure 7 that when pd is higher than 0.9, a minor increase in pd will require a significant increase in pf. That is, if we want to improve the detection rate in the range greater than 0.9, we have to tolerate much more false alarms.Figure 7
Detection performance.


## 5.3. Comparison with Existing Detection Methods

In this section, we compare our proposed two detection methods with Allen's method [26] and Ren's method [27], for these are two well-known self-similarity-based detection methods in the literature. Both of these methods define a range of Hurst parameter for normal traffic. For Allen's method, the Hurst range is (0.5, 0.99) and the range is (0.65, 0.85) in Ren's method. Traffic section with a Hurst outside the range is treated as abnormal traffic.Table1 compares the detection performance of Allen's method, Ren's method, and our proposed methods. Ren's detection method achieves higher detection rate pd than Allen's method at the cost of slightly higher false alarm rate pf. We first use the Allen's false alarm rate 34% as the false alarm rate of the proposed two detection methods. The proposed order statistic-based detection method can archive detection rate as high as 87%, and maximum likelihood estimate-based detection method archives detection rate as high as 92%, both higher than the detection rate of Allen's method. Similarly, we use the Ren's false alarm rate 38% as the false alarm rate of the proposed two detection methods. The detection rates of the proposed detection methods are also higher than that of the Ren's method.Table 1
Comparisons of detection performance.
Detection methodpfpdAllen34%80%Order statistic-based detection34%87%Maximum likelihood estimate-based detection34%92%Ren38%89%Order statistic-based detection38%91%Maximum likelihood estimate-based detection38%96%


## 6. Conclusion

In this paper, we have proposed a DDoS detection method by monitoring Hurst variation based on Li's work on DDoS attack detection. Meanwhile, we have discussed two methods for determining the change point of LRD traffic, which can be used to distinguish attack traffic from normal traffic. Experiments have been conducted to evaluate the performance of our proposed scheme, and the test results show that the proposed detection methods outperform existing self-similarity based detection methods, and can significantly enhance the reliability and robustness of the DDoS flood attack detection.



---

*Source: 962435-2010-06-28.xml*