Detection of unknown DoS attacks by Kolmogorov-complexity fluctuation

Abstract

Detection of unknown Denial-of-Service (DoS) attacks is a hard issue. What attackers do is simply to consume a large amount of target resources. This simple feature allows attackers to create a wide variety of attack flows, and hence we must find a sophisticated general metric for detection. A possible metric is Kolmogorov Complexity (KC), a measure of the size of the smallest program capable of representing the given piece of data flows because DoS attacks, known or unknown, are anyway launched by computer programs. However, there are no established DoS-detection methods which make use of this possibility. And to make matters worse, it is well known that KG cannot be rigorously computed. In this paper, we compare three different KG estimation methods including a new proposal of our own, and propose a new DoS-detection method by monitoring fluctuation of KC differentials. © Springer-Verlag Berlin Heidelberg 2005.