Predicting number of zombies in a DDoS attack using ANN based scheme

Abstract

Anomaly based DDoS detection systems construct profile of the traffic normally seen in the network, and identify anomalies whenever traffic deviate from normal profile beyond a threshold. This deviation in traffic beyond threshold is used in the past for DDoS detection but not for finding zombies. In this paper, two layer feed forward neural networks of different sizes are used to estimate number of zombies involved in a DDoS attack. The sample data used to train the feed forward neural networks is generated using NS-2 network simulator running on Linux platform. The generated sample data is divided into training data and test data and MSE is used to compare the performance of various feed forward neural networks. Various sizes of feed forward networks are compared for their estimation performance. The generalization capacity of the trained network is promising and the network is able to predict number of zombies involved in a DDoS attack with very less test error. © 2011 Springer-Verlag.