A novel detection methodology of network attack symptoms at aggregate traffic level on highspeed internet backbone links

Abstract

In this paper, we investigate the network attack traffic patterns appeared on Internet backbone links. Then, we derive two efficient measures for representing the network attack symptoms at aggregate traffic level. The two measures are the power spectrum and the packet count-to-traffic volume ratio of the aggregate traffic. And, we propose a new methodology to detect networks attack symptoms by measuring those traffic measures. Unlike existing methods based on individual packets or flows, since the proposed method is operated on the aggregate traffic level, the computational complexity can be significantly reduced and applicable to high-speed Internet backbone links.