UDP flooding attack detection using information metric measure

Abstract

UDP flooding is one of the most pursued DDoS attack among the attackers. Extensive research solutions focused on other DDoS flooding attacks could be found, but little work to deal UDP flooding attack traffic exists. Due to the stateless nature of UDP, the detection of the attack is very difficult and can effectively throttle the victim with unwanted traffic. In this paper, we present a solution to detect UDP flooding attack based on generalized entropy information metric and also determine the malicious source IP (SIP) addresses by carrying out the attack. We conduct our experiment on some captured attack traffic and the results demonstrate that the proposed solution can effectively detect UDP flooding attack along with the malicious SIP addresses.