Research on the detection of distributed denial of service attacks based on the characteristics of IP flow

Abstract

IP Flow is classified into the Micro-flow and the Macro-flow, which provides a way of selecting proper features used to detect DDoS. Five abstracted features' capabilities of recognizing DDoS are analyzed through experiments. With these features as inputs, a neural network classifier is used to detect DDoS. Experiments' results show that these IP Flow based features can be very helpful to DDoS detection if they are put together. © 2008 Springer Berlin Heidelberg.