A System for Denial-of-Service Attack Detection Based on Multivariate Correlation Analysis

A System for Denial-of-Service Attack DetectionBased on Multivariate Correlation AnalysisZhiyuan Tan, Aruna Jamdagni, Xiangjian He, Senior Member, IEEE,Priyadarsi Nanda, Member, IEEE, and Ren Ping Liu, Member, IEEE,

AbstractInterconnected systems, such as Web servers, database servers, cloud computing servers etc, are now under threads from network attackers. As one of most common and aggressive means, Denial-of-Service (DoS) attacks cause serious impact on these computing systems. In this paper, we present a DoS attack detection system that uses Multivariate Correlation Analysis (MCA) for accurate network traffic characterization by extracting the geometrical correlations between network traffic features. Our MCA-based DoS attack detection system employs the principle of anomaly-based detection in attack recognition. This makes our solution capable of detecting known and unknown DoS attacks effectively by learning the patterns of legitimate network traffic only. Furthermore, a triangle-area-based technique is proposed to enhance and to speed up the process of MCA. The effectiveness of our proposed detection system is evaluated using KDD Cup 99 dataset, and the influences of both non-normalized data and normalized data on the performance of the proposed detection system are examined. The results show that our system outperforms two other previously developed state-of-the-art approaches in terms of detection accuracy.Existing SystemInterconnected systems, such as Web servers, database servers, cloud computing servers etc., are now under threads from network attackers. As one of most common and aggressive means, Denial-of-Service (DoS) attacks cause serious impact on these computing systems.Disadvantages of the existing systemThe existing method of detecting a DoS attack involves a complicated and labor intensive task of keeping the signature database updated because signature generation is a manual process and heavily involves network security expertise.The present system relies on Misuse-based detection, which detect attacks by monitoring network activities and looking for matches with the existing attack signatures. This method fails to detect novel-attacks.Proposed SystemWe present a DoS attack detection system that uses Multivariate Correlation Analysis (MCA) for accurate network traffic characterization by extracting the geometrical correlations between network traffic features. Our MCA-based DoS attack detection system employs the principle of anomaly-based detection in attack recognition. This makes our solution capable of detecting known and unknown DoS attacks effectively by learning the patterns of legitimate network traffic only. Furthermore, a triangle-area-based technique is proposed to enhance and to speed up the process of MCA. The effectiveness of our proposed detection system is evaluated using KDD Cup 99 dataset, and the influences of both non-normalized data and normalized data on the performance of the proposed detection system are examined. The results show that our system outperforms two other previously developed state-of-the-art approaches in terms of detection accuracy.Advantages of proposed systemThis makes our solution capable of detecting known and unknown DoS attacks effectively by learning the patterns of legitimate network traffic only.The results show that our system outperforms two other previously developed state-of-the-art approaches in terms of detection accuracy.To find various attacks from the user to avoid Network Intrusion.

Problem StatementThe objective of DDoS attacks is to consume resources, such as memory, CPU processing space, or network bandwidth, in an attempt to make them unreachable to end users by blocking network communication or denying access to services.ImplementationImplementation is the stage of the project when the theoretical design is turned out into a working system. Thus it can be considered to be the most critical stage in achieving a successful new system and in giving the user, confidence that the new system will work and be effective. The implementation stage involves careful planning, investigation of the existing system and its constraints on implementation, designing of methods to achieve changeover and evaluation of changeover methodsArchitectureSTEP 1:Basic feature Generation of Individual RecordsTriangle Area Map Generation for Individual RecordsNoNormal Profile GenerationAttack Detection for Individual RecordsTested Profile Generation for Individual RecordsFeatureNormalizationNormal ProfilesNormalized FeaturesRaw/Original FeaturesTraining PhaseTest PhaseNetwork TrafficSTEP 2:Multivariate Correlation AnalysisSTEP 3:Decision MakingModulesUser ModuleMultivariate Correlation AnalysisDetection MechanismsComputational complexity And Time Cost Analysis

Module DescriptionUser ModuleIn this module, Users are having authentication and security to access the detail which is presented in the ontology system. Before accessing or searching the details user should have the account in that otherwise they should register first.Multivariate Correlation AnalysisDoS attack traffic behaves differently from the legitimate network traffic, and the behavior of network traffic is reflected by its statistical properties. To well describe these statistical properties, we present a novel Multivariate Correlation Analysis (MCA) approach in this section. This MCA approach employs triangle area for extracting the correlative information between the features within an observed data object.Detection MechanismsWe present a threshold-based anomaly detector, whose normal profiles are generated using purely legitimate network traffic records and utilized for future comparisons with new incoming investigated traffic records. The dissimilarity between a new incoming traffic record and the respective normal profile is examined by the proposed detector. If the dissimilarity is greater than a pre-determined threshold, the traffic record is flagged as an attack. Otherwise, it is labeled as a legitimate traffic record. Clearly, normal profiles and thresholds have direct influence on the performance of a threshold-based detector. A low quality normal profile causes an inaccurate characterization to legitimate network traffic. Thus, we first apply the proposed trianglearea- based MCA approach to analyze legitimate network traffic, and the generated TAMs are then used to supply quality features for normal profile generation.Computational complexity And Time Cost AnalysisWe conduct an analysis on the computational complexity and the time cost of our proposed MCA-based detection system. On one hand, as discussed in, triangle areas of all possible combinations of any two distinct features in a traffic record need to be computed when processing our proposed MCA. The former technique extracts the geometrical correlations hidden in individual pairs of two distinct features within each network traffic record, and offers more accurate characterization for network traffic behaviors. The latter technique facilitates our system to be able to distinguish both known and unknown DoS attacks from legitimate network traffic.Minimum Hardware Configuration of the proposed systemProcessor : Intel/AMDSpeed : 1.1 GHzRAM : 256 MBHard Disk : 20 GBKeyboard : Standard KeyboardMouse : Standard MouseMonitor : SVGA/LCDSoftware Configuration of the proposed systemOperating System : WindowsJava Version: JDK 1.7/1.8Application Server : Tomcat v6/7 Front End : HTML, Java, JSP, CSSScripts : JavaScriptIDE: EclipseDatabase : MySQL 5.5Database Connectivity : JDBCReferencesV. Paxson, Bro: A System for Detecting Network Intruders in Realtime, Computer Networks, vol. 31, pp. 2435-2463, 1999.P. Garca-Teodoro, J. Daz-Verdejo, G. Maci-Fernndez, and E. Vzquez, Anomaly-based Network Intrusion Detection: Techniques, Systems and Challenges, Computers & Security, vol. 28, pp. 18-28, 2009.D. E. Denning, An Intrusion-detection Model, IEEE Transactions on Software Engineering, pp. 222-232, 1987.K. Lee, J. Kim, K. H. Kwon, Y. Han, and S. Kim, DDoS attack detection method using cluster analysis, Expert Systems with Applications, vol. 34, no. 3, pp. 1659-1665, 2008.A. Tajbakhsh, M. Rahmati, and A. Mirzaei, Intrusion detection using fuzzy association rules, Applied Soft Computing, vol. 9, no. 2, pp. 462-469, 2009.