Lightweight DDoS Attack Detection Using Bayesian Space-Time Correlation
Authors:
Autores
| Person role | Person | |
|---|---|---|
|
7644 |
768,754,2665
|
|
|
7643 |
768,754,2665
|
|
|
7642 |
768,754,2665
|
Informations:
Pesc publication
Title
Lightweight DDoS Attack Detection Using Bayesian Space-Time Correlation
Research area
Computer Networks
Publication type
Doctoral Thesis
Identification Number
Date
9/12/2025
Resumo
Ataques DDoS continuam sendo uma das principais fontes de problemas na Internet e seguem causando perdas financeiras significativas para organizações de todos os portes. Para mitigar seu impacto, a detecção deve, preferencialmente, ocorrer próxima à origem do ataque (por exemplo, em roteadores residenciais ou servidores de borda). No entanto, depender de inspeção de pacotes pode acarretar sérios problemas de privacidade e escalabilidade. Propomos um sistema leve para detecção de ataques DDoS que utiliza apenas contadores de bytes e pacotes de roteadores residenciais convencionais. Para detectar ataques com essa quantidade limitada de informações, nossa principal contribuição consiste em definir duas camadas de detecção: (1) um classificador de aprendizado de máquina treinado com dados de usuários residenciais e de malwares reais; (2) e um modelo hierárquico Bayesiano que explora a natureza sincronizada dos ataques DDoS ao correlacionar alarmes de múltiplas residências para validar a abordagem em ambientes reais. Coletamos dados de ataques DDoS gerando tráfego real de ataque a partir das casas de um grupo selecionado de voluntários utilizando código-fonte de malwares reais. Nesse experimento, conduzido nas residências dos voluntários ao longo de um mês, nosso sistema detectou 99,1% de todos os ataques DDoS lançados, sem alarmes falsos.
Abstract
DDoS attacks are still one of the primary sources of problems on the Internet
and continue to cause significant financial losses for organizations. To mitigate their impact, detection should preferably occur close to the attack origin, e.g., at home routers or edge servers. However, relying on packet inspection may bring serious privacy and scalability issues. We propose a lightweight system for DDoS detection that solely employs byte and packet counts from off-the-shelf home routers. To detect attacks with such a limited amount of information, our key insight consists in defining two detection layers: (1) a ML classifier trained with data from real home user and malware; (2) and a Bayesian hierarchical model that exploits the synchronized nature of DDoS attacks by correlating alarms from multiple homes to check the approach in the wild. We collect data on DDoS attacks by generating real attack traffic from the homes of a selected group of volunteers, utilizing authentic malware source code. In that experiment, conducted using the residences of volunteers and over one month, our system detected 99.1% of all DDoS attacks launched, with no false alarms.
and continue to cause significant financial losses for organizations. To mitigate their impact, detection should preferably occur close to the attack origin, e.g., at home routers or edge servers. However, relying on packet inspection may bring serious privacy and scalability issues. We propose a lightweight system for DDoS detection that solely employs byte and packet counts from off-the-shelf home routers. To detect attacks with such a limited amount of information, our key insight consists in defining two detection layers: (1) a ML classifier trained with data from real home user and malware; (2) and a Bayesian hierarchical model that exploits the synchronized nature of DDoS attacks by correlating alarms from multiple homes to check the approach in the wild. We collect data on DDoS attacks by generating real attack traffic from the homes of a selected group of volunteers, utilizing authentic malware source code. In that experiment, conducted using the residences of volunteers and over one month, our system detected 99.1% of all DDoS attacks launched, with no false alarms.
File