Evaluating the Impact of Traffic Sampling on AATAC's DDoS Detection - LAAS-Réseaux et Communications Accéder directement au contenu
Communication Dans Un Congrès Année : 2018

Evaluating the Impact of Traffic Sampling on AATAC's DDoS Detection

Résumé

As Distributed Denial of Service (DDoS) attack are still a severe threat for the Internet stakeholders, they should be detected with efficient tools meeting industrial requirements. In a previous paper, we introduced the AATAC detector, which showed its ability to accurately detect DDoS attacks in real time on full traffic, while being able to cope with the several constraints due to an industrial operation. However, in a realistic scenario, network monitoring is done using sampled traffic. Such sampling may impact the detection accuracy or the pertinence of produced results. Consequently, in this paper, we evaluate AATAC over sampled traffic. We use five different count-based or time-based sampling techniques, and show that AATAC's resources consumption is in general greatly reduced with little to no impact on the detection accuracy. Obtained results are succinctly compared with those from FastNetMon, an open-source threshold-based DDoS detector.
Fichier principal
Vignette du fichier
sampling (1).pdf (447.57 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01862765 , version 1 (30-08-2018)

Identifiants

Citer

Gilles Roudiere, Philippe Owezarski. Evaluating the Impact of Traffic Sampling on AATAC's DDoS Detection. Workshop on Traffic Measurements for Cybersecurity (2018 WTMC), Aug 2018, Budapest, Hungary. pp.27-32, ⟨10.1145/3229598.3229605⟩. ⟨hal-01862765⟩
32 Consultations
12 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More