Detecting DDOS Attack Based On Network Self-Similarity

Nowadays Distributed Deny Of Service (DDOS) attacks have become to be one of the greatest troubles in Network Security. There seem to be no substantial improvement in anti-DDOS research on attack preventing, detecting & retorting yet, nor did any effective or nicety method appear to predict the DDOS attack in time. This paper brings up a method for DDOS inspecting and estimating through real-time model building and dynamically data analyzing, which is based on the theory of network self-similarity. By adopting the real-time rescaled range (RRS) algorithm developed from the RS method, we do the simulation work using Fractional Gaussian noise (FGN) and real network traffic data collected from LAN and WAN. It shows the method we bring up can differentiate normal network traffic and DDOS attack traffic effectively and precisely in most situation, and has provided a new way to detect and prevent DDOS attack duly and precisely. Compared with the traditional anti-DDOS method, it doesn't need to inspect the content of the packet, so has more efficiency and can be used on the node with huge traffic. In the next step we'll optimize the method further and construct a whole set of mechanism in DDOS detecting and blocking based on it.