Detecting DDoS attack based on compensation non-parameter CUSUM algorithm - YAN Fen1~3; CHEN Yi-qun3; HUANG Hao1; YIN Xin-chun3 (Tongxin xuebao)
An effective DDoS attack detection method on target-end network was proposed.The main goal was to detect attack in early stages with few expenditure,and record the suspicious packets in the same time.For DDoS attacks which based on TCP,many unacknowledged segments will be observed in victim end.In every time period ? t,calculated the ratio of the number of unacknowledged segments and the number of all segments.Then,the statistical sequence based on time came into being.After that,an improved non-parameter recursive CUSUM algorithm was used to detect attack effi-ciently on line.In this procedure,the suspicious packets were also recorded.Experiments prove that this algorithm is fast and efficient.It has low false-positive rate and could adapt to more complex network environments.In addition,it is helpful to attack analysis and tracing.