Real Time DDOS Attack Detection Using Time Series Algorithms

Abstract

DDOS attack is malicious attack in which attacker try to overwhelm the network traffic by flooding the target network. Attacker uses botnet to send large number of requests to target. DDOS attack can be in the form of TCP flood, SYN-ACK flood, HTTP flood, smurf attack. To Identify any type of DDOS attack it is necessary to differentiate between normal traffic flow and attack traffic flow. Time series forecasting and analysis helps to determine the network traffic pattern with the reference of time. Basically this patterns are learnt from historical data like data of last 30 days, data of one week, one hour, etc. This helps time series model to train on specific patterns. Here in this application two types of time series models are used to detect DDOS attack, one is stochastic time series model and another is ANN time series model respectively ARIMA model and LSTM model. Training this model with historic time series data of network traffic, this machine learning models are capable of forecasting future network traffic. If traffic of current time lapse is affected due to DDOS attack then it can be detected by trained model. By evaluating and measuring performance of models, best model for system will be deployed for early detection of attack in the system. Based on Performance of both models, best model for system is being deployed to detect DDOS attack in real time scenario.