One-parameter Methods for Recognizing DDoS Attacks

Abstract

In this article we deal with the use of one-parameter machine learning methods for the recognition of DDoS attacks. At the same time, we want to present the implementation of research focused on cybersecurity in the curriculum of our study engineering program Applied Network Engineering. We focused on the autoregressive coefficient of the first order autoregressive analysis and on the Hurst coefficient, which expresses the degree of self-similarity of the observed flow. We tested the ability of the coefficients to detect a change in the structure of the IP flow during a DDoS attack in time on simulated data and subsequently on several recorded real DDoS attacks which were preprocessed by our students.