DDoS Attack Detection Based on RLT Features

Abstract

To use SVM to detect DDoS precisely, the features vector that can distinguish normal stream from attack stream is required. According to the characters of DDoS, a group of relative values features (RLT features) are proposed. For indicating the existence and intensity of DDoS attack simultaneously, multi-class SVM (MCSVM) is introduced to DDoS detection. As shown in the emulation experiments, our method can detect various DDoS attacks effectively and indicate the attack intensity. The detection result is better than other present detection measures. Because RLT features include more attack information than the detection measures using single attack character, a better detection result is available.