DDoS Attacks Defense System Using Information Metrics

A Distributed Denial-of-Service (DDoS) attack is a distributed, coordinated attack on the availability of services of a target system or network that is launched indirectly through many compromised computing systems. A low-rate DDoS attack is an intelligent attack that the attacker can send attack packets to the victim at a sufficiently low rate to elude current anomaly-based detection. An information metric can quantify the differences of network traffic with various probability distributions. In this paper, an anomaly-based approach using two new information metrics such as the generalized entropy metric and the information distance metric, to detect low-rate DDoS attacks by measuring the difference between legitimate traffic and attack traffic is proposed. DDoS attacks detection metric is combined with IP traceback algorithm to form an effective collaborative defense mechanism against DDoS attacks.