A novel approach for a Distributed Denial of Service Detection Engine

In our present work we present some of the most popular data fusion algorithms that have inspired us to build an innovative Distributed Denial of Service (DDoS) Detection Engine. Our approach is based on the mathematical ground of Dempster-Shafer’s Theory of Evidence (D-S). Using a set of simple heuristics to feed our D-S inference engine we attempt to detect flooding attacks in a set of experiments, that were conducted in real network topologies (in the National Technical University of Athens campus) using well known DDoS tools, like Stacheldraht. The use of D-S model to express beliefs in some hypotheses, the ability to add the notion of uncertainty in the system and the quantitative measurement of the belief and plausibility of our detection results are some of the main advantages that this theory adds to an Intrusion detection framework and especially in comparison to a Bayesian estimator approach. Finally, we discuss several implementation and deployment issues in the context of security management and DDoS mitigating techniques.