Denial of service detection and analysis using idiotypic networks paradigm

ABSTRACT

In this paper we present a novel intrusion detection architecture based on Idiotypic Network Theory (INIDS), that aims at dealing with large scale network attacks featuring variable properties, like Denial of Service (DoS). The proposed architecture performs dynamic and adaptive clustering of the network traffic for taking fast and effective countermeasures against such high-volume attacks. INIDS is evaluated on the MIT'99 dataset and outperforms previous approaches for DoS detection applied to this set.

REFERENCES

• 1: J. P. Anderson. Computer security threat monitoring and surveillance. Technical report, James P. Anderson Co., April 1980.
• 2: H. Bersini. Why the first glass of wine is better than the seventh. In 16th International Workshop on Database and Expert Systems Applications DEXA'05, pages 100--111. Springer, 2005.
• 3: Glenn Carl , George Kesidis , Richard R. Brooks , Suresh Rai, Denial-of-Service Attack-Detection Techniques, IEEE Internet Computing, v.10 n.1, p.82-89, January 2006 [doi>10.1109/MIC.2006.5]
• 4: Leandro R. de Castro , Jonathan Timmis, Artificial Immune Systems: A New Computational Intelligence Paradigm, Springer-Verlag New York, Inc., Secaucus, NJ, 2002
• 5: http://www.iana.org/assignments/port\textendashnumbers. Internet Assigned Numbers Authority (IANA).
• 6: http://www.ll.mit.edu/IST/ideval/index.html. MIT Lincoln Laboratories data set, 1999.
• 7: N. K. Jerne. Towards a network theory of the immune system. Ann. Immunol. (Inst. Pasteur, Paris), 125C(1-2):373--389, 1974.
• 8: Jungwon Kim , Peter J. Bentley , Uwe Aickelin , Julie Greensmith , Gianni Tedesco , Jamie Twycross, Immune system approaches to intrusion detection --- a review, Natural Computing: an international journal, v.6 n.4, p.413-466, December 2007 [doi>10.1007/s11047-006-9026-4]
• 9: Jelena Mirkovic , Sven Dietrich , David Dittrich , Peter Reiher, Internet Denial of Service: Attack and Defense Mechanisms (Radia Perlman Computer Networking and Security), Prentice Hall PTR, Upper Saddle River, NJ, 2004
• 10: P. H. Mohr, N. Ryan, and J. Timmis. Exploiting immunological properties for ubiqitous computing systems. In Proceedings of 3rd International Conference on Artificial Immune Systems, ICARIS'04, pages 277--289. Springer, 2004.
• 11: M. Ostaszewski, F. Seredynski, and P. Bouvry. Coevolutionary-based mechanisms for network anomaly detection. Journal of Mathematical Modelling and Algorithms, 6(3):411--431, 2007.
• 12: T. Stibor. On the Appropriateness of Negative Selection for Anomaly Detection and Network Intrusion Detection. PhD thesis, Darmstadt University of Technology, 2006.
• 13: A. O. Tarakanov, L. B. Goncharova, and O. A. Tarakanov. A cytokine formal immune network. In Advances in Artificial Life, 8th European Conference, ECAL'05, pages 510--519. Springer, 2005.

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.3 Network Operations
          Subjects: Network monitoring

General Terms:
Security

Keywords:
denial of service, idiotypic networks