{'fraction_non_alphanumeric': 0.015509103169251517, 'fraction_numerical': 0.0, 'mean_word_length': 5.081967213114754, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Using a History-based Profile to Detect and Respond to DDoS Attacks

Distributed Denial-of-Service (DDoS) attack has been identified among the most serious threat to service availability on the Internet. It prevents legitimate users from accessing the victim node by flooding and consuming network resources. In order to combat such attacks, a distributed defense mechanism is needed that will thwart the attack traffic in real time. We propose one such mechanism that when deployed is able to filter out malicious and allow legitimate traffic to the extent possible during the attack period. We characterize the network traffic and introduce a new history-based profile algorithm that filters potential attack traffic and aims to maximize the flow of legitimate traffic in the event of an attack. We investigate the features of network traffic that can be used to do such filtration. We use a Bloom filter based mechanism to efficiently implement the history-based profile model which serves to reduce the communication and computation costs. We evaluate our scheme using simulations on recent real-world traffic datasets. The experimental results demonstrate the effectiveness of our scheme. In order to improve communication and computation costs even further, we propose using three octets of the IP address instead of the whole address. We also demonstrate how using three octets of IP address impacts the accuracy, efficiency, and memory requirement of the filtering mechanism.