DoS and DDoS attack detection using Mathematical and Entropy Methods

Abstract

The idea behind a Denial of Service(DoS) attack is to overload or flood the system or the network with systems that the system becomes incapacitated. A Distributed Denial of Service(DDoS) attack is a similar attack with multiple systems attacking one victim. In this paper we discuss the methods to detect these attacks in a working system using mathematical and entropy based techniques. The proposed mathematical model uses both the mean and standard deviation as thresholds for classification as they work better when the data is unsymmetrical like a real working system’s network data. The proposed entropy model uses a combination of Shannon’s entropy and the mathematical threshold. This model takes care of the anomalous non-attack cases like a ping to a blocked IP address or rejected packets.