DDoS detection and discrimination from flash events: a compendious review

Abstract

Although there has been an immense advancement in the robustness of IT infrastructure, the organizations still face downtimes, lasting for short periods and even continuing for days. This could be due to malicious requests, deliberately sent to disrupt the services or the volume of legitimate users trying to access the website. Detection of these network traffic anomalies and then categorizing them as DDoS Attack or Flash event, is a challenging task in the front of network security researchers. This paper reviews and summarizes the details and scenarios of these anomalies. It highlights the various features, parameters and metrics used in research till date to detect these anomalies and distinguish the legitimate request from the malicious one. The intent of paper is to guide researchers in selecting efficient parameters in order to obtain accurate results with low false positives. It highlights the list of characteristics to discriminate the two traffic patterns has been proposed for better understanding of the problem. Thus, the paper is expected to help academicians and researchers find effective solution for the above-mentioned anomalous behavior of the network traffic.