A Distinction Method of Flooding DDoS and Flash Crowds Based on User Traffic Behavior

Discriminating Distributed Denial of Service (DDoS) from Flash Crowds (FC) is a tough and challenging problem, because there are many similarities between each other existed in network layer. In this paper, according to an extensive analysis of user traffic behavior of DDoS and FC, it can be found that some traffic abnormalities are existed between Bots and legitimate users. So a behavior-based method employed Data Mining isproposed to distinguish each other, and two public real-world datasets are used to evaluate the method. What's more, simulated traffic are produced to evaluate the method further, which is based on statistical parameters took from the two datasets and combined with two popular and common distributions together, Gaussian Distribution and Pareto Distribution. And two types of simulations are considered: Novice Simulation and Veteran Simulation. The result in Novice Simulation has almost 100% accuracy, while in Veteran Simulation, the result has a more than 98% accuracy, less than 15% FRP and 3% FNR, all of them show the proposed method could have a good accuracy and robustness. In addition, compared it with traditional methods-Entropy and Threshold methods in Veteran Simulation, the results indicate that both of them could hardly distinguish DDoS and FC, whilethe proposed method could achieve a better distinguished effect.