Quantifying the effect of incomplete information in denial of service detection

The performance loss due to incomplete information in denial of service (DoS) detection is quantified in this paper. Volumetric DoS detection is formulated as a signal detection problem. Two detectors are defined: the first operates without knowledge of the attack model and the second operates as if the attack model were known. The performance loss is quantified by comparing the two detectors. Simulation results demonstrate that the performance loss is greatest for low intensity attacks and slowly diminishes as the attack intensity increases.