Detection of Application layer DDoS Attacks Based on Bayesian Classifier

One of the major challenges in networks security is detecting network attacks. The HTTP flooding attack is the most common type of DDoS attacks that targets application layer. The malicious DDoS packets are encapsulated with the huge amount of normal traffic, so this type of attack is considered the hardest one for detection. The available detection techniques for the HTTP flooding attack usually used similarity methods for traffic attributes or machine learning algorithms but these techniques are not effective especially for large scale networks. In this paper, a new detection technique is presented based on conditional probability and Bayes’ theorem. First the probability value for every normal traffic attribute is calculated. Then, we compute the conditional probability for the same attribute in any incoming connection given the occurrence of the same value in the previous normal traffic. Finally, the total probability is calculated by using the Bayes’ theorem to classify it either as normal or abnormal connection. The performance of the proposed technique is evaluated by extensive simulation in terms of its detection rate, probability of false positive and false negative.