Identifying DOS attacks using data pattern analysis
During a denial of service attack, it is difficult for a firewall to differentiate legitimate packets from rogue packets, particularly in large networks carrying substantial levels of traffic. Large networks commonly use network intrusion detection systems to identify such attacks, however new virus...
| Main Authors: | , |
|---|---|
| Other Authors: | |
| Format: | Conference Paper |
| Published: |
SECAU - Security Research Centre
2008
|
| Online Access: | http://hdl.handle.net/20.500.11937/24963 |
| _version_ | 1848751574936977408 |
|---|---|
| author | Salem, Mohammed Armstrong, Helen |
| author2 | Craig Valli |
| author_facet | Craig Valli Salem, Mohammed Armstrong, Helen |
| author_sort | Salem, Mohammed |
| building | Curtin Institutional Repository |
| collection | Online Access |
| description | During a denial of service attack, it is difficult for a firewall to differentiate legitimate packets from rogue packets, particularly in large networks carrying substantial levels of traffic. Large networks commonly use network intrusion detection systems to identify such attacks, however new viruses and worms can escape detection until their signatures are known and classified as an attack. Commonly used IDS are rule based and static, and produce a high number of false positive alerts. The aim of this research was to determine if it is possible for a firewall to self-learn by analysing its own traffic patterns. Statistical analyses of firewall logs for a large network were carried out and a baseline determined. Estimated traffic levels were projected using linear regresssion and Holt-Winter methods for comparison with the baseline. Rejected traffic falling outside the projected level for the network under study could indicate an attack. The results of the research were positive with variance from the projected rejected packet levels successfully indicating an attack in the test network. |
| first_indexed | 2025-11-14T07:54:54Z |
| format | Conference Paper |
| id | curtin-20.500.11937-24963 |
| institution | Curtin University Malaysia |
| institution_category | Local University |
| last_indexed | 2025-11-14T07:54:54Z |
| publishDate | 2008 |
| publisher | SECAU - Security Research Centre |
| recordtype | eprints |
| repository_type | Digital Repository |
| spelling | curtin-20.500.11937-249632022-11-21T06:47:06Z Identifying DOS attacks using data pattern analysis Salem, Mohammed Armstrong, Helen Craig Valli Andrew Woodward During a denial of service attack, it is difficult for a firewall to differentiate legitimate packets from rogue packets, particularly in large networks carrying substantial levels of traffic. Large networks commonly use network intrusion detection systems to identify such attacks, however new viruses and worms can escape detection until their signatures are known and classified as an attack. Commonly used IDS are rule based and static, and produce a high number of false positive alerts. The aim of this research was to determine if it is possible for a firewall to self-learn by analysing its own traffic patterns. Statistical analyses of firewall logs for a large network were carried out and a baseline determined. Estimated traffic levels were projected using linear regresssion and Holt-Winter methods for comparison with the baseline. Rejected traffic falling outside the projected level for the network under study could indicate an attack. The results of the research were positive with variance from the projected rejected packet levels successfully indicating an attack in the test network. 2008 Conference Paper http://hdl.handle.net/20.500.11937/24963 SECAU - Security Research Centre fulltext |
| spellingShingle | Salem, Mohammed Armstrong, Helen Identifying DOS attacks using data pattern analysis |
| title | Identifying DOS attacks using data pattern analysis |
| title_full | Identifying DOS attacks using data pattern analysis |
| title_fullStr | Identifying DOS attacks using data pattern analysis |
| title_full_unstemmed | Identifying DOS attacks using data pattern analysis |
| title_short | Identifying DOS attacks using data pattern analysis |
| title_sort | identifying dos attacks using data pattern analysis |
| url | http://hdl.handle.net/20.500.11937/24963 |