Fractional gaussian noise: A tool of characterizing traffic for detection purpose

Abstract

Detecting signs of distributed denial-of-service (DDOS) flood attacks based on traffic time series analysis needs characterizing traffic series using a statistical model. The essential thing about this model should consistently characterize various types of traffic (such as TCP, UDP, IP, and OTHER) in the same order of magnitude of modeling accuracy. Our previous work [1] uses fractional Gaussian noise (FGN) as a tool for featuring traffic series for the purpose of reliable detection of signs of DDOS flood attacks. As a supplement of [1], this article gives experimental investigations to show that FGN can yet be used for modeling autocorrelation functions of various types network traffic (TCP, UDP, IP, OTHER) consistently in the sense that the modeling accuracy (expressed by mean square error) is in the order of magnitude of 10 -3. © Springer-Verlag 2004.