Combining Recurrence Quantification Analysis and Adaptive Clustering to Detect DDoS Attacks
By Marcelo Antonio Righi, Raul Ceretta Nunes
| December 09, 2019
The high number of Distributed Denial of Service (DDoS) attacks executed against a lot of nations has demanded innovative solutions to guarantee reliability and availability of internet services in cyberspace. In this sense, different methods have been used to analyze network traffic for denial of service attacks, such as statistical analysis, data mining, machine learning, and others. However, few of them explore hidden recurrence patterns in nonlinear network traffic and none of them explore it together with Adaptive Clustering. This work proposes a new method, called DDoSbyRQA, which uses the Recurrence Quantification Analysis (RQA) based on the extraction of network traffic dynamic features and combination with an Adaptive Clustering algorithm (A-Kmeans) to detect DDoS attacks. The experiments, which were performed using the Center for Applied Internet Data Analysis (CAIDA) and University of California, Los Angeles (UCLA), databases, have demonstrated the ability of the method in real-time.
Combining Recurrence Quantification Analysis and Adaptive Clustering to Detect DDoS Attacks