Evaluating the Impact of Traffic Sampling on AATAC's DDoS Detection - LAAS - Laboratoire d'Analyse et d'Architecture des Systèmes
Article Dans Une Revue Journal of Cyber Security and Mobility Année : 2019

Evaluating the Impact of Traffic Sampling on AATAC's DDoS Detection

Résumé

As Distributed Denial of Service (DDoS) attack are still a severe threat for the Internet stakeholders, they should be detected with efficient tools meeting industrial requirements. We previously introduced the AATAC detector, which showed its ability to accurately detect DDoS attacks in real time on full traffic, while being able to cope with the several constraints due to an industrial operation, as time to detect, limited resources for running detection algorithms, detection autonomy for not wasting uselessly administrators' time. However, in a realistic scenario, network monitoring is done using sampled traffic. Such sampling may impact the detection accuracy or the pertinence of produced results. Consequently, in this paper, we evaluate AATAC over sampled traffic. We use five different count-based or time-based sampling techniques, and show that AATAC's resources consumption is in general greatly reduced with little to no impact on the detection accuracy. Obtained results are succinctly compared with those from FastNetMon, an open-source threshold-based DDoS detector.
Fichier principal
Vignette du fichier
RP_Journal_2245-1439_842.pdf (5.83 Mo) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-02047267 , version 1 (25-10-2019)

Identifiants

Citer

Gilles Roudiere, Philippe Owezarski. Evaluating the Impact of Traffic Sampling on AATAC's DDoS Detection. Journal of Cyber Security and Mobility, 2019, 8 (4), pp.419-438. ⟨10.13052/jcsm2245-1439.842⟩. ⟨hal-02047267⟩
52 Consultations
44 Téléchargements

Altmetric

Partager

More