Method and system for UDP flood attack detection
A system and method is provided to identify UDP attacks. A processor determines a spectral density of packet timing intervals, a natural distance between the spectral density and a uniform distribution, and a non-linear amplifier applying a non-linear amplification to the natural distance to detect a denial-of-service attack. It uses the concept of traffic statistics analysis, i.e., spectral densities of arrived-packet timing intervals, calculates the KL-distance measurement and makes decision based on the output of a non-linear Gaussian amplifier, with which one can easily adjust the amplifier via selecting different parameters of mean and variance to satisfy system requirements of false-positive and false-negative UDP attack detections.
1. A method for detecting distributed denial-of-service attacks, the method comprising:
determining a spectral density of packet timing intervals using a computer processor,
determining, using the computer processor, a natural distance between the spectral density and a uniform distribution, and
detecting, using the computer processor, a denial-of-service attack based on a non-linear amplification of the natural distance.
2. The method of claim 1 , wherein the natural distance has side values and center values, and the non-linear amplification suppresses the side values and amplifies the center values.
3. A detector for detecting distributed denial-of-service attacks, the system comprising: a computer processor configured to determine a spectral density of packet timing intervals, a natural distance between the spectral density and a uniform distribution, and a non-linear amplifier configured to apply a non-linear amplification to the natural distance to detect a denial-of-service attack.
4. The detector of claim 3 , wherein said processor is configured to determine a Kullback-Leibler distance between the spectral density and the uniform distribution.
5. The detector of claim 3 , wherein said processor is configured to determine that a denial-of-service attack is detected if the non-linear amplification of the natural distance is above a threshold.
6. The method of claim 1 , wherein said step of determining a natural distance comprises determining a Kullback-Leibler distance between the spectral density and the uniform distribution.
7. The method of claim 1 , further comprising determining that a denial-of-service attack is detected if the non-linear amplification of the natural distance is above a threshold.