Detection of the botnets’ low-rate DDoS attacks based on self-similarity

Sergii Lysenko (Khmelnytskyi national university)
Kira Bobrovnikova (Khmelnytskyi national university)
Serhii Matiukh (Khmelnytskyi national university)
Ivan Hurman (Khmelnytskyi national university)
Oleg Savenko (Khmelnytskyi national university)

International Journal of Electrical and Computer Engineering
Vol 10, No 4: August 2020

An article presents the approach for the botnets’ low-rate a DDoS-attacks detection based on the botnet’s behavior in the network. Detection process involves the analysis of the network traffic, generated by the botnets’ low-rate DDoS attack. Proposed technique is the part of botnets detection system – BotGRABBER system. The novelty of the paper is that the low-rate DDoS-attacks detection involves not only the network features, inherent to the botnets, but also network traffic self-similarity analysis, which is defined with the use of Hurst coefficient. Detection process consists of the knowledge formation based on the features that may indicate low-rate DDoS attack performed by a botnet; network monitoring, which analyzes information obtained from the network and making conclusion about possible DDoS attack in the network; and the appliance of the security scenario for the corporate area network’s infrastructure in the situation of low-rate attacks.