title: Network traffic anomalies automatic detection in DDoS attacks
metadata.name: dc.contributor.author
metadata.value: Orekhov, Andrey V.
metadata.lang: -
metadata.name: dc.contributor.author
metadata.value: Orekhov, Aleksey A.
metadata.lang: -
metadata.name: dc.date.accessioned
metadata.value: 2023-08-22T17:28:55Z
metadata.lang: -
metadata.name: dc.date.available
metadata.value: 2023-08-22T17:28:55Z
metadata.lang: -
metadata.name: dc.date.issued
metadata.value: 2023-06
metadata.lang: -
metadata.name: dc.identifier.citation
metadata.value: Orekhov A. V., Orekhov A. A. Network traffic anomalies automatic detection in DDoS attacks. Vestnik of Saint Petersburg University. Applied Mathematics. Computer Science. Control Processes, 2023, vol. 19, iss. 2, pp. 251–263.
metadata.lang: en_GB
metadata.name: dc.identifier.other
metadata.value: https://doi.org/10.21638/11701/spbu10.2023.210
metadata.lang: -
metadata.name: dc.identifier.uri
metadata.value: http://hdl.handle.net/11701/43832
metadata.lang: -
metadata.name: dc.description.abstract
metadata.value: Distributed denial-of-service attacks (DDoS attacks) are intrusions into computing systems of the Internet. Their purpose is to make systems of the Internet inaccessible for users. DDoS attack consist of sending many requests to a certain resource at the same time. As a result, the server cannot withstand the network load. In such situation, a provider must determine the moment when attack begins and change the traffic management strategy. Detection of the beginning of a DDoS attack is possible by using unsupervised machine learning methods and sequential statistical analysis of network activity. To activate that, convenient to use mathematical models based on discrete random processes with monotonically increasing trajectories. Random functions, which are represented in the correspondence between generalized time and the cumulative sum of network traffic or the correspondence between the total number of incoming packets and the cumulative sum of packets processed, change their type of increasing from linear to non-linear. In the first case, to parabolic or exponential, in the second case to logarithmic or arctangent. To determine the moment when the type of increasing is going to change, one can use quadratic forms of approximation-estimation tests as statistical rules.
metadata.lang: en_GB
metadata.name: dc.language.iso
metadata.value: ru
metadata.lang: en_GB
metadata.name: dc.publisher
metadata.value: St Petersburg State University
metadata.lang: en_GB
metadata.name: dc.relation.ispartofseries
metadata.value: Vestnik of St Petersburg University. Applied Mathematics. Computer Science. Control Processes;Volume 19; Issue 2
metadata.lang: -
metadata.name: dc.subject
metadata.value: traffic strategy
metadata.lang: en_GB
metadata.name: dc.subject
metadata.value: DDoS attack
metadata.lang: en_GB
metadata.name: dc.subject
metadata.value: unsupervised machine learning
metadata.lang: en_GB
metadata.name: dc.subject
metadata.value: sequential statistical analysis
metadata.lang: en_GB
metadata.name: dc.subject
metadata.value: Markov moment
metadata.lang: en_GB
metadata.name: dc.subject
metadata.value: least squares method
metadata.lang: en_GB
metadata.name: dc.title
metadata.value: Network traffic anomalies automatic detection in DDoS attacks
metadata.lang: en_GB
metadata.name: dc.type
metadata.value: Article
metadata.lang: en_GB
resources.filename: 10.pdf
resources.url: https://dspace.spbu.ru/bitstream/11701/43832/1/10.pdf
resources.format: Adobe PDF
resources.size: 411,41 kB